@studious-lms/server 1.4.1 → 1.4.3

package/src/lib/fileUpload.ts

@@ -39,6 +39,43 @@ export interface DirectUploadFile {
   uploadSessionId: string;
 }
 
+export async function validateDirectUploadIntent(input: {
+  filePath: string;
+  uploadSessionId: string;
+  userId: string;
+}) {
+  const fileRecord = await prisma.file.findFirst({
+    where: {
+      path: input.filePath,
+      uploadSessionId: input.uploadSessionId,
+      userId: input.userId,
+      uploadExpiresAt: { gt: new Date() },
+      isOrphaned: false,
+      messageId: null,
+    },
+    select: {
+      id: true,
+      uploadStatus: true,
+    },
+  });
+
+  if (!fileRecord) {
+    throw new TRPCError({
+      code: 'FORBIDDEN',
+      message: 'Invalid or expired upload intent',
+    });
+  }
+
+  if (!['PENDING', 'UPLOADING'].includes(fileRecord.uploadStatus)) {
+    throw new TRPCError({
+      code: 'BAD_REQUEST',
+      message: 'Upload is no longer accepting data',
+    });
+  }
+
+  return fileRecord;
+}
+
 // DEPRECATED: These functions are no longer used - files are uploaded directly to GCS
 // Use createDirectUploadFile() and createDirectUploadFiles() instead
 
@@ -103,7 +140,8 @@ export async function createDirectUploadFile(
   directory?: string,
   assignmentId?: string,
   submissionId?: string,
-  announcementId?: string
+  announcementId?: string,
+  conversationId?: string
 ): Promise<DirectUploadFile> {
   try {
     // Validate file extension matches MIME type
@@ -137,7 +175,7 @@ export async function createDirectUploadFile(
     
     // Generate backend proxy upload URL (not direct GCS)
     const baseUrl = env.BACKEND_URL || 'http://localhost:3001';
-    const uploadUrl = `${baseUrl}/api/upload/${encodeURIComponent(filePath)}`;
+    const uploadUrl = `${baseUrl}/api/upload/${encodeURIComponent(filePath)}?uploadSessionId=${encodeURIComponent(uploadSessionId)}`;
     const uploadExpiresAt = new Date(Date.now() + 15 * 60 * 1000); // 15 minutes from now
     
     // Create file record in database with PENDING status
@@ -173,6 +211,9 @@ export async function createDirectUploadFile(
           announcement: {
             connect: { id: announcementId }
           }
+        }),
+        ...(conversationId && {
+          conversationId,
         })
       },
     });
@@ -330,11 +371,20 @@ export async function createDirectUploadFiles(
   directory?: string,
   assignmentId?: string,
   submissionId?: string,
-  announcementId?: string
+  announcementId?: string,
+  conversationId?: string
 ): Promise<DirectUploadFile[]> {
   try {
     const uploadPromises = files.map(file => 
-      createDirectUploadFile(file, userId, directory, assignmentId, submissionId, announcementId)
+      createDirectUploadFile(
+        file,
+        userId,
+        directory,
+        assignmentId,
+        submissionId,
+        announcementId,
+        conversationId
+      )
     );
     return await Promise.all(uploadPromises);
   } catch (error) {
@@ -348,4 +398,4 @@ export async function createDirectUploadFiles(
       message: 'Failed to create direct upload files',
     });
   }
-}
+}

package/src/lib/prisma.ts

@@ -12,13 +12,32 @@ const getLogLevel = () => {
   }
 }
 
+const getDatabaseUrl = () => {
+  try {
+    const url = new URL(env.DATABASE_URL);
+    // Reduce per-instance DB pressure in hosted/serverless environments.
+    if (env.NODE_ENV === 'production') {
+      if (!url.searchParams.has('connection_limit')) {
+        url.searchParams.set('connection_limit', '1');
+      }
+      if (!url.searchParams.has('pool_timeout')) {
+        url.searchParams.set('pool_timeout', '20');
+      }
+    }
+    return url.toString();
+  } catch {
+    return env.DATABASE_URL;
+  }
+};
+
 const prismaClientSingleton = () => {
-  // return new PrismaClient({
-  //   log: env.NODE_ENV === 'development' 
-  //     ? ['query', 'error', 'warn'] 
-  //     : ['error'],
-  // });
-  return new PrismaClient();
+  return new PrismaClient({
+    datasources: {
+      db: {
+        url: getDatabaseUrl(),
+      },
+    },
+  });
 };
 
 // Prevent multiple instances of Prisma Client in development

package/src/middleware/auth.ts

@@ -8,11 +8,28 @@ import {
   findClassWithTeacher,
 } from "../models/auth.js";
 
+function getRequestToken(headers: MiddlewareContext["ctx"]["req"]["headers"]) {
+  const userHeader = headers["x-user"];
+  if (typeof userHeader === "string") {
+    return userHeader;
+  }
+  if (Array.isArray(userHeader) && userHeader.length > 0) {
+    return userHeader[0];
+  }
+
+  const authorizationHeader = headers.authorization;
+  if (typeof authorizationHeader === "string" && authorizationHeader.startsWith("Bearer ")) {
+    return authorizationHeader.slice(7);
+  }
+
+  return null;
+}
+
 export const createAuthMiddleware = (t: any) => {
   const isAuthed = t.middleware(async ({ next, ctx }: MiddlewareContext) => {
-    const userHeader = ctx.req.headers["x-user"];
+    const token = getRequestToken(ctx.req.headers);
 
-    if (!userHeader) {
+    if (!token) {
       throw new TRPCError({
         code: "UNAUTHORIZED",
         message: "Not authenticated - no token found",
@@ -20,8 +37,6 @@ export const createAuthMiddleware = (t: any) => {
     }
 
     try {
-      const token =
-        typeof userHeader === "string" ? userHeader : userHeader[0];
       const user = await findUserBySessionToken(token);
 
       if (!user) {

package/src/middleware/security.ts

@@ -19,7 +19,7 @@ const rateLimitHandler = (req: Request, res: Response) => {
 
 // General API rate limiter - applies to all routes
 export const generalLimiter = rateLimit({
-  windowMs: 10 * 60, // 10 minutes
+  windowMs: 10 * 60 * 1000, // 10 minutes
   max: 100, // Limit each IP to 100 requests per windowMs
   message: 'Too many requests from this IP, please try again later.',
   standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers

package/src/models/auth.ts

@@ -2,9 +2,25 @@
  * Auth model – user lookup, session CRUD, Redis session cache.
  * findUserBySessionToken checks Redis first, then DB.
  */
+import { SessionType } from "@prisma/client";
 import { getRedis } from "../lib/redis.js";
 import { prisma } from "../lib/prisma.js";
 
+const AUTH_SESSION_CACHE_PREFIX = "auth-session:";
+
+function getAuthSessionCacheKey(token: string) {
+  return `${AUTH_SESSION_CACHE_PREFIX}${token}`;
+}
+
+function getSessionTtlSeconds(expiresAt?: Date | null) {
+  if (!expiresAt) {
+    return null;
+  }
+
+  const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
+  return ttlSeconds > 0 ? ttlSeconds : null;
+}
+
 /** @returns User by username (includes password for login). */
 export function findUserByUsername(username: string) {
   return prisma.user.findFirst({
@@ -102,8 +118,10 @@ export function createUser(data: {
 /** Create a session. */
 export function createSession(data: {
   id: string;
-  userId: string;
+  type: SessionType;
   expiresAt: Date;
+  userId?: string;
+  classId?: string;
 }) {
   return prisma.session.create({
     data,
@@ -116,14 +134,14 @@ export async function deleteSessionsByUserId(userId: string) {
     where: { userId },
   });
   for (const session of sessions) {
-    await getRedis()?.del(`session:${session.id}`);
+    await getRedis()?.del(getAuthSessionCacheKey(session.id));
   }
   return prisma.session.deleteMany({
     where: { userId },
   });
 }
 
-/** Delete short-lived sessions (no classId) expiring before date. */
+/** Delete password reset sessions expiring before date. */
 export function deleteShortLivedSessionsByUserId(
   userId: string,
   expiresBefore: Date
@@ -131,7 +149,7 @@ export function deleteShortLivedSessionsByUserId(
   return prisma.session.deleteMany({
     where: {
       userId,
-      classId: null,
+      type: SessionType.PASSWORD_RESET,
       expiresAt: { lte: expiresBefore },
     },
   });
@@ -144,17 +162,17 @@ export function deleteUserById(id: string) {
   });
 }
 
-/** @returns Session by ID. */
-export function findSessionById(id: string) {
-  return prisma.session.findUnique({
-    where: { id },
+/** @returns Session by ID and type. */
+export function findSessionByIdAndType(id: string, type: SessionType) {
+  return prisma.session.findFirst({
+    where: { id, type },
   });
 }
 
-/** @returns Session with user. */
-export function findSessionByIdWithUser(id: string) {
-  return prisma.session.findUnique({
-    where: { id },
+/** @returns Session with user by ID and type. */
+export function findSessionByIdWithUserAndType(id: string, type: SessionType) {
+  return prisma.session.findFirst({
+    where: { id, type },
     include: {
       user: { select: { id: true } },
     },
@@ -178,39 +196,51 @@ export function updateUserPassword(userId: string, password: string) {
 }
 
 /** Delete a session. */
-export function deleteSessionById(id: string) {
+export async function deleteSessionById(id: string) {
+  await getRedis()?.del(getAuthSessionCacheKey(id));
   return prisma.session.delete({
     where: { id },
   });
 }
 
-/** @returns User from session token. Checks Redis first, then DB. Caches in Redis. */
+/** @returns User from valid auth session token. Checks Redis first, then DB. Caches in Redis. */
 export async function findUserBySessionToken(token: string) {
-  const session = await getRedis()?.get(`session:${token}`);
+  const cacheKey = getAuthSessionCacheKey(token);
+  const cachedUser = await getRedis()?.get(cacheKey);
 
-  if (session)
-    return JSON.parse(session);
+  if (cachedUser) {
+    return JSON.parse(cachedUser);
+  }
 
-  const user = await prisma.user.findFirst({
+  const session = await prisma.session.findFirst({
     where: {
-      sessions: { some: { id: token } },
+      id: token,
+      type: SessionType.AUTH,
+      userId: { not: null },
+      expiresAt: { gt: new Date() },
     },
     select: {
-      id: true,
-      username: true,
+      expiresAt: true,
+      user: {
+        select: {
+          id: true,
+          username: true,
+        },
+      },
     },
   });
 
-  if (user) {
-    const r = getRedis();
-    if (r) {
-      const ttlSeconds = 30 * 24 * 60 * 60; // 30 days, match session expiry
-      await r.setex(`session:${token}`, ttlSeconds, JSON.stringify(user));
-    }
-    return user;
+  if (!session?.user) {
+    return null;
+  }
+
+  const ttlSeconds = getSessionTtlSeconds(session.expiresAt);
+  const r = getRedis();
+  if (r && ttlSeconds) {
+    await r.setex(cacheKey, ttlSeconds, JSON.stringify(session.user));
   }
 
-  return null;
+  return session.user;
 }
 
 /** @returns Class IDs where user is a teacher. */

package/src/models/class.ts

@@ -4,7 +4,7 @@
  * grading boundaries, syllabus, lab drafts, invite codes.
  */
 
-import { Assignment, Class, Folder, GradingBoundary, MarkScheme, Section, Worksheet } from "@prisma/client";
+import { Assignment, Class, Folder, GradingBoundary, MarkScheme, Section, SessionType, Worksheet } from "@prisma/client";
 import type { PrismaClient, WorksheetQuestion } from "@prisma/client";
 
 import { prisma } from "../lib/prisma.js";
@@ -214,8 +214,18 @@ export function findClassWithAssignments(
       ? { studentId: options.userId }
       : undefined;
 
-  return prisma.class.findUnique({
-    where: { id: classId },
+  return prisma.class.findFirst({
+    where: {
+      id: classId,
+      ...(options.userId
+        ? {
+            OR: [
+              { students: { some: { id: options.userId } } },
+              { teachers: { some: { id: options.userId } } },
+            ],
+          }
+        : {}),
+    },
     include: {
       teachers: classIncludeForGet.teachers,
       students: classIncludeForGet.students,
@@ -261,6 +271,7 @@ export function findSessionByClassCode(classCode: string) {
   return prisma.session.findFirst({
     where: {
       id: { equals: classCode, mode: "insensitive" },
+      type: SessionType.CLASS_INVITE,
     },
   });
 }
@@ -700,4 +711,4 @@ export async function createClassByImport(classId: string, userId: string, year:
   }, { timeout: 30000 });
 
   return newClassId;
-}
+}

package/src/models/notification.ts

@@ -18,9 +18,9 @@ export function findNotificationsByReceiverId(receiverId: string) {
 }
 
 /** @returns Notification by ID. */
-export function findNotificationById(id: string) {
-  return prisma.notification.findUnique({
-    where: { id },
+export function findNotificationByIdForReceiver(id: string, receiverId: string) {
+  return prisma.notification.findFirst({
+    where: { id, receiverId },
     include: notificationInclude,
   });
 }
@@ -45,10 +45,16 @@ export function createManyNotifications(
   });
 }
 
-/** Mark a notification as read. */
-export function markNotificationAsRead(id: string) {
-  return prisma.notification.update({
-    where: { id },
+/** Mark a receiver's notification as read. */
+export async function markNotificationAsReadForReceiver(id: string, receiverId: string) {
+  const result = await prisma.notification.updateMany({
+    where: { id, receiverId },
     data: { read: true },
   });
+
+  if (result.count === 0) {
+    return null;
+  }
+
+  return findNotificationByIdForReceiver(id, receiverId);
 }

package/src/models/worksheet.ts

@@ -4,6 +4,21 @@
 import { prisma } from "../lib/prisma.js";
 import type { WorksheetQuestionType, GenerationStatus } from "@prisma/client";
 
+const worksheetClassMemberWhere = (userId: string) => ({
+  class: {
+    OR: [
+      { teachers: { some: { id: userId } } },
+      { students: { some: { id: userId } } },
+    ],
+  },
+});
+
+const worksheetTeacherWhere = (userId: string) => ({
+  class: {
+    teachers: { some: { id: userId } },
+  },
+});
+
 /** @returns Worksheet with questions and class. */
 export function findWorksheetById(id: string) {
   return prisma.worksheet.findUnique({
@@ -22,6 +37,34 @@ export function findWorksheetByIdMinimal(id: string) {
   });
 }
 
+/** @returns Worksheet by ID for an authorized class member. */
+export function findWorksheetByIdForClassMember(id: string, userId: string) {
+  return prisma.worksheet.findFirst({
+    where: {
+      id,
+      ...worksheetClassMemberWhere(userId),
+    },
+    include: {
+      questions: { orderBy: { createdAt: "asc" as const } },
+      class: true,
+    },
+  });
+}
+
+/** @returns Worksheet by ID for an authorized teacher. */
+export function findWorksheetByIdForTeacher(id: string, userId: string) {
+  return prisma.worksheet.findFirst({
+    where: {
+      id,
+      ...worksheetTeacherWhere(userId),
+    },
+    include: {
+      questions: { orderBy: { createdAt: "asc" as const } },
+      class: true,
+    },
+  });
+}
+
 /** @returns Worksheets for a class. */
 export function findWorksheetsByClassId(classId: string) {
   return prisma.worksheet.findMany({
@@ -33,6 +76,26 @@ export function findWorksheetsByClassId(classId: string) {
   });
 }
 
+/** @returns Worksheet question by ID for an authorized teacher. */
+export function findWorksheetQuestionByIdForTeacher(id: string, userId: string) {
+  return prisma.worksheetQuestion.findFirst({
+    where: {
+      id,
+      worksheet: worksheetTeacherWhere(userId),
+    },
+  });
+}
+
+/** @returns Worksheet question scoped to a worksheet. */
+export function findWorksheetQuestionByIdInWorksheet(
+  id: string,
+  worksheetId: string
+) {
+  return prisma.worksheetQuestion.findFirst({
+    where: { id, worksheetId },
+  });
+}
+
 /** Create a worksheet. */
 export function createWorksheet(data: { classId: string; name: string }) {
   return prisma.worksheet.create({
@@ -118,6 +181,45 @@ export function findSubmissionById(id: string) {
   });
 }
 
+/** @returns Submission if requester is the owning student or a class teacher for the worksheet. */
+export function findSubmissionByIdForWorksheetAccess(
+  id: string,
+  worksheetId: string,
+  worksheetClassId: string,
+  userId: string
+) {
+  return prisma.submission.findFirst({
+    where: {
+      id,
+      assignment: {
+        classId: worksheetClassId,
+        worksheets: { some: { id: worksheetId } },
+      },
+      OR: [
+        {
+          studentId: userId,
+          assignment: {
+            class: {
+              students: { some: { id: userId } },
+            },
+          },
+        },
+        {
+          assignment: {
+            class: {
+              teachers: { some: { id: userId } },
+            },
+          },
+        },
+      ],
+    },
+    select: {
+      id: true,
+      studentId: true,
+    },
+  });
+}
+
 const worksheetResponseInclude = {
   responses: {
     include: {
@@ -182,6 +284,29 @@ export function findWorksheetResponseById(id: string) {
   });
 }
 
+/** @returns Worksheet response if requester is the owning student. */
+export function findWorksheetResponseByIdForStudent(id: string, userId: string) {
+  return prisma.studentWorksheetResponse.findFirst({
+    where: {
+      id,
+      studentId: userId,
+      worksheet: worksheetClassMemberWhere(userId),
+    },
+    include: { responses: true, worksheet: true },
+  });
+}
+
+/** @returns Worksheet response if requester is a class teacher. */
+export function findWorksheetResponseByIdForTeacher(id: string, userId: string) {
+  return prisma.studentWorksheetResponse.findFirst({
+    where: {
+      id,
+      worksheet: worksheetTeacherWhere(userId),
+    },
+    include: { responses: true, worksheet: true },
+  });
+}
+
 /** @returns Worksheet response with question responses. */
 export function findWorksheetResponseWithResponses(
   id: string,
@@ -197,6 +322,43 @@ export function findWorksheetResponseWithResponses(
   });
 }
 
+/** @returns Worksheet response with scoped responses if requester is the owning student. */
+export function findWorksheetResponseWithResponsesForStudent(
+  id: string,
+  userId: string,
+  questionId?: string
+) {
+  return prisma.studentWorksheetResponse.findFirst({
+    where: {
+      id,
+      studentId: userId,
+      worksheet: worksheetClassMemberWhere(userId),
+    },
+    include: {
+      worksheet: true,
+      responses: questionId ? { where: { questionId } } : true,
+    },
+  });
+}
+
+/** @returns Worksheet response with scoped responses if requester is a class teacher. */
+export function findWorksheetResponseWithResponsesForTeacher(
+  id: string,
+  userId: string,
+  questionId?: string
+) {
+  return prisma.studentWorksheetResponse.findFirst({
+    where: {
+      id,
+      worksheet: worksheetTeacherWhere(userId),
+    },
+    include: {
+      worksheet: true,
+      responses: questionId ? { where: { questionId } } : true,
+    },
+  });
+}
+
 /** @returns Worksheet question by ID. */
 export function findWorksheetQuestionById(id: string) {
   return prisma.worksheetQuestion.findUnique({
@@ -204,6 +366,46 @@ export function findWorksheetQuestionById(id: string) {
   });
 }
 
+/** @returns Student question progress if requester is a class teacher. */
+export function findStudentQuestionProgressByIdForTeacher(
+  id: string,
+  userId: string
+) {
+  return prisma.studentQuestionProgress.findFirst({
+    where: {
+      id,
+      question: {
+        worksheet: worksheetTeacherWhere(userId),
+      },
+    },
+    include: {
+      question: true,
+      studentWorksheetResponse: true,
+    },
+  });
+}
+
+/** @returns Student question progress by id and worksheet response if requester is a class teacher. */
+export function findStudentQuestionProgressByIdForTeacherAndResponse(
+  id: string,
+  studentWorksheetResponseId: string,
+  userId: string
+) {
+  return prisma.studentQuestionProgress.findFirst({
+    where: {
+      id,
+      studentWorksheetResponseId,
+      question: {
+        worksheet: worksheetTeacherWhere(userId),
+      },
+    },
+    include: {
+      question: true,
+      studentWorksheetResponse: true,
+    },
+  });
+}
+
 /** Update student's question progress. */
 export function updateStudentQuestionProgress(
   id: string,