@studious-lms/server 1.4.4 → 1.4.6

package/src/routers/search.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
+import { searchGlobalClasses } from "../services/search.js";
+
+export const searchRouter = createTRPCRouter({
+  global: protectedProcedure
+    .input(
+      z.object({
+        query: z.string().max(80).optional(),
+        limit: z.number().int().min(1).max(30).optional(),
+      })
+    )
+    .query(({ ctx, input }) => searchGlobalClasses(ctx.user!.id, input)),
+});

package/src/services/comment.ts

@@ -1,7 +1,8 @@
 /**
- * Comment service – get comments, replies, and reactions. Used for announcements and worksheets.
+ * Comment service – get comments, replies, and reactions.
  */
 import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
 import {
   findCommentById,
   findRepliesByCommentId,
@@ -9,12 +10,81 @@ import {
   findReactionByUserAndComment,
   upsertReaction,
   deleteReactionById,
-  findCommentWithAnnouncement,
+  findCommentWithContext,
   getReactionCountsByCommentId,
 } from "../models/comment.js";
 
+function getCommentClass(comment: any) {
+  return (
+    comment.announcement?.class ??
+    comment.assignment?.class ??
+    comment.submission?.assignment?.class ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    comment.parentComment?.announcement?.class ??
+    comment.parentComment?.assignment?.class ??
+    comment.parentComment?.submission?.assignment?.class ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    null
+  );
+}
+
+function getPrivateStudentId(comment: any) {
+  return (
+    comment.submission?.studentId ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.studentQuestionProgress?.studentId ??
+    comment.parentComment?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentId ??
+    null
+  );
+}
+
+function isClassTeacher(comment: any, userId: string) {
+  return getCommentClass(comment)?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ?? false;
+}
+
+function isClassMember(comment: any, userId: string) {
+  const classData = getCommentClass(comment);
+  return (
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+    classData?.students?.some((student: { id: string }) => student.id === userId) ||
+    false
+  );
+}
+
+function canReadComment(comment: any, userId: string) {
+  const privateStudentId = getPrivateStudentId(comment);
+  if (privateStudentId) {
+    return privateStudentId === userId || isClassTeacher(comment, userId);
+  }
+  return isClassMember(comment, userId);
+}
+
+function canDeleteComment(comment: any, userId: string) {
+  return comment.authorId === userId || isClassTeacher(comment, userId);
+}
+
+async function requireCommentAccess(commentId: string, userId: string) {
+  const comment = await findCommentWithContext(commentId);
+  if (!comment) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Comment not found",
+    });
+  }
+  if (!canReadComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You do not have access to this comment",
+    });
+  }
+  return comment;
+}
+
 /** Get a comment by ID. */
-export async function getComment(id: string) {
+export async function getComment(userId: string, id: string) {
+  await requireCommentAccess(id, userId);
   const comment = await findCommentById(id);
   if (!comment) {
     throw new TRPCError({
@@ -26,7 +96,8 @@ export async function getComment(id: string) {
 }
 
 /** Get all replies to a comment. */
-export async function getReplies(commentId: string) {
+export async function getReplies(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   return findRepliesByCommentId(commentId);
 }
 
@@ -36,26 +107,55 @@ export async function replyToComment(
   parentCommentId: string,
   content: string
 ) {
+  const parentComment = await requireCommentAccess(parentCommentId, userId);
   return createComment({
     parentCommentId,
     content,
     authorId: userId,
+    announcementId: parentComment.announcementId,
+    assignmentId: parentComment.assignmentId,
+    submissionId: parentComment.submissionId,
+    studentQuestionProgressId: parentComment.studentQuestionProgressId,
   });
 }
 
+/** Update a comment authored by the user. */
+export async function updateComment(userId: string, id: string, content: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (comment.authorId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author can update this comment",
+    });
+  }
+
+  return prisma.comment.update({
+    where: { id },
+    data: { content },
+  });
+}
+
+/** Delete a comment authored by the user or moderated by a class teacher. */
+export async function deleteComment(userId: string, id: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (!canDeleteComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author or class teachers can delete comments",
+    });
+  }
+
+  await prisma.comment.delete({ where: { id } });
+  return { success: true };
+}
+
 /** Add or update a reaction (emoji) on a comment. */
 export async function addReaction(
   userId: string,
   commentId: string,
   type: string
 ) {
-  const comment = await findCommentById(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: "Unexpected error",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reaction = await upsertReaction({ userId, commentId, type });
   return { reaction };
@@ -63,6 +163,7 @@ export async function addReaction(
 
 /** Remove user's reaction from a comment. */
 export async function removeReaction(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   const reaction = await findReactionByUserAndComment(userId, commentId);
   if (!reaction) {
     throw new TRPCError({
@@ -75,13 +176,7 @@ export async function removeReaction(userId: string, commentId: string) {
 }
 
 export async function getReactions(userId: string, commentId: string) {
-  const comment = await findCommentWithAnnouncement(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Comment not found",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reactionCounts = await getReactionCountsByCommentId(commentId);
   const userReaction = await findReactionByUserAndComment(userId, commentId);

package/src/services/conversation.ts

@@ -13,15 +13,25 @@ import {
   createConversation,
   findConversationByIdAndMember,
   createConversationMember,
+  hideConversationMember,
   deleteConversationMember,
 } from "../models/conversation.js";
 
 /** List user's conversations with unread and mention counts. */
 export async function listConversations(userId: string) {
   const conversations = await findConversationsByUserId(userId);
+  const visibleConversations = conversations.filter((conversation) => {
+    const userMembership = conversation.members.find((member) => member.userId === userId);
+
+    if (!userMembership?.hiddenAt) {
+      return true;
+    }
+
+    return conversation.updatedAt > userMembership.hiddenAt;
+  });
 
   const conversationsWithUnread = await Promise.all(
-    conversations.map(async (conversation) => {
+    visibleConversations.map(async (conversation) => {
       const userMembership = conversation.members.find(
         (m) => m.userId === userId
       );
@@ -65,6 +75,20 @@ export async function listConversations(userId: string) {
   return conversationsWithUnread;
 }
 
+export async function hideConversation(userId: string, conversationId: string) {
+  const conversation = await findConversationByIdAndMember(conversationId, userId);
+  if (!conversation) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Not a member of this conversation",
+    });
+  }
+
+  await hideConversationMember(userId, conversationId);
+
+  return { success: true };
+}
+
 /** Create a DM or group conversation with the given members. */
 export async function createConversationRecord(
   userId: string,
@@ -87,11 +111,11 @@ export async function createConversationRecord(
   }
 
   if (type === "DM") {
-    const targetUser = await findUserByUsername(memberIds[0]);
+    const [targetUser] = await findUsersByIdsOrUsernames([memberIds[0]]);
     if (!targetUser) {
       throw new TRPCError({
         code: "BAD_REQUEST",
-        message: `User "${memberIds[0]}" not found`,
+        message: `User not found`,
       });
     }
 

package/src/services/message.ts

@@ -259,6 +259,14 @@ export async function sendMessage(
       });
     }
 
+    await tx.conversationMember.updateMany({
+      where: {
+        conversationId,
+        hiddenAt: { not: null },
+      },
+      data: { hiddenAt: null },
+    });
+
     await tx.conversation.update({
       where: { id: conversationId },
       data: { updatedAt: new Date() },

package/src/services/search.ts

@@ -0,0 +1,397 @@
+import { prisma } from "../lib/prisma.js";
+
+type SearchScope =
+  | "class"
+  | "assignment"
+  | "event"
+  | "syllabus"
+  | "worksheet"
+  | "file"
+  | "announcement"
+  | "section";
+
+type SearchResult = {
+  id: string;
+  type: SearchScope;
+  title: string;
+  subtitle: string;
+  classId: string;
+  className: string;
+  href: string;
+  matchedText?: string | null;
+  date?: Date | null;
+};
+
+const SEARCH_LIMIT = 12;
+
+const contains = (query: string) => ({
+  contains: query,
+  mode: "insensitive" as const,
+});
+
+const includesToken = (query: string, ...tokens: string[]) =>
+  tokens.some((token) => token.includes(query.toLowerCase()));
+
+const excerpt = (value: string | null | undefined, query: string) => {
+  if (!value) return null;
+  const trimmed = value.replace(/\s+/g, " ").trim();
+  if (!trimmed) return null;
+  if (!query) return trimmed.slice(0, 140);
+
+  const index = trimmed.toLowerCase().indexOf(query.toLowerCase());
+  if (index < 0) return trimmed.slice(0, 140);
+
+  const start = Math.max(0, index - 48);
+  const end = Math.min(trimmed.length, index + query.length + 92);
+  return `${start > 0 ? "..." : ""}${trimmed.slice(start, end)}${end < trimmed.length ? "..." : ""}`;
+};
+
+const trimResults = (results: SearchResult[], limit: number) =>
+  results
+    .sort((a, b) => {
+      const priority: Record<SearchScope, number> = {
+        class: 0,
+        assignment: 1,
+        event: 2,
+        syllabus: 3,
+        worksheet: 4,
+        file: 5,
+        announcement: 6,
+        section: 7,
+      };
+      const priorityDiff = priority[a.type] - priority[b.type];
+      if (priorityDiff !== 0) return priorityDiff;
+      return (b.date?.getTime() ?? 0) - (a.date?.getTime() ?? 0);
+    })
+    .slice(0, limit);
+
+export async function searchGlobalClasses(
+  userId: string,
+  input: { query?: string; limit?: number }
+) {
+  const rawQuery = input.query?.trim() ?? "";
+  const query = rawQuery.slice(0, 80);
+  const limit = Math.min(Math.max(input.limit ?? SEARCH_LIMIT, 1), 30);
+
+  const memberships = await prisma.class.findMany({
+    where: {
+      OR: [
+        { teachers: { some: { id: userId } } },
+        { students: { some: { id: userId } } },
+      ],
+    },
+    select: {
+      id: true,
+      name: true,
+      section: true,
+      subject: true,
+      syllabus: true,
+      teachers: { where: { id: userId }, select: { id: true } },
+      students: { where: { id: userId }, select: { id: true } },
+    },
+  });
+
+  const allClassIds = memberships.map((cls) => cls.id);
+  if (allClassIds.length === 0) {
+    return { query, results: [] as SearchResult[] };
+  }
+
+  const teacherClassIds = memberships
+    .filter((cls) => cls.teachers.length > 0)
+    .map((cls) => cls.id);
+  const studentClassIds = memberships
+    .filter((cls) => cls.students.length > 0 && cls.teachers.length === 0)
+    .map((cls) => cls.id);
+  const classById = new Map(memberships.map((cls) => [cls.id, cls]));
+
+  const queryFilters = query
+    ? {
+        class: [
+          { name: contains(query) },
+          { section: contains(query) },
+          { subject: contains(query) },
+        ],
+        assignment: [
+          { title: contains(query) },
+          { instructions: contains(query) },
+        ],
+        event: [
+          { name: contains(query) },
+          { location: contains(query) },
+          { remarks: contains(query) },
+        ],
+        worksheet: [{ name: contains(query) }],
+        file: [{ name: contains(query) }, { type: contains(query) }],
+        announcement: [{ remarks: contains(query) }],
+        section: [{ name: contains(query) }],
+      }
+    : null;
+
+  const assignmentAccess = [
+    ...(teacherClassIds.length > 0
+      ? [{ classId: { in: teacherClassIds } }]
+      : []),
+    ...(studentClassIds.length > 0
+      ? [
+          {
+            classId: { in: studentClassIds },
+            OR: [
+              { assignedTo: { some: { id: userId } } },
+              { assignedTo: { none: {} } },
+            ],
+          },
+        ]
+      : []),
+  ];
+
+  const [
+    classes,
+    assignments,
+    events,
+    worksheets,
+    files,
+    announcements,
+    sections,
+  ] = await Promise.all([
+    prisma.class.findMany({
+      where: {
+        id: { in: allClassIds },
+        ...(queryFilters ? { OR: queryFilters.class } : {}),
+      },
+      select: { id: true, name: true, section: true, subject: true },
+      take: limit,
+    }),
+    prisma.assignment.findMany({
+      where: {
+        template: false,
+        AND: [
+          ...(queryFilters ? [{ OR: queryFilters.assignment }] : []),
+          ...(assignmentAccess.length > 0 ? [{ OR: assignmentAccess }] : []),
+        ],
+      },
+      select: {
+        id: true,
+        title: true,
+        instructions: true,
+        dueDate: true,
+        modifiedAt: true,
+        classId: true,
+        class: { select: { name: true } },
+      },
+      orderBy: { dueDate: "asc" },
+      take: limit,
+    }),
+    prisma.event.findMany({
+      where: {
+        classId: { in: allClassIds },
+        ...(queryFilters ? { OR: queryFilters.event } : {}),
+      },
+      select: {
+        id: true,
+        name: true,
+        location: true,
+        remarks: true,
+        startTime: true,
+        classId: true,
+        class: { select: { name: true } },
+      },
+      orderBy: { startTime: "asc" },
+      take: limit,
+    }),
+    prisma.worksheet.findMany({
+      where: {
+        classId: { in: allClassIds },
+        ...(queryFilters && !includesToken(query, "worksheet", "worksheets")
+          ? { OR: queryFilters.worksheet }
+          : {}),
+      },
+      select: {
+        id: true,
+        name: true,
+        updatedAt: true,
+        classId: true,
+        class: { select: { name: true } },
+      },
+      orderBy: { updatedAt: "desc" },
+      take: limit,
+    }),
+    prisma.file.findMany({
+      where: {
+        ...(queryFilters ? { OR: queryFilters.file } : {}),
+        AND: [
+          {
+            OR: [
+              { folder: { classId: { in: allClassIds } } },
+              { classDraftId: { in: teacherClassIds } },
+              {
+                assignment: {
+                  OR: assignmentAccess,
+                },
+              },
+              { announcement: { classId: { in: allClassIds } } },
+            ],
+          },
+        ],
+      },
+      select: {
+        id: true,
+        name: true,
+        type: true,
+        uploadedAt: true,
+        folder: { select: { classId: true, class: { select: { name: true } } } },
+        classDraft: { select: { id: true, name: true } },
+        assignment: { select: { classId: true, class: { select: { name: true } } } },
+        announcement: { select: { classId: true, class: { select: { name: true } } } },
+      },
+      orderBy: { uploadedAt: "desc" },
+      take: limit,
+    }),
+    prisma.announcement.findMany({
+      where: {
+        classId: { in: allClassIds },
+        ...(queryFilters ? { OR: queryFilters.announcement } : {}),
+      },
+      select: {
+        id: true,
+        remarks: true,
+        createdAt: true,
+        classId: true,
+        class: { select: { name: true } },
+      },
+      orderBy: { createdAt: "desc" },
+      take: limit,
+    }),
+    prisma.section.findMany({
+      where: {
+        classId: { in: allClassIds },
+        ...(queryFilters && !includesToken(query, "section", "sections", "assignment", "assignments")
+          ? { OR: queryFilters.section }
+          : {}),
+      },
+      select: {
+        id: true,
+        name: true,
+        classId: true,
+        class: { select: { name: true } },
+      },
+      take: limit,
+    }),
+  ]);
+
+  const results: SearchResult[] = [
+    ...classes.map((cls) => ({
+      id: cls.id,
+      type: "class" as const,
+      title: cls.name,
+      subtitle: [cls.subject, cls.section].filter(Boolean).join(" · "),
+      classId: cls.id,
+      className: cls.name,
+      href: `/class/${cls.id}`,
+    })),
+    ...assignments.map((assignment) => ({
+      id: assignment.id,
+      type: "assignment" as const,
+      title: assignment.title,
+      subtitle: `${assignment.class.name} · Assignment`,
+      classId: assignment.classId,
+      className: assignment.class.name,
+      href: `/class/${assignment.classId}/assignment/${assignment.id}`,
+      matchedText: excerpt(assignment.instructions, query),
+      date: assignment.dueDate ?? assignment.modifiedAt,
+    })),
+    ...events.map((event) => ({
+      id: event.id,
+      type: "event" as const,
+      title: event.name || "Untitled event",
+      subtitle: `${event.class?.name ?? "Class"} · Event`,
+      classId: event.classId!,
+      className: event.class?.name ?? "Class",
+      href: `/class/${event.classId}/attendance/${event.id}`,
+      matchedText: excerpt(event.location || event.remarks, query),
+      date: event.startTime,
+    })),
+    ...memberships
+      .filter((cls) => {
+        if (!cls.syllabus) return false;
+        if (!query) return true;
+        return (
+          includesToken(query, "syllabus") ||
+          cls.name.toLowerCase().includes(query.toLowerCase()) ||
+          cls.subject.toLowerCase().includes(query.toLowerCase()) ||
+          cls.syllabus.toLowerCase().includes(query.toLowerCase())
+        );
+      })
+      .slice(0, limit)
+      .map((cls) => ({
+        id: `${cls.id}:syllabus`,
+        type: "syllabus" as const,
+        title: `${cls.name} syllabus`,
+        subtitle: `${cls.subject} · Syllabus`,
+        classId: cls.id,
+        className: cls.name,
+        href: `/class/${cls.id}/syllabus`,
+        matchedText: excerpt(cls.syllabus, query),
+      })),
+    ...worksheets.map((worksheet) => ({
+      id: worksheet.id,
+      type: "worksheet" as const,
+      title: worksheet.name,
+      subtitle: `${worksheet.class?.name ?? "Class"} · Worksheet`,
+      classId: worksheet.classId,
+      className: worksheet.class?.name ?? "Class",
+      href: `/class/${worksheet.classId}/worksheets`,
+      date: worksheet.updatedAt,
+    })),
+    ...files.flatMap((file) => {
+      const classId =
+        file.folder?.classId ??
+        file.classDraft?.id ??
+        file.assignment?.classId ??
+        file.announcement?.classId;
+      const className =
+        file.folder?.class?.name ??
+        file.classDraft?.name ??
+        file.assignment?.class?.name ??
+        file.announcement?.class?.name ??
+        (classId ? classById.get(classId)?.name : undefined);
+
+      if (!classId || !className) return [];
+
+      return [
+        {
+          id: file.id,
+          type: "file" as const,
+          title: file.name,
+          subtitle: `${className} · File`,
+          classId,
+          className,
+          href: `/class/${classId}/files`,
+          matchedText: file.type,
+          date: file.uploadedAt,
+        },
+      ];
+    }),
+    ...announcements.map((announcement) => ({
+      id: announcement.id,
+      type: "announcement" as const,
+      title: excerpt(announcement.remarks, query) ?? "Announcement",
+      subtitle: `${announcement.class.name} · Announcement`,
+      classId: announcement.classId,
+      className: announcement.class.name,
+      href: `/class/${announcement.classId}`,
+      matchedText: excerpt(announcement.remarks, query),
+      date: announcement.createdAt,
+    })),
+    ...sections.map((section) => ({
+      id: section.id,
+      type: "section" as const,
+      title: section.name,
+      subtitle: `${section.class.name} · Section`,
+      classId: section.classId,
+      className: section.class.name,
+      href: `/class/${section.classId}/assignments`,
+    })),
+  ];
+
+  return { query, results: trimResults(results, limit) };
+}

package/tests/lib/cors.test.ts

@@ -64,7 +64,19 @@ describe('CORS configuration', () => {
     });
 
     expect(isAllowedOrigin('https://studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(true);
-    expect(isAllowedOrigin('https://malicious-studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(false);
+    // Same shape on a non-.vercel.app host must not match the env-only pattern.
+    expect(isAllowedOrigin('https://studious-git-fake-studious-lms.evil.example')).toBe(false);
+  });
+
+  test('allows any https://*.vercel.app origin', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+    });
+
+    expect(isAllowedOrigin('https://preview-abc123.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('https://my-app-git-main-username.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('http://preview.vercel.app')).toBe(false);
   });
 
   test('rejects missing and unconfigured origins instead of using a fallback', () => {