@studious-lms/server 1.4.1 → 1.4.3

package/src/services/worksheet.ts

@@ -7,8 +7,9 @@ import { GenerationStatus, type WorksheetQuestionType } from "@prisma/client";
 import { prisma } from "../lib/prisma.js";
 import { cancelGradePipeline, regradeWorksheetPipeline } from "../pipelines/gradeWorksheet.js";
 import {
-  findWorksheetById,
   findWorksheetByIdMinimal,
+  findWorksheetByIdForClassMember,
+  findWorksheetByIdForTeacher,
   findWorksheetsByClassId,
   createWorksheet,
   updateWorksheet,
@@ -17,30 +18,63 @@ import {
   createWorksheetQuestion,
   updateWorksheetQuestion,
   deleteWorksheetQuestion,
-  findSubmissionById,
+  findSubmissionByIdForWorksheetAccess,
   findOrCreateWorksheetResponse,
-  findWorksheetResponseWithResponses,
-  findWorksheetQuestionById,
+  findWorksheetResponseByIdForTeacher,
+  findWorksheetResponseWithResponsesForStudent,
+  findWorksheetQuestionByIdForTeacher,
+  findWorksheetQuestionByIdInWorksheet,
   updateStudentQuestionProgress,
   createStudentQuestionProgress,
   findStudentQuestionProgress,
   updateStudentQuestionProgressForGrading,
   createStudentQuestionProgressForGrading,
   createComment,
+  findStudentQuestionProgressByIdForTeacher,
+  findStudentQuestionProgressByIdForTeacherAndResponse,
 } from "../models/worksheet.js";
 
 type MCQOptions = { id: string; text: string; isCorrect: boolean }[];
 
+const sanitizeQuestionOptionsForStudent = (options: unknown) => {
+  if (!Array.isArray(options)) return options;
+
+  return options.map((option) => {
+    if (!option || typeof option !== "object") return option;
+
+    const { isCorrect: _isCorrect, ...rest } = option as Record<string, unknown>;
+    return rest;
+  });
+};
+
+const sanitizeWorksheetForStudent = <T extends {
+  questions: Array<Record<string, unknown>>;
+}>(worksheet: T) => ({
+  ...worksheet,
+  questions: worksheet.questions.map((question) => ({
+    ...question,
+    answer: "",
+    markScheme: null,
+    options: sanitizeQuestionOptionsForStudent(question.options),
+  })),
+});
+
 /** Get worksheet with questions and mark schemes. */
-export async function getWorksheet(worksheetId: string) {
-  const worksheet = await findWorksheetById(worksheetId);
-  if (!worksheet) {
+export async function getWorksheet(worksheetId: string, userId: string) {
+  const teacherWorksheet = await findWorksheetByIdForTeacher(worksheetId, userId);
+  if (teacherWorksheet) {
+    return teacherWorksheet;
+  }
+
+  const studentWorksheet = await findWorksheetByIdForClassMember(worksheetId, userId);
+  if (!studentWorksheet) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Worksheet not found",
+      code: "FORBIDDEN",
+      message: "You do not have access to this worksheet",
     });
   }
-  return worksheet;
+
+  return sanitizeWorksheetForStudent(studentWorksheet);
 }
 
 /** Check if worksheet exists. */
@@ -59,12 +93,27 @@ export async function listWorksheets(classId: string) {
 
 export async function updateWorksheetRecord(
   worksheetId: string,
+  userId: string,
   data: { name?: string }
 ) {
+  const worksheet = await findWorksheetByIdForTeacher(worksheetId, userId);
+  if (!worksheet) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can update worksheets",
+    });
+  }
   return updateWorksheet(worksheetId, data);
 }
 
-export async function deleteWorksheetRecord(worksheetId: string) {
+export async function deleteWorksheetRecord(worksheetId: string, userId: string) {
+  const worksheet = await findWorksheetByIdForTeacher(worksheetId, userId);
+  if (!worksheet) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can delete worksheets",
+    });
+  }
   return deleteWorksheet(worksheetId);
 }
 
@@ -74,6 +123,7 @@ export async function createWorksheetRecord(classId: string, name: string) {
 
 export async function addQuestionToWorksheet(
   worksheetId: string,
+  userId: string,
   data: {
     question: string;
     answer: string;
@@ -83,11 +133,11 @@ export async function addQuestionToWorksheet(
     type: WorksheetQuestionType;
   }
 ) {
-  const worksheet = await findWorksheetByIdMinimal(worksheetId);
+  const worksheet = await findWorksheetByIdForTeacher(worksheetId, userId);
   if (!worksheet) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Worksheet not found",
+      code: "FORBIDDEN",
+      message: "Only class teachers can modify worksheet questions",
     });
   }
   return createWorksheetQuestion({
@@ -98,15 +148,16 @@ export async function addQuestionToWorksheet(
 
 export async function reorderWorksheetQuestions(
   worksheetId: string,
+  userId: string,
   movedId: string,
   position: "before" | "after",
   targetId: string
 ) {
-  const worksheet = await findWorksheetByIdMinimal(worksheetId);
+  const worksheet = await findWorksheetByIdForTeacher(worksheetId, userId);
   if (!worksheet) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Worksheet not found",
+      code: "FORBIDDEN",
+      message: "Only class teachers can reorder worksheet questions",
     });
   }
 
@@ -158,6 +209,7 @@ export async function reorderWorksheetQuestions(
 export async function updateWorksheetQuestionRecord(
   worksheetId: string,
   questionId: string,
+  userId: string,
   data: {
     question?: string;
     answer?: string;
@@ -167,11 +219,11 @@ export async function updateWorksheetQuestionRecord(
     type?: WorksheetQuestionType;
   }
 ) {
-  const worksheet = await findWorksheetByIdMinimal(worksheetId);
-  if (!worksheet) {
+  const question = await findWorksheetQuestionByIdForTeacher(questionId, userId);
+  if (!question || question.worksheetId !== worksheetId) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Worksheet not found",
+      code: "FORBIDDEN",
+      message: "Only class teachers can update worksheet questions",
     });
   }
   return updateWorksheetQuestion(questionId, data);
@@ -179,13 +231,14 @@ export async function updateWorksheetQuestionRecord(
 
 export async function deleteWorksheetQuestionRecord(
   worksheetId: string,
-  questionId: string
+  questionId: string,
+  userId: string
 ) {
-  const worksheet = await findWorksheetByIdMinimal(worksheetId);
-  if (!worksheet) {
+  const question = await findWorksheetQuestionByIdForTeacher(questionId, userId);
+  if (!question || question.worksheetId !== worksheetId) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Worksheet not found",
+      code: "FORBIDDEN",
+      message: "Only class teachers can delete worksheet questions",
     });
   }
   return deleteWorksheetQuestion(questionId);
@@ -193,13 +246,27 @@ export async function deleteWorksheetQuestionRecord(
 
 export async function getWorksheetSubmission(
   worksheetId: string,
-  submissionId: string
+  submissionId: string,
+  userId: string
 ) {
-  const submission = await findSubmissionById(submissionId);
+  const worksheet = await findWorksheetByIdForClassMember(worksheetId, userId);
+  if (!worksheet) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You do not have access to this worksheet",
+    });
+  }
+
+  const submission = await findSubmissionByIdForWorksheetAccess(
+    submissionId,
+    worksheetId,
+    worksheet.classId,
+    userId
+  );
   if (!submission) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Submission not found",
+      code: "FORBIDDEN",
+      message: "You do not have access to this worksheet submission",
     });
   }
   return findOrCreateWorksheetResponse(
@@ -215,25 +282,36 @@ export async function answerWorksheetQuestion(
   response: string,
   userId: string
 ) {
-  const worksheetResponse = await findWorksheetResponseWithResponses(
+  const worksheetResponse = await findWorksheetResponseWithResponsesForStudent(
     worksheetResponseId,
+    userId,
     questionId
   );
   if (!worksheetResponse) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You can only answer your own worksheet responses",
+    });
+  }
+
+  const question = await findWorksheetQuestionByIdInWorksheet(
+    questionId,
+    worksheetResponse.worksheetId
+  );
+  if (!question) {
     throw new TRPCError({
       code: "NOT_FOUND",
-      message: "Worksheet response not found",
+      message: "Worksheet question not found",
     });
   }
 
-  const question = await findWorksheetQuestionById(questionId);
   const isMarkableByAlgo =
-    question?.type === "MULTIPLE_CHOICE" || question?.type === "TRUE_FALSE";
-  const marksAwardedIfCorrect = question?.points || 0;
+    question.type === "MULTIPLE_CHOICE" || question.type === "TRUE_FALSE";
+  const marksAwardedIfCorrect = question.points || 0;
   const correctAnswer = isMarkableByAlgo
-    ? question?.type === "MULTIPLE_CHOICE"
-      ? (question?.options as MCQOptions)?.find((o) => o.isCorrect)?.id
-      : question?.answer?.toString()
+    ? question.type === "MULTIPLE_CHOICE"
+      ? (question.options as MCQOptions)?.find((o) => o.isCorrect)?.id
+      : question.answer?.toString()
     : null;
 
   const existingResponse = worksheetResponse.responses[0];
@@ -273,21 +351,46 @@ export async function answerWorksheetQuestion(
 
 export async function cancelGrading(
   worksheetResponseId: string,
-  progressId: string
+  progressId: string,
+  userId: string
 ) {
+  const progress = await findStudentQuestionProgressByIdForTeacherAndResponse(
+    progressId,
+    worksheetResponseId,
+    userId
+  );
+  if (!progress) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can cancel worksheet grading",
+    });
+  }
   return cancelGradePipeline(worksheetResponseId, progressId);
 }
 
 export async function regradeQuestion(
   worksheetResponseId: string,
-  progressId: string
+  progressId: string,
+  userId: string
 ) {
+  const progress = await findStudentQuestionProgressByIdForTeacherAndResponse(
+    progressId,
+    worksheetResponseId,
+    userId
+  );
+  if (!progress) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can regrade worksheet answers",
+    });
+  }
   return regradeWorksheetPipeline(worksheetResponseId, progressId);
 }
 
 export async function gradeAnswer(
   questionId: string,
   studentWorksheetResponseId: string,
+  userId: string,
   data: {
     responseId?: string;
     response?: string;
@@ -297,7 +400,44 @@ export async function gradeAnswer(
     points?: number;
   }
 ) {
+  const worksheetResponse = await findWorksheetResponseByIdForTeacher(
+    studentWorksheetResponseId,
+    userId
+  );
+  if (!worksheetResponse) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can grade worksheet answers",
+    });
+  }
+
+  const question = await findWorksheetQuestionByIdInWorksheet(
+    questionId,
+    worksheetResponse.worksheetId
+  );
+  if (!question) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Worksheet question not found",
+    });
+  }
+
   if (data.responseId) {
+    const existingProgress = await findStudentQuestionProgressByIdForTeacher(
+      data.responseId,
+      userId
+    );
+    if (
+      !existingProgress ||
+      existingProgress.studentWorksheetResponseId !== studentWorksheetResponseId ||
+      existingProgress.questionId !== questionId
+    ) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "Only class teachers can grade worksheet answers",
+      });
+    }
+
     return updateStudentQuestionProgressForGrading(data.responseId, {
       isCorrect: data.isCorrect,
       feedback: data.feedback,
@@ -306,17 +446,6 @@ export async function gradeAnswer(
     });
   }
 
-  const worksheetResponse = await prisma.studentWorksheetResponse.findUnique({
-    where: { id: studentWorksheetResponseId },
-    select: { studentId: true },
-  });
-  if (!worksheetResponse) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Student worksheet response not found",
-    });
-  }
-
   const existing = await findStudentQuestionProgress(
     worksheetResponse.studentId,
     questionId,
@@ -350,6 +479,17 @@ export async function addCommentToResponse(
   comment: string,
   authorId: string
 ) {
+  const progress = await findStudentQuestionProgressByIdForTeacher(
+    responseId,
+    authorId
+  );
+  if (!progress) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can comment on worksheet responses",
+    });
+  }
+
   return createComment({
     studentQuestionProgressId: responseId,
     content: comment,

package/src/trpc.ts

@@ -1,13 +1,12 @@
 import { initTRPC, TRPCError } from '@trpc/server';
 import { ZodError } from 'zod';
 import { logger } from './utils/logger.js';
-import { prisma } from './lib/prisma.js';
 import { createLoggingMiddleware } from './middleware/logging.js';
 import { createAuthMiddleware } from './middleware/auth.js';
 import { Request, Response } from 'express';
 import { z } from 'zod';
 import { handlePrismaError, PrismaErrorInfo } from './utils/prismaErrorHandler.js';
-import { generalLimiter } from './middleware/security.js';
+import { findUserBySessionToken } from './models/auth.js';
 
 interface CreateContextOptions {
   req: Request;
@@ -26,22 +25,17 @@ export type Context = {
 
 export const createTRPCContext = async (opts: CreateContextOptions): Promise<Context> => {
   const { req, res } = opts;
-  
-  // Get user from session/token
-  const token = req.headers.authorization?.split(' ')[1];
-  const user = token ? await prisma.user.findFirst({
-    where: {
-      sessions: {
-        some: {
-          id: token
-        }
-      },
-    },
-    select: {
-      id: true,
-    }
-  }) : null;
-  
+
+  const userHeader = req.headers["x-user"];
+  const tokenFromUserHeader = typeof userHeader === "string" ? userHeader : userHeader?.[0];
+  const authorizationHeader = req.headers.authorization;
+  const tokenFromAuthorization =
+    typeof authorizationHeader === "string" && authorizationHeader.startsWith("Bearer ")
+      ? authorizationHeader.slice(7)
+      : null;
+  const token = tokenFromUserHeader ?? tokenFromAuthorization;
+  const user = token ? await findUserBySessionToken(token) : null;
+
   return {
     req,
     res,