@studious-lms/server 1.4.4 → 1.4.6

package/prisma/migrations/20260502230500_assignment_submission_comments/migration.sql

@@ -0,0 +1,60 @@
+ALTER TABLE "public"."Comment" ADD COLUMN "assignmentId" TEXT;
+ALTER TABLE "public"."Comment" ADD COLUMN "submissionId" TEXT;
+
+CREATE INDEX "Comment_assignmentId_idx" ON "public"."Comment"("assignmentId");
+CREATE INDEX "Comment_submissionId_idx" ON "public"."Comment"("submissionId");
+
+ALTER TABLE "public"."Comment" ADD CONSTRAINT "Comment_assignmentId_fkey" FOREIGN KEY ("assignmentId") REFERENCES "public"."Assignment"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "public"."Comment" ADD CONSTRAINT "Comment_submissionId_fkey" FOREIGN KEY ("submissionId") REFERENCES "public"."Submission"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+WITH RECURSIVE "CommentOwnerContext" AS (
+  SELECT
+    "id",
+    "parentCommentId",
+    "announcementId",
+    "assignmentId",
+    "submissionId",
+    "studentQuestionProgressId"
+  FROM "public"."Comment"
+  WHERE "parentCommentId" IS NULL
+
+  UNION ALL
+
+  SELECT
+    child."id",
+    child."parentCommentId",
+    COALESCE(child."announcementId", parent."announcementId"),
+    COALESCE(child."assignmentId", parent."assignmentId"),
+    COALESCE(child."submissionId", parent."submissionId"),
+    COALESCE(child."studentQuestionProgressId", parent."studentQuestionProgressId")
+  FROM "public"."Comment" child
+  INNER JOIN "CommentOwnerContext" parent ON child."parentCommentId" = parent."id"
+)
+UPDATE "public"."Comment" c
+SET
+  "announcementId" = owner."announcementId",
+  "assignmentId" = owner."assignmentId",
+  "submissionId" = owner."submissionId",
+  "studentQuestionProgressId" = owner."studentQuestionProgressId"
+FROM "CommentOwnerContext" owner
+WHERE c."id" = owner."id"
+  AND c."parentCommentId" IS NOT NULL
+  AND (
+    (CASE WHEN c."assignmentId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN c."submissionId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN c."announcementId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN c."studentQuestionProgressId" IS NOT NULL THEN 1 ELSE 0 END)
+  ) = 0
+  AND (
+    (CASE WHEN owner."assignmentId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN owner."submissionId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN owner."announcementId" IS NOT NULL THEN 1 ELSE 0 END) +
+    (CASE WHEN owner."studentQuestionProgressId" IS NOT NULL THEN 1 ELSE 0 END)
+  ) = 1;
+
+ALTER TABLE "public"."Comment" ADD CONSTRAINT "Comment_single_owner_check" CHECK (
+  (CASE WHEN "assignmentId" IS NOT NULL THEN 1 ELSE 0 END) +
+  (CASE WHEN "submissionId" IS NOT NULL THEN 1 ELSE 0 END) +
+  (CASE WHEN "announcementId" IS NOT NULL THEN 1 ELSE 0 END) +
+  (CASE WHEN "studentQuestionProgressId" IS NOT NULL THEN 1 ELSE 0 END) = 1
+);

package/prisma/schema.prisma

@@ -282,6 +282,7 @@ model Assignment {
   aiPolicyLevel Int @default(0)
 
   submissions   Submission[]
+  comments      Comment[] @relation("AssignmentComments")
   assignedTo    User[] @relation("SpecificAssignmentAssignedTo")
   section       Section?       @relation(fields: [sectionId], references: [id], onDelete: Cascade)
   sectionId     String?
@@ -325,6 +326,10 @@ model Comment {
   authorId      String
   announcement  Announcement? @relation(fields: [announcementId], references: [id], onDelete: Cascade)
   announcementId String?
+  assignment    Assignment? @relation("AssignmentComments", fields: [assignmentId], references: [id], onDelete: Cascade)
+  assignmentId  String?
+  submission    Submission? @relation("SubmissionComments", fields: [submissionId], references: [id], onDelete: Cascade)
+  submissionId  String?
   parentComment Comment? @relation("CommentReplies", fields: [parentCommentId], references: [id], onDelete: Cascade)
   parentCommentId String?
   status GenerationStatus?
@@ -334,6 +339,9 @@ model Comment {
   modifiedAt    DateTime? @updatedAt
   studentQuestionProgress StudentQuestionProgress? @relation("StudentQuestionProgressComments", fields: [studentQuestionProgressId], references: [id], onDelete: Cascade)
   studentQuestionProgressId String?
+
+  @@index([assignmentId])
+  @@index([submissionId])
 }
 
 model Reaction {
@@ -366,6 +374,7 @@ model Submission {
 
   attachments File[]  @relation("SubmissionFile")
   annotations File[]  @relation("SubmissionAnnotations")
+  comments Comment[] @relation("SubmissionComments")
   worksheetResponses StudentWorksheetResponse[]
   extendedResponse String?
   gradeReceived Int?
@@ -512,6 +521,7 @@ model ConversationMember {
   conversationId String
   role ConversationRole @default(MEMBER)
   joinedAt DateTime @default(now())
+  hiddenAt DateTime? // When user last hid this conversation from their list
   lastViewedAt DateTime? // When user last viewed this conversation
   lastViewedMentionAt DateTime? // When user last viewed mentions in this conversation
   

package/src/index.ts

@@ -520,22 +520,6 @@ async function handleFileUpload(req: Request, res: Response) {
     }
     
     res.header('Access-Control-Allow-Credentials', 'true');
-
-    const user = await getAuthenticatedRequestUser(req);
-    if (!user) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-
-    const uploadSessionId = getUploadSessionId(req);
-    if (!uploadSessionId) {
-      return res.status(401).json({ error: 'Upload session is required' });
-    }
-
-    await validateDirectUploadIntent({
-      filePath,
-      uploadSessionId,
-      userId: user.id,
-    });
     
     const contentType = req.headers['content-type'] || 'application/octet-stream';
     const file = bucket.file(filePath);
@@ -547,7 +531,7 @@ async function handleFileUpload(req: Request, res: Response) {
     });
     
     writeStream.on('error', (error) => {
-      logger.error('Error uploading file:', {error, filePath, userId: user.id});
+      logger.error('Error uploading file:', {error, filePath});
       if (!res.headersSent) {
         res.status(500).json({ error: 'Error uploading file' });
       }

package/src/lib/config/cors.ts

@@ -18,6 +18,10 @@ const nonProductionOrigins = [
   'http://127.0.0.1:3000',
   'http://127.0.0.1:3001',
 ];
+
+/** Any preview / prod deployment on *.vercel.app (HTTPS only). */
+const vercelAppOriginPattern = /^https:\/\/[a-z0-9][a-z0-9.-]*\.vercel\.app$/i;
+
 const MAX_PATTERN_LENGTH = 200;
 // This heuristic only targets common nested-quantifier cases like `(a+)+`.
 // It does not catch every risky construct (for example `.*.*` or deep alternation nesting),
@@ -77,7 +81,10 @@ export const createCorsOriginMatcher = (env: CorsEnv) => {
     ...parseCorsOrigins(env.CORS_ALLOWED_ORIGINS),
   ].filter(isDefined)));
 
-  const allowedOriginPatterns = parseCorsOriginPatterns(env.CORS_ALLOWED_ORIGIN_PATTERNS);
+  const allowedOriginPatterns = [
+    vercelAppOriginPattern,
+    ...parseCorsOriginPatterns(env.CORS_ALLOWED_ORIGIN_PATTERNS),
+  ];
 
   const isAllowedOrigin = (origin?: string) => {
     const corsOrigin = origin ? toCorsOrigin(origin) : undefined;

package/src/models/comment.ts

@@ -1,5 +1,5 @@
 /**
- * Comment model – comments, replies, and reactions (for announcements/worksheets).
+ * Comment model – comments, replies, and reactions.
  */
 import { prisma } from "../lib/prisma.js";
 import type { ReactionType } from "@prisma/client";
@@ -7,6 +7,10 @@ import type { ReactionType } from "@prisma/client";
 export const commentSelect = {
   id: true,
   content: true,
+  announcementId: true,
+  assignmentId: true,
+  submissionId: true,
+  parentCommentId: true,
   createdAt: true,
   modifiedAt: true,
   author: {
@@ -77,6 +81,10 @@ export function createComment(data: {
   parentCommentId: string;
   content: string;
   authorId: string;
+  announcementId?: string | null;
+  assignmentId?: string | null;
+  submissionId?: string | null;
+  studentQuestionProgressId?: string | null;
 }) {
   return prisma.comment.create({
     data,
@@ -142,6 +150,145 @@ export function findCommentWithAnnouncement(commentId: string) {
   });
 }
 
+/** @returns Comment with the owning class context for authorization. */
+export function findCommentWithContext(commentId: string) {
+  return prisma.comment.findUnique({
+    where: { id: commentId },
+    include: {
+      announcement: {
+        select: {
+          class: {
+            select: {
+              id: true,
+              teachers: { select: { id: true } },
+              students: { select: { id: true } },
+            },
+          },
+        },
+      },
+      assignment: {
+        select: {
+          class: {
+            select: {
+              id: true,
+              teachers: { select: { id: true } },
+              students: { select: { id: true } },
+            },
+          },
+        },
+      },
+      submission: {
+        select: {
+          studentId: true,
+          assignment: {
+            select: {
+              class: {
+                select: {
+                  id: true,
+                  teachers: { select: { id: true } },
+                  students: { select: { id: true } },
+                },
+              },
+            },
+          },
+        },
+      },
+      studentQuestionProgress: {
+        select: {
+          studentId: true,
+          studentWorksheetResponse: {
+            select: {
+              submission: {
+                select: {
+                  studentId: true,
+                  assignment: {
+                    select: {
+                      class: {
+                        select: {
+                          id: true,
+                          teachers: { select: { id: true } },
+                          students: { select: { id: true } },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      parentComment: {
+        include: {
+          announcement: {
+            select: {
+              class: {
+                select: {
+                  id: true,
+                  teachers: { select: { id: true } },
+                  students: { select: { id: true } },
+                },
+              },
+            },
+          },
+          assignment: {
+            select: {
+              class: {
+                select: {
+                  id: true,
+                  teachers: { select: { id: true } },
+                  students: { select: { id: true } },
+                },
+              },
+            },
+          },
+          submission: {
+            select: {
+              studentId: true,
+              assignment: {
+                select: {
+                  class: {
+                    select: {
+                      id: true,
+                      teachers: { select: { id: true } },
+                      students: { select: { id: true } },
+                    },
+                  },
+                },
+              },
+            },
+          },
+          studentQuestionProgress: {
+            select: {
+              studentId: true,
+              studentWorksheetResponse: {
+                select: {
+                  submission: {
+                    select: {
+                      studentId: true,
+                      assignment: {
+                        select: {
+                          class: {
+                            select: {
+                              id: true,
+                              teachers: { select: { id: true } },
+                              students: { select: { id: true } },
+                            },
+                          },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+}
+
 /** @returns Reaction counts by type for a comment. */
 export function getReactionCountsByCommentId(commentId: string) {
   return prisma.reaction.groupBy({

package/src/models/conversation.ts

@@ -190,6 +190,18 @@ export function createConversationMember(data: {
   });
 }
 
+/** Hide a conversation for a single member until new activity occurs. */
+export function hideConversationMember(userId: string, conversationId: string) {
+  return prisma.conversationMember.update({
+    where: {
+      userId_conversationId: { userId, conversationId },
+    },
+    data: {
+      hiddenAt: new Date(),
+    },
+  });
+}
+
 /** Remove a member from a conversation. */
 export function deleteConversationMember(userId: string, conversationId: string) {
   return prisma.conversationMember.delete({

package/src/pipelines/aiLabChat.ts

@@ -16,7 +16,8 @@ import { DocumentBlock } from "../lib/jsonStyles.js";
 import { type LabChatResponse, labChatResponseSchema } from "./aiLabChatContract.js";
 import { buildLabChatResponseMessages } from "./labChatPrompt.js";
 
-const LAB_CHAT_RESPONSE_TIMEOUT_MS = 90_000;
+/** Cap model wait time; leave headroom after inference for PDF/GCS/DB within Vercel maxDuration (500s). */
+const LAB_CHAT_RESPONSE_TIMEOUT_MS = 400_000;
 
 const withTimeout = async <T>(
   task: Promise<T>,

package/src/routers/_app.ts

@@ -21,6 +21,7 @@ import { marketingRouter } from "./marketing.js";
 import { worksheetRouter } from "./worksheet.js";
 import { commentRouter } from "./comment.js";
 import { studentProgressRouter } from "./studentProgress.js";
+import { searchRouter } from "./search.js";
 
 export const appRouter = createTRPCRouter({
   class: classRouter,
@@ -43,6 +44,7 @@ export const appRouter = createTRPCRouter({
   worksheet: worksheetRouter,
   comment: commentRouter,
   studentProgress: studentProgressRouter,
+  search: searchRouter,
 });
 
 // Export type router type definition

package/src/routers/assignment.ts

@@ -172,6 +172,66 @@ const updateUploadProgressSchema = z.object({
   progress: z.number().min(0).max(100),
 });
 
+const assignmentCommentSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  content: z.string().min(1, "Comment cannot be empty"),
+  parentCommentId: z.string().optional(),
+});
+
+const assignmentCommentsSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+});
+
+const submissionCommentSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  submissionId: z.string(),
+  content: z.string().min(1, "Comment cannot be empty"),
+  parentCommentId: z.string().optional(),
+});
+
+const submissionCommentsSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  submissionId: z.string(),
+});
+
+const commentInclude = {
+  author: {
+    select: {
+      id: true,
+      username: true,
+      profile: {
+        select: {
+          displayName: true,
+          profilePicture: true,
+          profilePictureThumbnail: true,
+        },
+      },
+    },
+  },
+  replies: {
+    include: {
+      author: {
+        select: {
+          id: true,
+          username: true,
+          profile: {
+            select: {
+              displayName: true,
+              profilePicture: true,
+              profilePictureThumbnail: true,
+            },
+          },
+        },
+      },
+    },
+    orderBy: { createdAt: "asc" as const },
+  },
+} as const;
+
 export const assignmentRouter = createTRPCRouter({
   reorder: protectedTeacherProcedure
     .input(z.object({
@@ -254,6 +314,170 @@ export const assignmentRouter = createTRPCRouter({
     .input(z.object({ assignmentId: z.string(), classId: z.string() }))
     .query(({ ctx, input }) => getSubmissions(input.assignmentId, ctx.user!.id)),
 
+  getComments: protectedClassMemberProcedure
+    .input(assignmentCommentsSchema)
+    .query(async ({ input }) => {
+      const assignment = await prisma.assignment.findFirst({
+        where: { id: input.assignmentId, classId: input.classId },
+        select: { id: true },
+      });
+      if (!assignment) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Assignment not found",
+        });
+      }
+
+      const comments = await prisma.comment.findMany({
+        where: {
+          assignmentId: input.assignmentId,
+          submissionId: null,
+          parentCommentId: null,
+        },
+        include: commentInclude,
+        orderBy: { createdAt: "asc" },
+      });
+
+      return { comments };
+    }),
+
+  addComment: protectedClassMemberProcedure
+    .input(assignmentCommentSchema)
+    .mutation(async ({ ctx, input }) => {
+      const assignment = await prisma.assignment.findFirst({
+        where: { id: input.assignmentId, classId: input.classId },
+        select: { id: true },
+      });
+      if (!assignment) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Assignment not found",
+        });
+      }
+
+      if (input.parentCommentId) {
+        const parentComment = await prisma.comment.findFirst({
+          where: {
+            id: input.parentCommentId,
+            assignmentId: input.assignmentId,
+            submissionId: null,
+          },
+          select: { id: true },
+        });
+        if (!parentComment) {
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Parent comment not found",
+          });
+        }
+      }
+
+      const comment = await prisma.comment.create({
+        data: {
+          content: input.content,
+          authorId: ctx.user!.id,
+          assignmentId: input.assignmentId,
+          ...(input.parentCommentId && { parentCommentId: input.parentCommentId }),
+        },
+        include: commentInclude,
+      });
+
+      return { comment };
+    }),
+
+  getSubmissionComments: protectedClassMemberProcedure
+    .input(submissionCommentsSchema)
+    .query(async ({ ctx, input }) => {
+      const submission = await prisma.submission.findFirst({
+        where: {
+          id: input.submissionId,
+          assignmentId: input.assignmentId,
+          assignment: {
+            classId: input.classId,
+            class: {
+              OR: [
+                { teachers: { some: { id: ctx.user!.id } } },
+                { students: { some: { id: ctx.user!.id } } },
+              ],
+            },
+          },
+          OR: [
+            { studentId: ctx.user!.id },
+            { assignment: { class: { teachers: { some: { id: ctx.user!.id } } } } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!submission) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Submission not found",
+        });
+      }
+
+      const comments = await prisma.comment.findMany({
+        where: {
+          submissionId: input.submissionId,
+          parentCommentId: null,
+        },
+        include: commentInclude,
+        orderBy: { createdAt: "asc" },
+      });
+
+      return { comments };
+    }),
+
+  addSubmissionComment: protectedClassMemberProcedure
+    .input(submissionCommentSchema)
+    .mutation(async ({ ctx, input }) => {
+      const submission = await prisma.submission.findFirst({
+        where: {
+          id: input.submissionId,
+          assignmentId: input.assignmentId,
+          assignment: { classId: input.classId },
+          OR: [
+            { studentId: ctx.user!.id },
+            { assignment: { class: { teachers: { some: { id: ctx.user!.id } } } } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!submission) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Submission not found",
+        });
+      }
+
+      if (input.parentCommentId) {
+        const parentComment = await prisma.comment.findFirst({
+          where: {
+            id: input.parentCommentId,
+            submissionId: input.submissionId,
+          },
+          select: { id: true },
+        });
+        if (!parentComment) {
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Parent comment not found",
+          });
+        }
+      }
+
+      const comment = await prisma.comment.create({
+        data: {
+          content: input.content,
+          authorId: ctx.user!.id,
+          submissionId: input.submissionId,
+          ...(input.parentCommentId && { parentCommentId: input.parentCommentId }),
+        },
+        include: commentInclude,
+      });
+
+      return { comment };
+    }),
+
   updateSubmissionAsTeacher: protectedTeacherProcedure
     .input(updateSubmissionSchema)
     .mutation(({ ctx, input }) =>
@@ -660,4 +884,3 @@ export const assignmentRouter = createTRPCRouter({
       };
     }),
 });
-

package/src/routers/comment.ts

@@ -5,6 +5,8 @@ import {
   getComment,
   getReplies,
   replyToComment,
+  updateComment,
+  deleteComment,
   addReaction,
   removeReaction,
   getReactions,
@@ -15,11 +17,11 @@ export { commentSelect } from "../models/comment.js";
 export const commentRouter = createTRPCRouter({
   get: protectedProcedure
     .input(z.object({ id: z.string() }))
-    .query(({ input }) => getComment(input.id)),
+    .query(({ ctx, input }) => getComment(ctx.user!.id, input.id)),
 
   getReplies: protectedProcedure
     .input(z.object({ commentId: z.string() }))
-    .query(({ input }) => getReplies(input.commentId)),
+    .query(({ ctx, input }) => getReplies(ctx.user!.id, input.commentId)),
 
   replyToComment: protectedProcedure
     .input(
@@ -32,6 +34,21 @@ export const commentRouter = createTRPCRouter({
       replyToComment(ctx.user!.id, input.parentCommentId, input.content)
     ),
 
+  update: protectedProcedure
+    .input(
+      z.object({
+        id: z.string(),
+        content: z.string().min(1, "Comment cannot be empty"),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      updateComment(ctx.user!.id, input.id, input.content)
+    ),
+
+  delete: protectedProcedure
+    .input(z.object({ id: z.string() }))
+    .mutation(({ ctx, input }) => deleteComment(ctx.user!.id, input.id)),
+
   addReaction: protectedProcedure
     .input(
       z.object({

package/src/routers/conversation.ts

@@ -5,6 +5,7 @@ import {
   createConversationRecord,
   getConversation,
   addMemberToConversation,
+  hideConversation,
   removeMemberFromConversation,
 } from "../services/conversation.js";
 
@@ -36,6 +37,12 @@ export const conversationRouter = createTRPCRouter({
       getConversation(ctx.user!.id, input.conversationId)
     ),
 
+  hide: protectedProcedure
+    .input(z.object({ conversationId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      hideConversation(ctx.user!.id, input.conversationId)
+    ),
+
   addMember: protectedProcedure
     .input(
       z.object({