@studious-lms/server 1.4.2 → 1.4.4

package/src/index.ts

@@ -7,9 +7,11 @@ import dotenv from 'dotenv';
 import { createExpressMiddleware } from '@trpc/server/adapters/express';
 import { appRouter } from './routers/_app.js';
 import { createTRPCContext, createCallerFactory } from './trpc.js';
+import { findUserBySessionToken } from './models/auth.js';
 import { logger } from './utils/logger.js';
 import { setupSocketHandlers } from './socket/handlers.js';
 import { bucket } from './lib/googleCloudStorage.js';
+import { validateDirectUploadIntent } from './lib/fileUpload.js';
 import { prisma } from './lib/prisma.js';
 import { pusher } from './lib/pusher.js';
 import { connectRedis, disconnectRedis } from './lib/redis.js';
@@ -115,6 +117,17 @@ app.use((req, res, next) => {
 // Create HTTP server
 const httpServer = createServer(app);
 
+app.get('/', async (req, res) => {
+  res.status(200).json({ 
+    status: 'OK',
+    timestamp: new Date().toISOString(),
+    uptime: process.uptime(),
+    version: process.env.npm_package_version,
+    environment: process.env.NODE_ENV,
+    appUrl: process.env.NEXT_PUBLIC_APP_URL,
+  });
+});
+
 app.get('/health', async (req, res) => {
 
   try {
@@ -156,10 +169,7 @@ app.post('/api/pusher/auth', async (req, res) => {
       return res.status(401).json({ error: 'Authentication required' });
     }
 
-    const user = await prisma.user.findFirst({
-      where: { sessions: { some: { id: token } } },
-      select: { id: true, username: true },
-    });
+    const user = await findUserBySessionToken(token);
 
     if (!user) {
       return res.status(401).json({ error: 'Invalid or expired session' });
@@ -274,19 +284,7 @@ app.get('/api/files/:fileId', async (req, res) => {
     const token = typeof userHeader === 'string' ? userHeader : userHeader[0];
 
     // Find user by session token
-    const user = await prisma.user.findFirst({
-      where: {
-        sessions: {
-          some: {
-            id: token
-          }
-        }
-      },
-      select: {
-        id: true,
-        username: true,
-      }
-    });
+    const user = await findUserBySessionToken(token);
 
     if (!user) {
       return res.status(401).json({ error: 'Invalid or expired session' });
@@ -463,19 +461,53 @@ app.get('/api/files/:fileId', async (req, res) => {
 app.use('/trpc/auth.login', authLimiter);
 app.use('/trpc/auth.register', authLimiter);
 
+async function getAuthenticatedRequestUser(req: Request) {
+  const userHeader = req.headers['x-user'];
+  const tokenFromUserHeader = typeof userHeader === 'string' ? userHeader : userHeader?.[0];
+  const authorizationHeader = req.headers.authorization;
+  const tokenFromAuthorization =
+    typeof authorizationHeader === 'string' && authorizationHeader.startsWith('Bearer ')
+      ? authorizationHeader.slice(7)
+      : null;
+
+  let token = tokenFromUserHeader ?? tokenFromAuthorization;
+
+  if (!token && req.headers.cookie) {
+    const cookieName = env.PUSHER_AUTH_COOKIE_NAME || 'token';
+    const match = req.headers.cookie.match(new RegExp(cookieName + '=([^;]+)'));
+    token = match?.[1]?.trim() ?? null;
+  }
+
+  if (!token) {
+    return null;
+  }
+
+  return findUserBySessionToken(token);
+}
+
+function getUploadSessionId(req: Request) {
+  const queryValue = req.query.uploadSessionId;
+  if (typeof queryValue === 'string' && queryValue.trim()) {
+    return queryValue;
+  }
+
+  const headerValue = req.headers['x-upload-session-id'];
+  return typeof headerValue === 'string' ? headerValue : headerValue?.[0];
+}
+
 // File upload endpoint for secure file uploads (supports both POST and PUT)
-app.post('/api/upload/:filePath', uploadLimiter, async (req, res) => {
-  handleFileUpload(req, res);
+app.post('/api/upload/:filePath', async (req, res) => {
+  await handleFileUpload(req, res);
 });
 
 app.put('/api/upload/:filePath', uploadLimiter, async (req, res) => {
-  handleFileUpload(req, res);
+  await handleFileUpload(req, res);
 });
 
-function handleFileUpload(req: any, res: any) {
+async function handleFileUpload(req: Request, res: Response) {
   try {
     const filePath = decodeURIComponent(req.params.filePath);
-    
+
     // Set CORS headers for upload endpoint
     const origin = req.headers.origin;
     
@@ -488,23 +520,34 @@ function handleFileUpload(req: any, res: any) {
     }
     
     res.header('Access-Control-Allow-Credentials', 'true');
+
+    const user = await getAuthenticatedRequestUser(req);
+    if (!user) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
+    const uploadSessionId = getUploadSessionId(req);
+    if (!uploadSessionId) {
+      return res.status(401).json({ error: 'Upload session is required' });
+    }
+
+    await validateDirectUploadIntent({
+      filePath,
+      uploadSessionId,
+      userId: user.id,
+    });
     
-    // Get content type from headers
     const contentType = req.headers['content-type'] || 'application/octet-stream';
-    
-    // Create a new file in the bucket
     const file = bucket.file(filePath);
-    
-    // Create a write stream to Google Cloud Storage
+
     const writeStream = file.createWriteStream({
       metadata: {
         contentType,
       },
     });
     
-    // Handle stream events
     writeStream.on('error', (error) => {
-      logger.error('Error uploading file:', {error});
+      logger.error('Error uploading file:', {error, filePath, userId: user.id});
       if (!res.headersSent) {
         res.status(500).json({ error: 'Error uploading file' });
       }
@@ -518,11 +561,21 @@ function handleFileUpload(req: any, res: any) {
       });
     });
     
-    // Pipe the request body to the write stream
     req.pipe(writeStream);
     
   } catch (error) {
     logger.error('Error handling file upload:', {error});
+    const code = typeof error === 'object' && error && 'code' in error ? error.code : null;
+    const message = error instanceof Error ? error.message : 'Internal server error';
+
+    if (code === 'FORBIDDEN') {
+      return res.status(403).json({ error: message });
+    }
+
+    if (code === 'BAD_REQUEST') {
+      return res.status(400).json({ error: message });
+    }
+
     res.status(500).json({ error: 'Internal server error' });
   }
 }

package/src/lib/fileUpload.ts

@@ -39,6 +39,43 @@ export interface DirectUploadFile {
   uploadSessionId: string;
 }
 
+export async function validateDirectUploadIntent(input: {
+  filePath: string;
+  uploadSessionId: string;
+  userId: string;
+}) {
+  const fileRecord = await prisma.file.findFirst({
+    where: {
+      path: input.filePath,
+      uploadSessionId: input.uploadSessionId,
+      userId: input.userId,
+      uploadExpiresAt: { gt: new Date() },
+      isOrphaned: false,
+      messageId: null,
+    },
+    select: {
+      id: true,
+      uploadStatus: true,
+    },
+  });
+
+  if (!fileRecord) {
+    throw new TRPCError({
+      code: 'FORBIDDEN',
+      message: 'Invalid or expired upload intent',
+    });
+  }
+
+  if (!['PENDING', 'UPLOADING'].includes(fileRecord.uploadStatus)) {
+    throw new TRPCError({
+      code: 'BAD_REQUEST',
+      message: 'Upload is no longer accepting data',
+    });
+  }
+
+  return fileRecord;
+}
+
 // DEPRECATED: These functions are no longer used - files are uploaded directly to GCS
 // Use createDirectUploadFile() and createDirectUploadFiles() instead
 
@@ -103,7 +140,8 @@ export async function createDirectUploadFile(
   directory?: string,
   assignmentId?: string,
   submissionId?: string,
-  announcementId?: string
+  announcementId?: string,
+  conversationId?: string
 ): Promise<DirectUploadFile> {
   try {
     // Validate file extension matches MIME type
@@ -137,7 +175,7 @@ export async function createDirectUploadFile(
     
     // Generate backend proxy upload URL (not direct GCS)
     const baseUrl = env.BACKEND_URL || 'http://localhost:3001';
-    const uploadUrl = `${baseUrl}/api/upload/${encodeURIComponent(filePath)}`;
+    const uploadUrl = `${baseUrl}/api/upload/${encodeURIComponent(filePath)}?uploadSessionId=${encodeURIComponent(uploadSessionId)}`;
     const uploadExpiresAt = new Date(Date.now() + 15 * 60 * 1000); // 15 minutes from now
     
     // Create file record in database with PENDING status
@@ -173,6 +211,9 @@ export async function createDirectUploadFile(
           announcement: {
             connect: { id: announcementId }
           }
+        }),
+        ...(conversationId && {
+          conversationId,
         })
       },
     });
@@ -330,11 +371,20 @@ export async function createDirectUploadFiles(
   directory?: string,
   assignmentId?: string,
   submissionId?: string,
-  announcementId?: string
+  announcementId?: string,
+  conversationId?: string
 ): Promise<DirectUploadFile[]> {
   try {
     const uploadPromises = files.map(file => 
-      createDirectUploadFile(file, userId, directory, assignmentId, submissionId, announcementId)
+      createDirectUploadFile(
+        file,
+        userId,
+        directory,
+        assignmentId,
+        submissionId,
+        announcementId,
+        conversationId
+      )
     );
     return await Promise.all(uploadPromises);
   } catch (error) {
@@ -348,4 +398,4 @@ export async function createDirectUploadFiles(
       message: 'Failed to create direct upload files',
     });
   }
-}
+}

package/src/middleware/auth.ts

@@ -8,11 +8,28 @@ import {
   findClassWithTeacher,
 } from "../models/auth.js";
 
+function getRequestToken(headers: MiddlewareContext["ctx"]["req"]["headers"]) {
+  const userHeader = headers["x-user"];
+  if (typeof userHeader === "string") {
+    return userHeader;
+  }
+  if (Array.isArray(userHeader) && userHeader.length > 0) {
+    return userHeader[0];
+  }
+
+  const authorizationHeader = headers.authorization;
+  if (typeof authorizationHeader === "string" && authorizationHeader.startsWith("Bearer ")) {
+    return authorizationHeader.slice(7);
+  }
+
+  return null;
+}
+
 export const createAuthMiddleware = (t: any) => {
   const isAuthed = t.middleware(async ({ next, ctx }: MiddlewareContext) => {
-    const userHeader = ctx.req.headers["x-user"];
+    const token = getRequestToken(ctx.req.headers);
 
-    if (!userHeader) {
+    if (!token) {
       throw new TRPCError({
         code: "UNAUTHORIZED",
         message: "Not authenticated - no token found",
@@ -20,8 +37,6 @@ export const createAuthMiddleware = (t: any) => {
     }
 
     try {
-      const token =
-        typeof userHeader === "string" ? userHeader : userHeader[0];
       const user = await findUserBySessionToken(token);
 
       if (!user) {

package/src/models/auth.ts

@@ -2,9 +2,25 @@
  * Auth model – user lookup, session CRUD, Redis session cache.
  * findUserBySessionToken checks Redis first, then DB.
  */
+import { SessionType } from "@prisma/client";
 import { getRedis } from "../lib/redis.js";
 import { prisma } from "../lib/prisma.js";
 
+const AUTH_SESSION_CACHE_PREFIX = "auth-session:";
+
+function getAuthSessionCacheKey(token: string) {
+  return `${AUTH_SESSION_CACHE_PREFIX}${token}`;
+}
+
+function getSessionTtlSeconds(expiresAt?: Date | null) {
+  if (!expiresAt) {
+    return null;
+  }
+
+  const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
+  return ttlSeconds > 0 ? ttlSeconds : null;
+}
+
 /** @returns User by username (includes password for login). */
 export function findUserByUsername(username: string) {
   return prisma.user.findFirst({
@@ -102,8 +118,10 @@ export function createUser(data: {
 /** Create a session. */
 export function createSession(data: {
   id: string;
-  userId: string;
+  type: SessionType;
   expiresAt: Date;
+  userId?: string;
+  classId?: string;
 }) {
   return prisma.session.create({
     data,
@@ -116,14 +134,14 @@ export async function deleteSessionsByUserId(userId: string) {
     where: { userId },
   });
   for (const session of sessions) {
-    await getRedis()?.del(`session:${session.id}`);
+    await getRedis()?.del(getAuthSessionCacheKey(session.id));
   }
   return prisma.session.deleteMany({
     where: { userId },
   });
 }
 
-/** Delete short-lived sessions (no classId) expiring before date. */
+/** Delete password reset sessions expiring before date. */
 export function deleteShortLivedSessionsByUserId(
   userId: string,
   expiresBefore: Date
@@ -131,7 +149,7 @@ export function deleteShortLivedSessionsByUserId(
   return prisma.session.deleteMany({
     where: {
       userId,
-      classId: null,
+      type: SessionType.PASSWORD_RESET,
       expiresAt: { lte: expiresBefore },
     },
   });
@@ -144,17 +162,17 @@ export function deleteUserById(id: string) {
   });
 }
 
-/** @returns Session by ID. */
-export function findSessionById(id: string) {
-  return prisma.session.findUnique({
-    where: { id },
+/** @returns Session by ID and type. */
+export function findSessionByIdAndType(id: string, type: SessionType) {
+  return prisma.session.findFirst({
+    where: { id, type },
   });
 }
 
-/** @returns Session with user. */
-export function findSessionByIdWithUser(id: string) {
-  return prisma.session.findUnique({
-    where: { id },
+/** @returns Session with user by ID and type. */
+export function findSessionByIdWithUserAndType(id: string, type: SessionType) {
+  return prisma.session.findFirst({
+    where: { id, type },
     include: {
       user: { select: { id: true } },
     },
@@ -178,39 +196,51 @@ export function updateUserPassword(userId: string, password: string) {
 }
 
 /** Delete a session. */
-export function deleteSessionById(id: string) {
+export async function deleteSessionById(id: string) {
+  await getRedis()?.del(getAuthSessionCacheKey(id));
   return prisma.session.delete({
     where: { id },
   });
 }
 
-/** @returns User from session token. Checks Redis first, then DB. Caches in Redis. */
+/** @returns User from valid auth session token. Checks Redis first, then DB. Caches in Redis. */
 export async function findUserBySessionToken(token: string) {
-  const session = await getRedis()?.get(`session:${token}`);
+  const cacheKey = getAuthSessionCacheKey(token);
+  const cachedUser = await getRedis()?.get(cacheKey);
 
-  if (session)
-    return JSON.parse(session);
+  if (cachedUser) {
+    return JSON.parse(cachedUser);
+  }
 
-  const user = await prisma.user.findFirst({
+  const session = await prisma.session.findFirst({
     where: {
-      sessions: { some: { id: token } },
+      id: token,
+      type: SessionType.AUTH,
+      userId: { not: null },
+      expiresAt: { gt: new Date() },
     },
     select: {
-      id: true,
-      username: true,
+      expiresAt: true,
+      user: {
+        select: {
+          id: true,
+          username: true,
+        },
+      },
     },
   });
 
-  if (user) {
-    const r = getRedis();
-    if (r) {
-      const ttlSeconds = 30 * 24 * 60 * 60; // 30 days, match session expiry
-      await r.setex(`session:${token}`, ttlSeconds, JSON.stringify(user));
-    }
-    return user;
+  if (!session?.user) {
+    return null;
+  }
+
+  const ttlSeconds = getSessionTtlSeconds(session.expiresAt);
+  const r = getRedis();
+  if (r && ttlSeconds) {
+    await r.setex(cacheKey, ttlSeconds, JSON.stringify(session.user));
   }
 
-  return null;
+  return session.user;
 }
 
 /** @returns Class IDs where user is a teacher. */

package/src/models/class.ts

@@ -4,7 +4,7 @@
  * grading boundaries, syllabus, lab drafts, invite codes.
  */
 
-import { Assignment, Class, Folder, GradingBoundary, MarkScheme, Section, Worksheet } from "@prisma/client";
+import { Assignment, Class, Folder, GradingBoundary, MarkScheme, Section, SessionType, Worksheet } from "@prisma/client";
 import type { PrismaClient, WorksheetQuestion } from "@prisma/client";
 
 import { prisma } from "../lib/prisma.js";
@@ -214,8 +214,18 @@ export function findClassWithAssignments(
       ? { studentId: options.userId }
       : undefined;
 
-  return prisma.class.findUnique({
-    where: { id: classId },
+  return prisma.class.findFirst({
+    where: {
+      id: classId,
+      ...(options.userId
+        ? {
+            OR: [
+              { students: { some: { id: options.userId } } },
+              { teachers: { some: { id: options.userId } } },
+            ],
+          }
+        : {}),
+    },
     include: {
       teachers: classIncludeForGet.teachers,
       students: classIncludeForGet.students,
@@ -261,6 +271,7 @@ export function findSessionByClassCode(classCode: string) {
   return prisma.session.findFirst({
     where: {
       id: { equals: classCode, mode: "insensitive" },
+      type: SessionType.CLASS_INVITE,
     },
   });
 }
@@ -700,4 +711,4 @@ export async function createClassByImport(classId: string, userId: string, year:
   }, { timeout: 30000 });
 
   return newClassId;
-}
+}

package/src/models/notification.ts

@@ -18,9 +18,9 @@ export function findNotificationsByReceiverId(receiverId: string) {
 }
 
 /** @returns Notification by ID. */
-export function findNotificationById(id: string) {
-  return prisma.notification.findUnique({
-    where: { id },
+export function findNotificationByIdForReceiver(id: string, receiverId: string) {
+  return prisma.notification.findFirst({
+    where: { id, receiverId },
     include: notificationInclude,
   });
 }
@@ -45,10 +45,16 @@ export function createManyNotifications(
   });
 }
 
-/** Mark a notification as read. */
-export function markNotificationAsRead(id: string) {
-  return prisma.notification.update({
-    where: { id },
+/** Mark a receiver's notification as read. */
+export async function markNotificationAsReadForReceiver(id: string, receiverId: string) {
+  const result = await prisma.notification.updateMany({
+    where: { id, receiverId },
     data: { read: true },
   });
+
+  if (result.count === 0) {
+    return null;
+  }
+
+  return findNotificationByIdForReceiver(id, receiverId);
 }