@studious-lms/server 1.4.2 → 1.4.3

package/src/services/auth.ts

@@ -2,6 +2,7 @@
  * Auth service – user registration, login, logout, verification, and password reset.
  * Handles session creation, Redis caching, and email notifications.
  */
+import { SessionType } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
 import { v4 as uuidv4 } from "uuid";
 import { compare, hash } from "bcryptjs";
@@ -19,13 +20,12 @@ import {
   deleteSessionsByUserId,
   deleteShortLivedSessionsByUserId,
   deleteUserById,
-  findSessionById,
-  findSessionByIdWithUser,
+  findSessionByIdAndType,
+  findSessionByIdWithUserAndType,
   updateUserVerified,
   updateUserPassword,
   deleteSessionById,
 } from "../models/auth.js";
-import { getRedis } from "../lib/redis.js";
 
 /** Register a new user, create verification session, and send verification email. */
 export async function register(input: {
@@ -79,6 +79,7 @@ export async function register(input: {
     () =>
       createSession({
         id: uuidv4(),
+        type: SessionType.EMAIL_VERIFICATION,
         userId: user.id,
         expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
       }),
@@ -102,7 +103,7 @@ export async function register(input: {
   return { user: { id: user.id, username: user.username } };
 }
 
-/** Authenticate user by username/password, create session, and cache in Redis. */
+/** Authenticate user by username/password, create session. */
 export async function login(input: { username: string; password: string }) {
   const { username, password } = input;
 
@@ -130,15 +131,11 @@ export async function login(input: { username: string; password: string }) {
 
   const session = await createSession({
     id: uuidv4(),
+    type: SessionType.AUTH,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
   });
 
-  const cachePayload = JSON.stringify({ id: user.id, username: user.username });
-  const ttlSeconds = 30 * 24 * 60 * 60; // 30 days, match session expiry
-  const r = getRedis();
-  if (r) await r.setex(`session:${session.id}`, ttlSeconds, cachePayload);
-
   return {
     token: session.id,
     user: { id: user.id, username: user.username },
@@ -177,6 +174,7 @@ export async function resendVerificationEmail(email: string) {
 
   const verificationToken = await createSession({
     id: uuidv4(),
+    type: SessionType.EMAIL_VERIFICATION,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
   });
@@ -200,7 +198,10 @@ export async function resendVerificationEmail(email: string) {
 
 /** Verify email via token. Marks user as verified and deletes the session. */
 export async function verify(token: string) {
-  const session = await findSessionById(token);
+  const session = await findSessionByIdAndType(
+    token,
+    SessionType.EMAIL_VERIFICATION
+  );
   if (!session) {
     throw new TRPCError({
       code: "NOT_FOUND",
@@ -209,13 +210,22 @@ export async function verify(token: string) {
   }
 
   if (session.expiresAt && session.expiresAt < new Date()) {
+    await deleteSessionById(token);
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "Session expired",
     });
   }
 
-  await updateUserVerified(session.userId!, true);
+  if (!session.userId) {
+    await deleteSessionById(token);
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Invalid session state",
+    });
+  }
+
+  await updateUserVerified(session.userId, true);
   await deleteSessionById(token);
   return { success: true };
 }
@@ -232,6 +242,7 @@ export async function requestPasswordReset(email: string) {
 
   const resetToken = await createSession({
     id: uuidv4(),
+    type: SessionType.PASSWORD_RESET,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60),
   });
@@ -255,7 +266,10 @@ export async function requestPasswordReset(email: string) {
 
 /** Reset password using token from email. Validates token and updates password. */
 export async function resetPassword(token: string, password: string) {
-  const session = await findSessionByIdWithUser(token);
+  const session = await findSessionByIdWithUserAndType(
+    token,
+    SessionType.PASSWORD_RESET
+  );
   if (!session || !session.userId) {
     throw new TRPCError({
       code: "NOT_FOUND",

package/src/services/class.ts

@@ -2,6 +2,7 @@
  * Class service – CRUD for classes, members, grades, mark schemes, grading boundaries,
  * syllabus, lab drafts, and invite codes.
  */
+import { SessionType } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
 import { generateInviteCode } from "../utils/generateInviteCode.js";
@@ -286,6 +287,7 @@ export async function getInviteCode(classId: string) {
       data: {
         id: generateInviteCode(),
         classId,
+        type: SessionType.CLASS_INVITE,
         expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
       },
     });
@@ -297,13 +299,14 @@ export async function getInviteCode(classId: string) {
 
 export async function createInviteCode(classId: string) {
   await prisma.session.deleteMany({
-    where: { classId },
+    where: { classId, type: SessionType.CLASS_INVITE },
   });
 
   const session = await prisma.session.create({
     data: {
       id: generateInviteCode(),
       classId,
+      type: SessionType.CLASS_INVITE,
       expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
     },
   });

package/src/services/file.ts

@@ -14,6 +14,7 @@ import {
   updateFileName,
   deleteFileById,
 } from "../models/file.js";
+import { findConversationMembership } from "../models/message.js";
 
 /** Generate a signed URL for file download. Validates user has access. */
 export async function getFileSignedUrl(userId: string, fileId: string) {
@@ -65,6 +66,11 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
     hasAccess = true;
   }
 
+  if (file.conversationId) {
+    const membership = await findConversationMembership(file.conversationId, userId);
+    hasAccess = hasAccess || Boolean(membership);
+  }
+
   if (file.folder?.class) {
     const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
     const isStudent = file.folder.class.students.some((s) => s.id === userId);

package/src/services/labChat.ts

@@ -20,6 +20,10 @@ import {
 import { generateAndSendLabIntroduction, generateAndSendLabResponse } from "../pipelines/aiLabChat.js";
 import { isAIUser } from "../utils/aiUser.js";
 import { logger } from "../utils/logger.js";
+import {
+  claimMessageAttachments,
+  ensureMessageHasContentOrAttachments,
+} from "./message.js";
 
 /** Create a lab chat with conversation and teacher members. Broadcasts via Pusher. */
 export async function createLabChat(
@@ -213,9 +217,10 @@ export async function postToLabChat(
     labChatId: string;
     content: string;
     mentionedUserIds?: string[];
+    fileIds?: string[];
   }
 ) {
-  const { labChatId, content, mentionedUserIds = [] } = input;
+  const { labChatId, content, mentionedUserIds = [], fileIds = [] } = input;
 
   const labChat = await findLabChatForPost(labChatId, userId);
   if (!labChat) {
@@ -238,30 +243,27 @@ export async function postToLabChat(
     }
   }
 
+  ensureMessageHasContentOrAttachments(content, fileIds);
+  const normalizedContent = content.trim();
+
   const result = await prisma.$transaction(async (tx) => {
     const message = await tx.message.create({
       data: {
-        content,
+        content: normalizedContent,
         senderId: userId,
         conversationId: labChat.conversationId,
         ...(isAIUser(userId) ? {} : { status: GenerationStatus.PENDING }),
       },
-      include: {
-        sender: {
-          select: {
-            id: true,
-            username: true,
-            profile: {
-              select: {
-                displayName: true,
-                profilePicture: true,
-              },
-            },
-          },
-        },
-      },
     });
 
+    await claimMessageAttachments(
+      tx,
+      userId,
+      labChat.conversationId,
+      message.id,
+      fileIds
+    );
+
     if (mentionedUserIds.length > 0) {
       await tx.mention.createMany({
         data: mentionedUserIds.map((mentionedUserId) => ({
@@ -276,7 +278,26 @@ export async function postToLabChat(
       data: { updatedAt: new Date() },
     });
 
-    return message;
+    return tx.message.findUniqueOrThrow({
+      where: { id: message.id },
+      include: {
+        sender: {
+          select: {
+            id: true,
+            username: true,
+            profile: {
+              select: {
+                displayName: true,
+                profilePicture: true,
+              },
+            },
+          },
+        },
+        attachments: {
+          select: { id: true, name: true, type: true },
+        },
+      },
+    });
   });
 
   try {
@@ -290,7 +311,9 @@ export async function postToLabChat(
         conversationId: result.conversationId,
         createdAt: result.createdAt,
         sender: result.sender,
+        attachments: result.attachments ?? [],
         mentionedUserIds,
+        meta: {},
       }
     );
   } catch (error) {
@@ -307,7 +330,7 @@ export async function postToLabChat(
     } catch (error) {
       console.error("Failed to broadcast lab response pending:", error);
     }
-    generateAndSendLabResponse(labChatId, content, {
+    generateAndSendLabResponse(labChatId, normalizedContent, {
       classId: labChat.classId,
       messageId: result.id,
     }).catch((error) =>
@@ -327,6 +350,7 @@ export async function postToLabChat(
     conversationId: result.conversationId,
     createdAt: result.createdAt,
     sender: result.sender,
+    attachments: result.attachments ?? [],
     mentionedUserIds,
   };
 }

package/src/services/message.ts

@@ -2,9 +2,14 @@
  * Message service – send, update, delete messages; mark as read; track mentions.
  * Broadcasts real-time updates via Pusher.
  */
+import type { Prisma } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
 import { chatChannel, pusher } from "../lib/pusher.js";
+import {
+  confirmDirectUpload,
+  createDirectUploadFiles,
+} from "../lib/fileUpload.js";
 import { logger } from "../utils/logger.js";
 import {
   findConversationMembership,
@@ -16,6 +21,126 @@ import {
   countUnreadMentions,
 } from "../models/message.js";
 
+export function ensureMessageHasContentOrAttachments(
+  content: string,
+  fileIds: string[] = []
+) {
+  if (!content.trim() && fileIds.length === 0) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Message must include content or attachments",
+    });
+  }
+}
+
+export async function claimMessageAttachments(
+  tx: Prisma.TransactionClient,
+  userId: string,
+  conversationId: string,
+  messageId: string,
+  fileIds: string[] = []
+) {
+  const uniqueFileIds = [...new Set(fileIds)];
+
+  if (uniqueFileIds.length === 0) {
+    return;
+  }
+
+  const { count } = await tx.file.updateMany({
+    where: {
+      id: { in: uniqueFileIds },
+      userId,
+      conversationId,
+      uploadStatus: "COMPLETED",
+      messageId: null,
+    },
+    data: {
+      messageId,
+    },
+  });
+
+  if (count !== uniqueFileIds.length) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Some attachments are missing, unfinished, or unavailable",
+    });
+  }
+}
+
+export async function getMessageUploadUrls(
+  userId: string,
+  input: {
+    conversationId: string;
+    files: { name: string; type: string; size: number }[];
+  }
+) {
+  const membership = await findConversationMembership(input.conversationId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Not a member of this conversation",
+    });
+  }
+
+  return createDirectUploadFiles(
+    input.files,
+    userId,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    input.conversationId
+  );
+}
+
+export async function confirmMessageUpload(
+  userId: string,
+  input: {
+    conversationId: string;
+    fileId: string;
+    uploadSuccess: boolean;
+    errorMessage?: string;
+  }
+) {
+  const membership = await findConversationMembership(input.conversationId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Not a member of this conversation",
+    });
+  }
+
+  const file = await prisma.file.findFirst({
+    where: {
+      id: input.fileId,
+      userId,
+      conversationId: input.conversationId,
+      messageId: null,
+    },
+    select: { id: true },
+  });
+
+  if (!file) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "File not found or you do not have permission",
+    });
+  }
+
+  await confirmDirectUpload(
+    input.fileId,
+    input.uploadSuccess,
+    input.errorMessage
+  );
+
+  return {
+    success: true,
+    message: input.uploadSuccess
+      ? "Upload confirmed successfully"
+      : "Upload failed",
+  };
+}
+
 /** List messages in a conversation with cursor-based pagination. */
 export async function listMessages(
   userId: string,
@@ -74,9 +199,18 @@ export async function sendMessage(
     conversationId: string;
     content: string;
     mentionedUserIds?: string[];
+    fileIds?: string[];
   }
 ) {
-  const { conversationId, content, mentionedUserIds = [] } = input;
+  const {
+    conversationId,
+    content,
+    mentionedUserIds = [],
+    fileIds = [],
+  } = input;
+
+  ensureMessageHasContentOrAttachments(content, fileIds);
+  const normalizedContent = content.trim();
 
   const membership = await findConversationMembership(conversationId, userId);
   if (!membership) {
@@ -102,10 +236,36 @@ export async function sendMessage(
   const result = await prisma.$transaction(async (tx) => {
     const message = await tx.message.create({
       data: {
-        content,
+        content: normalizedContent,
         senderId: userId,
         conversationId,
       },
+    });
+
+    await claimMessageAttachments(
+      tx,
+      userId,
+      conversationId,
+      message.id,
+      fileIds
+    );
+
+    if (mentionedUserIds.length > 0) {
+      await tx.mention.createMany({
+        data: mentionedUserIds.map((mentionedUserId) => ({
+          messageId: message.id,
+          userId: mentionedUserId,
+        })),
+      });
+    }
+
+    await tx.conversation.update({
+      where: { id: conversationId },
+      data: { updatedAt: new Date() },
+    });
+
+    return tx.message.findUniqueOrThrow({
+      where: { id: message.id },
       include: {
         sender: {
           select: {
@@ -124,22 +284,6 @@ export async function sendMessage(
         },
       },
     });
-
-    if (mentionedUserIds.length > 0) {
-      await tx.mention.createMany({
-        data: mentionedUserIds.map((mentionedUserId) => ({
-          messageId: message.id,
-          userId: mentionedUserId,
-        })),
-      });
-    }
-
-    await tx.conversation.update({
-      where: { id: conversationId },
-      data: { updatedAt: new Date() },
-    });
-
-    return message;
   });
 
   try {
@@ -173,6 +317,7 @@ export async function sendMessage(
     conversationId: result.conversationId,
     createdAt: result.createdAt,
     sender: result.sender,
+    attachments: result.attachments ?? [],
     mentionedUserIds,
   };
 }

package/src/services/newtonChat.ts

@@ -7,6 +7,10 @@ import { logger } from "../utils/logger.js";
 import { chatChannel, pusher } from "../lib/pusher.js";
 import { isAIUser } from "../utils/aiUser.js";
 import { generateAndSendNewtonIntroduction, generateAndSendNewtonResponse } from "../pipelines/aiNewtonChat.js";
+import {
+  claimMessageAttachments,
+  ensureMessageHasContentOrAttachments,
+} from "./message.js";
 import {
   findClassWithStudent,
   findSubmissionByAssignmentAndStudent,
@@ -118,7 +122,8 @@ export async function postToNewtonChat(
   userId: string,
   newtonChatId: string,
   content: string,
-  mentionedUserIds: string[] = []
+  mentionedUserIds: string[] = [],
+  fileIds: string[] = []
 ) {
   const newtonChat = await findNewtonChatByIdAndMember(newtonChatId, userId);
   if (!newtonChat) {
@@ -141,29 +146,33 @@ export async function postToNewtonChat(
     }
   }
 
+  ensureMessageHasContentOrAttachments(content, fileIds);
+  const normalizedContent = content.trim();
+
+  if (!normalizedContent) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Newton chat messages must include text content",
+    });
+  }
+
   const result = await prisma.$transaction(async (tx) => {
     const message = await tx.message.create({
       data: {
-        content,
+        content: normalizedContent,
         senderId: userId,
         conversationId: newtonChat.conversationId,
       },
-      include: {
-        sender: {
-          select: {
-            id: true,
-            username: true,
-            profile: {
-              select: {
-                displayName: true,
-                profilePicture: true,
-              },
-            },
-          },
-        },
-      },
     });
 
+    await claimMessageAttachments(
+      tx,
+      userId,
+      newtonChat.conversationId,
+      message.id,
+      fileIds
+    );
+
     if (mentionedUserIds.length > 0) {
       await tx.mention.createMany({
         data: mentionedUserIds.map((mentionedUserId) => ({
@@ -178,7 +187,26 @@ export async function postToNewtonChat(
       data: { updatedAt: new Date() },
     });
 
-    return message;
+    return tx.message.findUniqueOrThrow({
+      where: { id: message.id },
+      include: {
+        sender: {
+          select: {
+            id: true,
+            username: true,
+            profile: {
+              select: {
+                displayName: true,
+                profilePicture: true,
+              },
+            },
+          },
+        },
+        attachments: {
+          select: { id: true, name: true, type: true },
+        },
+      },
+    });
   });
 
   try {
@@ -192,7 +220,9 @@ export async function postToNewtonChat(
         conversationId: result.conversationId,
         createdAt: result.createdAt,
         sender: result.sender,
+        attachments: result.attachments ?? [],
         mentionedUserIds,
+        meta: {},
       }
     );
   } catch (error) {
@@ -202,7 +232,7 @@ export async function postToNewtonChat(
   if (!isAIUser(userId)) {
     generateAndSendNewtonResponse(
       newtonChatId,
-      content,
+      normalizedContent,
       newtonChat.conversationId,
       newtonChat.submission
     ).catch((error) => {
@@ -217,6 +247,7 @@ export async function postToNewtonChat(
     conversationId: result.conversationId,
     createdAt: result.createdAt,
     sender: result.sender,
+    attachments: result.attachments ?? [],
     mentionedUserIds,
   };
 }

package/src/services/notification.ts

@@ -1,12 +1,13 @@
 /**
  * Notification service – list, send, and mark notifications as read.
  */
+import { TRPCError } from "@trpc/server";
 import {
   findNotificationsByReceiverId,
-  findNotificationById,
+  findNotificationByIdForReceiver,
   createNotification,
   createManyNotifications,
-  markNotificationAsRead,
+  markNotificationAsReadForReceiver,
 } from "../models/notification.js";
 
 /** List notifications for a user. */
@@ -14,9 +15,18 @@ export async function listNotifications(userId: string) {
   return findNotificationsByReceiverId(userId);
 }
 
-/** Get a single notification by ID. */
-export async function getNotification(id: string) {
-  return findNotificationById(id);
+/** Get a single notification by ID for its receiver. */
+export async function getNotification(userId: string, id: string) {
+  const notification = await findNotificationByIdForReceiver(id, userId);
+
+  if (!notification) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Notification not found",
+    });
+  }
+
+  return notification;
 }
 
 /** Send a notification to one user. */
@@ -44,7 +54,16 @@ export async function sendToMultiple(input: {
   return result;
 }
 
-/** Mark a notification as read. */
-export async function markAsRead(id: string) {
-  return markNotificationAsRead(id);
+/** Mark a notification as read for its receiver. */
+export async function markAsRead(userId: string, id: string) {
+  const notification = await markNotificationAsReadForReceiver(id, userId);
+
+  if (!notification) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Notification not found",
+    });
+  }
+
+  return notification;
 }