@studious-lms/server 1.4.2 → 1.4.4

package/src/routers/worksheet.ts

@@ -1,8 +1,15 @@
 import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
+import {
+  confirmDirectUpload,
+  createDirectUploadFiles,
+  updateUploadProgress,
+} from "../lib/fileUpload.js";
 import {
   createTRPCRouter,
   protectedClassMemberProcedure,
   protectedProcedure,
+  protectedTeacherProcedure,
 } from "../trpc.js";
 import { z } from "zod";
 import {
@@ -12,6 +19,8 @@ import {
   updateWorksheetRecord,
   deleteWorksheetRecord,
   createWorksheetRecord,
+  createWorksheetFromPdf,
+  createWorksheetFromUploadedPdf,
   addQuestionToWorksheet,
   reorderWorksheetQuestions,
   updateWorksheetQuestionRecord,
@@ -24,10 +33,44 @@ import {
   addCommentToResponse,
 } from "../services/worksheet.js";
 
+const directFileSchema = z.object({
+  name: z.string(),
+  type: z.string(),
+  size: z.number(),
+});
+
+const pdfFileSchema = directFileSchema.superRefine((file, ctx) => {
+  const isPdf =
+    file.type === "application/pdf" && file.name.toLowerCase().endsWith(".pdf");
+  if (!isPdf) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Only PDF files are supported",
+    });
+  }
+});
+
+const getWorksheetUploadUrlsSchema = z.object({
+  classId: z.string(),
+  files: z.array(pdfFileSchema),
+});
+
+const confirmWorksheetUploadSchema = z.object({
+  classId: z.string(),
+  fileId: z.string(),
+  uploadSuccess: z.boolean(),
+  errorMessage: z.string().optional(),
+});
+
+const updateUploadProgressSchema = z.object({
+  fileId: z.string(),
+  progress: z.number().min(0).max(100),
+});
+
 export const worksheetRouter = createTRPCRouter({
   getWorksheet: protectedProcedure
     .input(z.object({ worksheetId: z.string() }))
-    .query(({ input }) => getWorksheet(input.worksheetId)),
+    .query(({ ctx, input }) => getWorksheet(input.worksheetId, ctx.user!.id)),
 
   exists: protectedClassMemberProcedure
     .input(z.object({ id: z.string() }))
@@ -41,26 +84,99 @@ export const worksheetRouter = createTRPCRouter({
       return worksheetExists(input.id);
     }),
 
-  listWorksheets: protectedProcedure
+  listWorksheets: protectedClassMemberProcedure
     .input(z.object({ classId: z.string() }))
     .query(({ input }) => listWorksheets(input.classId)),
 
   updateWorksheet: protectedProcedure
     .input(z.object({ worksheetId: z.string(), name: z.string().optional() }))
-    .mutation(({ input }) =>
-      updateWorksheetRecord(input.worksheetId, { name: input.name })
+    .mutation(({ ctx, input }) =>
+      updateWorksheetRecord(input.worksheetId, ctx.user!.id, {
+        name: input.name,
+      })
     ),
 
   deleteWorksheet: protectedProcedure
     .input(z.object({ worksheetId: z.string() }))
-    .mutation(({ input }) => deleteWorksheetRecord(input.worksheetId)),
+    .mutation(({ ctx, input }) =>
+      deleteWorksheetRecord(input.worksheetId, ctx.user!.id)
+    ),
 
-  create: protectedProcedure
+  create: protectedTeacherProcedure
     .input(z.object({ classId: z.string(), name: z.string() }))
     .mutation(({ input }) =>
       createWorksheetRecord(input.classId, input.name)
     ),
 
+  createFromPdf: protectedTeacherProcedure
+    .input(z.object({ classId: z.string(), url: z.string().url() }))
+    .mutation(({ input }) => createWorksheetFromPdf(input.classId, input.url)),
+
+  getWorksheetUploadUrls: protectedTeacherProcedure
+    .input(getWorksheetUploadUrlsSchema)
+    .mutation(async ({ ctx, input }) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "You must be logged in to upload files",
+        });
+      }
+
+      const uploadFiles = await createDirectUploadFiles(
+        input.files,
+        ctx.user.id
+      );
+
+      return {
+        success: true,
+        uploadFiles,
+      };
+    }),
+
+  confirmWorksheetUpload: protectedTeacherProcedure
+    .input(confirmWorksheetUploadSchema)
+    .mutation(async ({ ctx, input }) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "You must be logged in",
+        });
+      }
+
+      const file = await prisma.file.findFirst({
+        where: {
+          id: input.fileId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (!file) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "File not found or you don't have permission",
+        });
+      }
+
+      await confirmDirectUpload(
+        input.fileId,
+        input.uploadSuccess,
+        input.errorMessage
+      );
+
+      return {
+        success: true,
+        message: input.uploadSuccess
+          ? "Upload confirmed successfully"
+          : "Upload failed",
+      };
+    }),
+
+  createFromUploadedPdf: protectedTeacherProcedure
+    .input(z.object({ classId: z.string(), fileId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      createWorksheetFromUploadedPdf(input.classId, input.fileId, ctx.user!.id)
+    ),
+
   addQuestion: protectedProcedure
     .input(
       z.object({
@@ -80,8 +196,8 @@ export const worksheetRouter = createTRPCRouter({
         ]),
       })
     )
-    .mutation(({ input }) =>
-      addQuestionToWorksheet(input.worksheetId, {
+    .mutation(({ ctx, input }) =>
+      addQuestionToWorksheet(input.worksheetId, ctx.user!.id, {
         question: input.question,
         answer: input.answer,
         points: input.points,
@@ -100,9 +216,10 @@ export const worksheetRouter = createTRPCRouter({
         targetId: z.string(),
       })
     )
-    .mutation(({ input }) =>
+    .mutation(({ ctx, input }) =>
       reorderWorksheetQuestions(
         input.worksheetId,
+        ctx.user!.id,
         input.movedId,
         input.position,
         input.targetId
@@ -131,10 +248,11 @@ export const worksheetRouter = createTRPCRouter({
           .optional(),
       })
     )
-    .mutation(({ input }) =>
+    .mutation(({ ctx, input }) =>
       updateWorksheetQuestionRecord(
         input.worksheetId,
         input.questionId,
+        ctx.user!.id,
         {
           question: input.question,
           answer: input.answer,
@@ -153,8 +271,12 @@ export const worksheetRouter = createTRPCRouter({
         questionId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      deleteWorksheetQuestionRecord(input.worksheetId, input.questionId)
+    .mutation(({ ctx, input }) =>
+      deleteWorksheetQuestionRecord(
+        input.worksheetId,
+        input.questionId,
+        ctx.user!.id
+      )
     ),
 
   getWorksheetSubmission: protectedProcedure
@@ -164,8 +286,8 @@ export const worksheetRouter = createTRPCRouter({
         submissionId: z.string(),
       })
     )
-    .query(({ input }) =>
-      getWorksheetSubmission(input.worksheetId, input.submissionId)
+    .query(({ ctx, input }) =>
+      getWorksheetSubmission(input.worksheetId, input.submissionId, ctx.user!.id)
     ),
 
   answerQuestion: protectedProcedure
@@ -192,8 +314,8 @@ export const worksheetRouter = createTRPCRouter({
         progressId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      cancelGrading(input.worksheetResponseId, input.progressId)
+    .mutation(({ ctx, input }) =>
+      cancelGrading(input.worksheetResponseId, input.progressId, ctx.user!.id)
     ),
 
   regradeQuestion: protectedProcedure
@@ -203,8 +325,8 @@ export const worksheetRouter = createTRPCRouter({
         progressId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      regradeQuestion(input.worksheetResponseId, input.progressId)
+    .mutation(({ ctx, input }) =>
+      regradeQuestion(input.worksheetResponseId, input.progressId, ctx.user!.id)
     ),
 
   gradeAnswer: protectedProcedure
@@ -220,10 +342,11 @@ export const worksheetRouter = createTRPCRouter({
         points: z.number().optional(),
       })
     )
-    .mutation(({ input }) =>
+    .mutation(({ ctx, input }) =>
       gradeAnswer(
         input.questionId,
         input.studentWorksheetResponseId,
+        ctx.user!.id,
         {
           responseId: input.responseId,
           response: input.response,
@@ -249,4 +372,36 @@ export const worksheetRouter = createTRPCRouter({
         ctx.user!.id
       )
     ),
+
+  updateUploadProgress: protectedProcedure
+    .input(updateUploadProgressSchema)
+    .mutation(async ({ ctx, input }) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "You must be logged in",
+        });
+      }
+
+      const file = await prisma.file.findFirst({
+        where: {
+          id: input.fileId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (!file) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "File not found or you don't have permission",
+        });
+      }
+
+      await updateUploadProgress(input.fileId, input.progress);
+
+      return {
+        success: true,
+        progress: input.progress,
+      };
+    }),
 });

package/src/services/auth.ts

@@ -2,6 +2,7 @@
  * Auth service – user registration, login, logout, verification, and password reset.
  * Handles session creation, Redis caching, and email notifications.
  */
+import { SessionType } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
 import { v4 as uuidv4 } from "uuid";
 import { compare, hash } from "bcryptjs";
@@ -19,13 +20,12 @@ import {
   deleteSessionsByUserId,
   deleteShortLivedSessionsByUserId,
   deleteUserById,
-  findSessionById,
-  findSessionByIdWithUser,
+  findSessionByIdAndType,
+  findSessionByIdWithUserAndType,
   updateUserVerified,
   updateUserPassword,
   deleteSessionById,
 } from "../models/auth.js";
-import { getRedis } from "../lib/redis.js";
 
 /** Register a new user, create verification session, and send verification email. */
 export async function register(input: {
@@ -79,6 +79,7 @@ export async function register(input: {
     () =>
       createSession({
         id: uuidv4(),
+        type: SessionType.EMAIL_VERIFICATION,
         userId: user.id,
         expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
       }),
@@ -102,7 +103,7 @@ export async function register(input: {
   return { user: { id: user.id, username: user.username } };
 }
 
-/** Authenticate user by username/password, create session, and cache in Redis. */
+/** Authenticate user by username/password, create session. */
 export async function login(input: { username: string; password: string }) {
   const { username, password } = input;
 
@@ -130,15 +131,11 @@ export async function login(input: { username: string; password: string }) {
 
   const session = await createSession({
     id: uuidv4(),
+    type: SessionType.AUTH,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
   });
 
-  const cachePayload = JSON.stringify({ id: user.id, username: user.username });
-  const ttlSeconds = 30 * 24 * 60 * 60; // 30 days, match session expiry
-  const r = getRedis();
-  if (r) await r.setex(`session:${session.id}`, ttlSeconds, cachePayload);
-
   return {
     token: session.id,
     user: { id: user.id, username: user.username },
@@ -177,6 +174,7 @@ export async function resendVerificationEmail(email: string) {
 
   const verificationToken = await createSession({
     id: uuidv4(),
+    type: SessionType.EMAIL_VERIFICATION,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
   });
@@ -200,7 +198,10 @@ export async function resendVerificationEmail(email: string) {
 
 /** Verify email via token. Marks user as verified and deletes the session. */
 export async function verify(token: string) {
-  const session = await findSessionById(token);
+  const session = await findSessionByIdAndType(
+    token,
+    SessionType.EMAIL_VERIFICATION
+  );
   if (!session) {
     throw new TRPCError({
       code: "NOT_FOUND",
@@ -209,13 +210,22 @@ export async function verify(token: string) {
   }
 
   if (session.expiresAt && session.expiresAt < new Date()) {
+    await deleteSessionById(token);
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "Session expired",
     });
   }
 
-  await updateUserVerified(session.userId!, true);
+  if (!session.userId) {
+    await deleteSessionById(token);
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Invalid session state",
+    });
+  }
+
+  await updateUserVerified(session.userId, true);
   await deleteSessionById(token);
   return { success: true };
 }
@@ -232,6 +242,7 @@ export async function requestPasswordReset(email: string) {
 
   const resetToken = await createSession({
     id: uuidv4(),
+    type: SessionType.PASSWORD_RESET,
     userId: user.id,
     expiresAt: new Date(Date.now() + 1000 * 60 * 60),
   });
@@ -255,7 +266,10 @@ export async function requestPasswordReset(email: string) {
 
 /** Reset password using token from email. Validates token and updates password. */
 export async function resetPassword(token: string, password: string) {
-  const session = await findSessionByIdWithUser(token);
+  const session = await findSessionByIdWithUserAndType(
+    token,
+    SessionType.PASSWORD_RESET
+  );
   if (!session || !session.userId) {
     throw new TRPCError({
       code: "NOT_FOUND",

package/src/services/class.ts

@@ -2,6 +2,7 @@
  * Class service – CRUD for classes, members, grades, mark schemes, grading boundaries,
  * syllabus, lab drafts, and invite codes.
  */
+import { SessionType } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
 import { generateInviteCode } from "../utils/generateInviteCode.js";
@@ -286,6 +287,7 @@ export async function getInviteCode(classId: string) {
       data: {
         id: generateInviteCode(),
         classId,
+        type: SessionType.CLASS_INVITE,
         expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
       },
     });
@@ -297,13 +299,14 @@ export async function getInviteCode(classId: string) {
 
 export async function createInviteCode(classId: string) {
   await prisma.session.deleteMany({
-    where: { classId },
+    where: { classId, type: SessionType.CLASS_INVITE },
   });
 
   const session = await prisma.session.create({
     data: {
       id: generateInviteCode(),
       classId,
+      type: SessionType.CLASS_INVITE,
       expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
     },
   });

package/src/services/file.ts

@@ -14,6 +14,7 @@ import {
   updateFileName,
   deleteFileById,
 } from "../models/file.js";
+import { findConversationMembership } from "../models/message.js";
 
 /** Generate a signed URL for file download. Validates user has access. */
 export async function getFileSignedUrl(userId: string, fileId: string) {
@@ -65,6 +66,11 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
     hasAccess = true;
   }
 
+  if (file.conversationId) {
+    const membership = await findConversationMembership(file.conversationId, userId);
+    hasAccess = hasAccess || Boolean(membership);
+  }
+
   if (file.folder?.class) {
     const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
     const isStudent = file.folder.class.students.some((s) => s.id === userId);

package/src/services/labChat.ts

@@ -20,6 +20,10 @@ import {
 import { generateAndSendLabIntroduction, generateAndSendLabResponse } from "../pipelines/aiLabChat.js";
 import { isAIUser } from "../utils/aiUser.js";
 import { logger } from "../utils/logger.js";
+import {
+  claimMessageAttachments,
+  ensureMessageHasContentOrAttachments,
+} from "./message.js";
 
 /** Create a lab chat with conversation and teacher members. Broadcasts via Pusher. */
 export async function createLabChat(
@@ -213,9 +217,10 @@ export async function postToLabChat(
     labChatId: string;
     content: string;
     mentionedUserIds?: string[];
+    fileIds?: string[];
   }
 ) {
-  const { labChatId, content, mentionedUserIds = [] } = input;
+  const { labChatId, content, mentionedUserIds = [], fileIds = [] } = input;
 
   const labChat = await findLabChatForPost(labChatId, userId);
   if (!labChat) {
@@ -238,30 +243,27 @@ export async function postToLabChat(
     }
   }
 
+  ensureMessageHasContentOrAttachments(content, fileIds);
+  const normalizedContent = content.trim();
+
   const result = await prisma.$transaction(async (tx) => {
     const message = await tx.message.create({
       data: {
-        content,
+        content: normalizedContent,
         senderId: userId,
         conversationId: labChat.conversationId,
         ...(isAIUser(userId) ? {} : { status: GenerationStatus.PENDING }),
       },
-      include: {
-        sender: {
-          select: {
-            id: true,
-            username: true,
-            profile: {
-              select: {
-                displayName: true,
-                profilePicture: true,
-              },
-            },
-          },
-        },
-      },
     });
 
+    await claimMessageAttachments(
+      tx,
+      userId,
+      labChat.conversationId,
+      message.id,
+      fileIds
+    );
+
     if (mentionedUserIds.length > 0) {
       await tx.mention.createMany({
         data: mentionedUserIds.map((mentionedUserId) => ({
@@ -276,7 +278,26 @@ export async function postToLabChat(
       data: { updatedAt: new Date() },
     });
 
-    return message;
+    return tx.message.findUniqueOrThrow({
+      where: { id: message.id },
+      include: {
+        sender: {
+          select: {
+            id: true,
+            username: true,
+            profile: {
+              select: {
+                displayName: true,
+                profilePicture: true,
+              },
+            },
+          },
+        },
+        attachments: {
+          select: { id: true, name: true, type: true },
+        },
+      },
+    });
   });
 
   try {
@@ -290,7 +311,9 @@ export async function postToLabChat(
         conversationId: result.conversationId,
         createdAt: result.createdAt,
         sender: result.sender,
+        attachments: result.attachments ?? [],
         mentionedUserIds,
+        meta: {},
       }
     );
   } catch (error) {
@@ -307,7 +330,7 @@ export async function postToLabChat(
     } catch (error) {
       console.error("Failed to broadcast lab response pending:", error);
     }
-    generateAndSendLabResponse(labChatId, content, {
+    generateAndSendLabResponse(labChatId, normalizedContent, {
       classId: labChat.classId,
       messageId: result.id,
     }).catch((error) =>
@@ -327,6 +350,7 @@ export async function postToLabChat(
     conversationId: result.conversationId,
     createdAt: result.createdAt,
     sender: result.sender,
+    attachments: result.attachments ?? [],
     mentionedUserIds,
   };
 }