@studious-lms/server 1.4.5 → 1.4.6

package/src/services/comment.ts

@@ -1,7 +1,8 @@
 /**
- * Comment service – get comments, replies, and reactions. Used for announcements and worksheets.
+ * Comment service – get comments, replies, and reactions.
  */
 import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
 import {
   findCommentById,
   findRepliesByCommentId,
@@ -9,12 +10,81 @@ import {
   findReactionByUserAndComment,
   upsertReaction,
   deleteReactionById,
-  findCommentWithAnnouncement,
+  findCommentWithContext,
   getReactionCountsByCommentId,
 } from "../models/comment.js";
 
+function getCommentClass(comment: any) {
+  return (
+    comment.announcement?.class ??
+    comment.assignment?.class ??
+    comment.submission?.assignment?.class ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    comment.parentComment?.announcement?.class ??
+    comment.parentComment?.assignment?.class ??
+    comment.parentComment?.submission?.assignment?.class ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    null
+  );
+}
+
+function getPrivateStudentId(comment: any) {
+  return (
+    comment.submission?.studentId ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.studentQuestionProgress?.studentId ??
+    comment.parentComment?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentId ??
+    null
+  );
+}
+
+function isClassTeacher(comment: any, userId: string) {
+  return getCommentClass(comment)?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ?? false;
+}
+
+function isClassMember(comment: any, userId: string) {
+  const classData = getCommentClass(comment);
+  return (
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+    classData?.students?.some((student: { id: string }) => student.id === userId) ||
+    false
+  );
+}
+
+function canReadComment(comment: any, userId: string) {
+  const privateStudentId = getPrivateStudentId(comment);
+  if (privateStudentId) {
+    return privateStudentId === userId || isClassTeacher(comment, userId);
+  }
+  return isClassMember(comment, userId);
+}
+
+function canDeleteComment(comment: any, userId: string) {
+  return comment.authorId === userId || isClassTeacher(comment, userId);
+}
+
+async function requireCommentAccess(commentId: string, userId: string) {
+  const comment = await findCommentWithContext(commentId);
+  if (!comment) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Comment not found",
+    });
+  }
+  if (!canReadComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You do not have access to this comment",
+    });
+  }
+  return comment;
+}
+
 /** Get a comment by ID. */
-export async function getComment(id: string) {
+export async function getComment(userId: string, id: string) {
+  await requireCommentAccess(id, userId);
   const comment = await findCommentById(id);
   if (!comment) {
     throw new TRPCError({
@@ -26,7 +96,8 @@ export async function getComment(id: string) {
 }
 
 /** Get all replies to a comment. */
-export async function getReplies(commentId: string) {
+export async function getReplies(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   return findRepliesByCommentId(commentId);
 }
 
@@ -36,26 +107,55 @@ export async function replyToComment(
   parentCommentId: string,
   content: string
 ) {
+  const parentComment = await requireCommentAccess(parentCommentId, userId);
   return createComment({
     parentCommentId,
     content,
     authorId: userId,
+    announcementId: parentComment.announcementId,
+    assignmentId: parentComment.assignmentId,
+    submissionId: parentComment.submissionId,
+    studentQuestionProgressId: parentComment.studentQuestionProgressId,
   });
 }
 
+/** Update a comment authored by the user. */
+export async function updateComment(userId: string, id: string, content: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (comment.authorId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author can update this comment",
+    });
+  }
+
+  return prisma.comment.update({
+    where: { id },
+    data: { content },
+  });
+}
+
+/** Delete a comment authored by the user or moderated by a class teacher. */
+export async function deleteComment(userId: string, id: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (!canDeleteComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author or class teachers can delete comments",
+    });
+  }
+
+  await prisma.comment.delete({ where: { id } });
+  return { success: true };
+}
+
 /** Add or update a reaction (emoji) on a comment. */
 export async function addReaction(
   userId: string,
   commentId: string,
   type: string
 ) {
-  const comment = await findCommentById(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: "Unexpected error",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reaction = await upsertReaction({ userId, commentId, type });
   return { reaction };
@@ -63,6 +163,7 @@ export async function addReaction(
 
 /** Remove user's reaction from a comment. */
 export async function removeReaction(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   const reaction = await findReactionByUserAndComment(userId, commentId);
   if (!reaction) {
     throw new TRPCError({
@@ -75,13 +176,7 @@ export async function removeReaction(userId: string, commentId: string) {
 }
 
 export async function getReactions(userId: string, commentId: string) {
-  const comment = await findCommentWithAnnouncement(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Comment not found",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reactionCounts = await getReactionCountsByCommentId(commentId);
   const userReaction = await findReactionByUserAndComment(userId, commentId);

package/tests/lib/cors.test.ts

@@ -64,7 +64,19 @@ describe('CORS configuration', () => {
     });
 
     expect(isAllowedOrigin('https://studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(true);
-    expect(isAllowedOrigin('https://malicious-studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(false);
+    // Same shape on a non-.vercel.app host must not match the env-only pattern.
+    expect(isAllowedOrigin('https://studious-git-fake-studious-lms.evil.example')).toBe(false);
+  });
+
+  test('allows any https://*.vercel.app origin', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+    });
+
+    expect(isAllowedOrigin('https://preview-abc123.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('https://my-app-git-main-username.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('http://preview.vercel.app')).toBe(false);
   });
 
   test('rejects missing and unconfigured origins instead of using a fallback', () => {

package/tests/routers/assignment.test.ts

@@ -1,5 +1,5 @@
 import { test, expect, describe, beforeEach } from 'vitest';
-import { user1Caller, user2Caller } from '../setup';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
 import { expectForbidden, expectUnauth } from '../helpers';
 
 describe('Assignment Router', () => {
@@ -145,6 +145,73 @@ describe('Assignment Router', () => {
     });
   });
 
+  describe('comments', () => {
+    test('allows class members to add and read assignment-level comments', async () => {
+      const { comment } = await user2Caller.assignment.addComment({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+        content: 'I have a question about this assignment.',
+      });
+
+      expect(comment.assignmentId).toBe(testAssignment.id);
+      expect(comment.submissionId).toBeNull();
+
+      const { comments } = await user1Caller.assignment.getComments({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+      });
+
+      expect(comments.some((item) => item.id === comment.id)).toBe(true);
+    });
+
+    test('allows only the submission student and teachers to read private submission comments', async () => {
+      const submission = await user2Caller.assignment.getSubmission({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+      });
+
+      const { comment } = await user1Caller.assignment.addSubmissionComment({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+        submissionId: submission.id,
+        content: 'Private note for this submission.',
+      });
+
+      expect(comment.submissionId).toBe(submission.id);
+
+      const studentView = await user2Caller.assignment.getSubmissionComments({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+        submissionId: submission.id,
+      });
+      expect(studentView.comments.some((item) => item.id === comment.id)).toBe(true);
+
+      const teacherView = await user1Caller.assignment.getSubmissionComments({
+        classId: testClass.id,
+        assignmentId: testAssignment.id,
+        submissionId: submission.id,
+      });
+      expect(teacherView.comments.some((item) => item.id === comment.id)).toBe(true);
+
+      const classmateProfile = await user3Caller.user.getProfile();
+      await user1Caller.class.addStudent({
+        classId: testClass.id,
+        studentId: classmateProfile.id,
+      });
+
+      await expect(
+        user3Caller.assignment.getSubmissionComments({
+          classId: testClass.id,
+          assignmentId: testAssignment.id,
+          submissionId: submission.id,
+        }),
+      ).rejects.toMatchObject({
+        code: 'NOT_FOUND',
+        message: 'Submission not found',
+      });
+    });
+  });
+
   // describe('getAll', () => {
   //   test('should get all assignments for class', async () => {
   //     const result = await user1Caller.assignment.get({
@@ -834,4 +901,3 @@ describe('Assignment Router', () => {
     });
   });
 });
-

package/tests/routers/comment.test.ts

@@ -1,5 +1,5 @@
 import { test, expect, describe, beforeAll } from 'vitest';
-import { user1Caller, user2Caller } from '../setup';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
 
 describe('Comment Router', () => {
   let testClass: any;
@@ -42,6 +42,47 @@ describe('Comment Router', () => {
         user1Caller.comment.get({ id: 'nonexistent-id' }),
       ).rejects.toThrow();
     });
+
+    test('should fail for users outside the comment class', async () => {
+      await expect(
+        user2Caller.comment.get({ id: commentId }),
+      ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+
+    test('should fail for the author after class removal', async () => {
+      const removalClass = await user1Caller.class.create({
+        name: 'Removed Comment Author Class',
+        subject: 'History',
+        section: '11th Grade',
+      });
+      const user3Profile = await user3Caller.user.getProfile();
+      await user1Caller.class.addStudent({
+        classId: removalClass.id,
+        studentId: user3Profile.id,
+      });
+
+      const { announcement: removalAnnouncement } = await user1Caller.announcement.create({
+        classId: removalClass.id,
+        remarks: 'Announcement with removable author comment',
+      });
+      const { comment } = await user3Caller.announcement.addComment({
+        announcementId: removalAnnouncement.id,
+        classId: removalClass.id,
+        content: 'I should lose access when removed.',
+      });
+
+      await user1Caller.class.removeMember({
+        classId: removalClass.id,
+        userId: user3Profile.id,
+      });
+
+      await expect(
+        user3Caller.comment.get({ id: comment.id }),
+      ).rejects.toThrow();
+      await expect(
+        user3Caller.comment.update({ id: comment.id, content: 'Updated after removal' }),
+      ).rejects.toThrow();
+    });
   });
 
   describe('replyToComment', () => {

package/vercel.json

@@ -0,0 +1,8 @@
+{
+    "fluid": true,
+    "functions": {
+      "src/index.ts": {
+        "maxDuration": 500
+      }
+    }
+  }