@studious-lms/server 1.4.5 → 1.4.7

package/src/routers/assignment.ts

@@ -6,6 +6,10 @@ import { createDirectUploadFiles, type DirectUploadFile, confirmDirectUpload, up
 import { deleteFile } from "../lib/googleCloudStorage.js";
 import { logger } from "../utils/logger.js";
 import { gradeWorksheetPipeline } from "../pipelines/gradeWorksheet.js";
+import {
+  classMemberOrSchoolAdminWhere,
+  classTeacherOrSchoolAdminWhere,
+} from "../models/access.js";
 import {
   assignmentExists,
   getDueToday,
@@ -172,6 +176,66 @@ const updateUploadProgressSchema = z.object({
   progress: z.number().min(0).max(100),
 });
 
+const assignmentCommentSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  content: z.string().min(1, "Comment cannot be empty"),
+  parentCommentId: z.string().optional(),
+});
+
+const assignmentCommentsSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+});
+
+const submissionCommentSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  submissionId: z.string(),
+  content: z.string().min(1, "Comment cannot be empty"),
+  parentCommentId: z.string().optional(),
+});
+
+const submissionCommentsSchema = z.object({
+  assignmentId: z.string(),
+  classId: z.string(),
+  submissionId: z.string(),
+});
+
+const commentInclude = {
+  author: {
+    select: {
+      id: true,
+      username: true,
+      profile: {
+        select: {
+          displayName: true,
+          profilePicture: true,
+          profilePictureThumbnail: true,
+        },
+      },
+    },
+  },
+  replies: {
+    include: {
+      author: {
+        select: {
+          id: true,
+          username: true,
+          profile: {
+            select: {
+              displayName: true,
+              profilePicture: true,
+              profilePictureThumbnail: true,
+            },
+          },
+        },
+      },
+    },
+    orderBy: { createdAt: "asc" as const },
+  },
+} as const;
+
 export const assignmentRouter = createTRPCRouter({
   reorder: protectedTeacherProcedure
     .input(z.object({
@@ -254,6 +318,165 @@ export const assignmentRouter = createTRPCRouter({
     .input(z.object({ assignmentId: z.string(), classId: z.string() }))
     .query(({ ctx, input }) => getSubmissions(input.assignmentId, ctx.user!.id)),
 
+  getComments: protectedClassMemberProcedure
+    .input(assignmentCommentsSchema)
+    .query(async ({ input }) => {
+      const assignment = await prisma.assignment.findFirst({
+        where: { id: input.assignmentId, classId: input.classId },
+        select: { id: true },
+      });
+      if (!assignment) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Assignment not found",
+        });
+      }
+
+      const comments = await prisma.comment.findMany({
+        where: {
+          assignmentId: input.assignmentId,
+          submissionId: null,
+          parentCommentId: null,
+        },
+        include: commentInclude,
+        orderBy: { createdAt: "asc" },
+      });
+
+      return { comments };
+    }),
+
+  addComment: protectedClassMemberProcedure
+    .input(assignmentCommentSchema)
+    .mutation(async ({ ctx, input }) => {
+      const assignment = await prisma.assignment.findFirst({
+        where: { id: input.assignmentId, classId: input.classId },
+        select: { id: true },
+      });
+      if (!assignment) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Assignment not found",
+        });
+      }
+
+      if (input.parentCommentId) {
+        const parentComment = await prisma.comment.findFirst({
+          where: {
+            id: input.parentCommentId,
+            assignmentId: input.assignmentId,
+            submissionId: null,
+          },
+          select: { id: true },
+        });
+        if (!parentComment) {
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Parent comment not found",
+          });
+        }
+      }
+
+      const comment = await prisma.comment.create({
+        data: {
+          content: input.content,
+          authorId: ctx.user!.id,
+          assignmentId: input.assignmentId,
+          ...(input.parentCommentId && { parentCommentId: input.parentCommentId }),
+        },
+        include: commentInclude,
+      });
+
+      return { comment };
+    }),
+
+  getSubmissionComments: protectedClassMemberProcedure
+    .input(submissionCommentsSchema)
+    .query(async ({ ctx, input }) => {
+      const submission = await prisma.submission.findFirst({
+        where: {
+          id: input.submissionId,
+          assignmentId: input.assignmentId,
+          assignment: {
+            classId: input.classId,
+            class: classMemberOrSchoolAdminWhere(ctx.user!.id),
+          },
+          OR: [
+            { studentId: ctx.user!.id },
+            { assignment: { class: classTeacherOrSchoolAdminWhere(ctx.user!.id) } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!submission) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Submission not found",
+        });
+      }
+
+      const comments = await prisma.comment.findMany({
+        where: {
+          submissionId: input.submissionId,
+          parentCommentId: null,
+        },
+        include: commentInclude,
+        orderBy: { createdAt: "asc" },
+      });
+
+      return { comments };
+    }),
+
+  addSubmissionComment: protectedClassMemberProcedure
+    .input(submissionCommentSchema)
+    .mutation(async ({ ctx, input }) => {
+      const submission = await prisma.submission.findFirst({
+        where: {
+          id: input.submissionId,
+          assignmentId: input.assignmentId,
+          assignment: { classId: input.classId },
+          OR: [
+            { studentId: ctx.user!.id },
+            { assignment: { class: classTeacherOrSchoolAdminWhere(ctx.user!.id) } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!submission) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Submission not found",
+        });
+      }
+
+      if (input.parentCommentId) {
+        const parentComment = await prisma.comment.findFirst({
+          where: {
+            id: input.parentCommentId,
+            submissionId: input.submissionId,
+          },
+          select: { id: true },
+        });
+        if (!parentComment) {
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Parent comment not found",
+          });
+        }
+      }
+
+      const comment = await prisma.comment.create({
+        data: {
+          content: input.content,
+          authorId: ctx.user!.id,
+          submissionId: input.submissionId,
+          ...(input.parentCommentId && { parentCommentId: input.parentCommentId }),
+        },
+        include: commentInclude,
+      });
+
+      return { comment };
+    }),
+
   updateSubmissionAsTeacher: protectedTeacherProcedure
     .input(updateSubmissionSchema)
     .mutation(({ ctx, input }) =>
@@ -406,6 +629,21 @@ export const assignmentRouter = createTRPCRouter({
                 include: {
                   students: true,
                   teachers: true,
+                  school: {
+                    include: {
+                      users: {
+                        where: { role: "ADMIN" },
+                        select: { id: true },
+                      },
+                      memberships: {
+                        where: {
+                          role: "ADMIN",
+                          status: "ACTIVE",
+                        },
+                        select: { userId: true },
+                      },
+                    },
+                  },
                 },
               },
             },
@@ -423,8 +661,12 @@ export const assignmentRouter = createTRPCRouter({
       // Check if user is the student who owns the submission or a teacher of the class
       const isStudent = submission.studentId === ctx.user.id;
       const isTeacher = submission.assignment.class.teachers.some(teacher => teacher.id === ctx.user?.id);
+      const isSchoolAdmin = Boolean(
+        submission.assignment.class.school?.memberships.some(admin => admin.userId === ctx.user?.id) ||
+          submission.assignment.class.school?.users.some(admin => admin.id === ctx.user?.id)
+      );
 
-      if (!isStudent && !isTeacher) {
+      if (!isStudent && !isTeacher && !isSchoolAdmin) {
         throw new TRPCError({
           code: "FORBIDDEN",
           message: "You don't have permission to upload files to this submission",
@@ -660,4 +902,3 @@ export const assignmentRouter = createTRPCRouter({
       };
     }),
 });
-

package/src/routers/class.ts

@@ -74,6 +74,7 @@ export const classRouter = createTRPCRouter({
         section: z.string(),
         subject: z.string(),
         color: z.string().optional(),
+        schoolId: z.string().optional(),
       })
     )
     .mutation(({ ctx, input }) =>

package/src/routers/comment.ts

@@ -5,6 +5,8 @@ import {
   getComment,
   getReplies,
   replyToComment,
+  updateComment,
+  deleteComment,
   addReaction,
   removeReaction,
   getReactions,
@@ -15,11 +17,11 @@ export { commentSelect } from "../models/comment.js";
 export const commentRouter = createTRPCRouter({
   get: protectedProcedure
     .input(z.object({ id: z.string() }))
-    .query(({ input }) => getComment(input.id)),
+    .query(({ ctx, input }) => getComment(ctx.user!.id, input.id)),
 
   getReplies: protectedProcedure
     .input(z.object({ commentId: z.string() }))
-    .query(({ input }) => getReplies(input.commentId)),
+    .query(({ ctx, input }) => getReplies(ctx.user!.id, input.commentId)),
 
   replyToComment: protectedProcedure
     .input(
@@ -32,6 +34,21 @@ export const commentRouter = createTRPCRouter({
       replyToComment(ctx.user!.id, input.parentCommentId, input.content)
     ),
 
+  update: protectedProcedure
+    .input(
+      z.object({
+        id: z.string(),
+        content: z.string().min(1, "Comment cannot be empty"),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      updateComment(ctx.user!.id, input.id, input.content)
+    ),
+
+  delete: protectedProcedure
+    .input(z.object({ id: z.string() }))
+    .mutation(({ ctx, input }) => deleteComment(ctx.user!.id, input.id)),
+
   addReaction: protectedProcedure
     .input(
       z.object({

package/src/routers/school.ts

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import {
+  createTRPCRouter,
+  protectedProcedure,
+  publicProcedure,
+} from "../trpc.js";
+import {
+  acceptInvite,
+  addMember,
+  createInvite,
+  createSchoolClass,
+  createSchoolRecord,
+  getAdminOverview,
+  getCurrentSchool,
+  getInvite,
+  listClasses,
+  listInvites,
+  listMembers,
+  removeMember,
+  revokeInvite,
+  updateMemberRole,
+} from "../services/school.js";
+
+const schoolRoleSchema = z.enum(["ADMIN", "TEACHER", "STUDENT"]);
+
+const schoolIdSchema = z.object({
+  schoolId: z.string(),
+});
+
+export const schoolRouter = createTRPCRouter({
+  getCurrent: protectedProcedure
+    .input(z.object({ schoolId: z.string().optional() }).optional())
+    .query(({ ctx, input }) =>
+      getCurrentSchool(ctx.user!.id, input?.schoolId)
+    ),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        name: z.string().min(1),
+        subdomain: z.string().min(1).optional(),
+        logoId: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolRecord(ctx.user!.id, input)),
+
+  getAdminOverview: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => getAdminOverview(ctx.user!.id, input.schoolId)),
+
+  listClasses: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listClasses(ctx.user!.id, input.schoolId)),
+
+  createClass: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        name: z.string(),
+        section: z.string(),
+        subject: z.string(),
+        color: z.string().optional(),
+        teachers: z.array(z.string()).optional(),
+        students: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolClass(ctx.user!.id, input)),
+
+  listMembers: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listMembers(ctx.user!.id, input.schoolId)),
+
+  addMember: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => addMember(ctx.user!.id, input)),
+
+  updateMemberRole: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => updateMemberRole(ctx.user!.id, input)),
+
+  removeMember: protectedProcedure
+    .input(z.object({ schoolId: z.string(), memberUserId: z.string() }))
+    .mutation(({ ctx, input }) => removeMember(ctx.user!.id, input)),
+
+  listInvites: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listInvites(ctx.user!.id, input.schoolId)),
+
+  createInvite: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        email: z.string().email(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => createInvite(ctx.user!.id, input)),
+
+  revokeInvite: protectedProcedure
+    .input(z.object({ schoolId: z.string(), inviteId: z.string() }))
+    .mutation(({ ctx, input }) => revokeInvite(ctx.user!.id, input)),
+
+  getInvite: publicProcedure
+    .input(z.object({ token: z.string() }))
+    .query(({ input }) => getInvite(input.token)),
+
+  acceptInvite: protectedProcedure
+    .input(z.object({ token: z.string() }))
+    .mutation(({ ctx, input }) => acceptInvite(ctx.user!.id, input.token)),
+});

package/src/services/announcement.ts

@@ -157,11 +157,15 @@ export async function updateAnnouncementRecord(
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can update announcements",
+      message: "Only the announcement creator, class teachers, or school admins can update announcements",
     });
   }
 
@@ -277,11 +281,15 @@ export async function deleteAnnouncementRecord(userId: string, id: string, class
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can delete announcements",
+      message: "Only the announcement creator, class teachers, or school admins can delete announcements",
     });
   }
 

package/src/services/class.ts

@@ -25,6 +25,7 @@ import {
   findFullExportableClass,
   createClassByImport,
 } from "../models/class.js";
+import { listUserSchoolMemberships } from "../models/school.js";
 import { Class, Folder } from "@prisma/client";
 
 /** Get all classes where user is teacher or student, with assignments and members. */
@@ -121,9 +122,29 @@ export async function createClass(
     section: string;
     subject: string;
     color?: string;
+    schoolId?: string;
   }
 ) {
-  const { students, teachers, name, section, subject, color } = input;
+  const { students, teachers, name, section, subject, color, schoolId } = input;
+
+  if (schoolId) {
+    const memberships = await listUserSchoolMemberships(userId);
+    const membership = memberships.find((item) => item.schoolId === schoolId);
+
+    if (!membership) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "You are not a member of this school",
+      });
+    }
+
+    if (membership.role === "STUDENT") {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "Students cannot create school classes",
+      });
+    }
+  }
 
   if (teachers && teachers.length > 0 && students && students.length > 0) {
     return prisma.class.create({
@@ -132,6 +153,7 @@ export async function createClass(
         section,
         subject,
         color,
+        schoolId,
         teachers: { connect: teachers.map((id) => ({ id })) },
         students: { connect: students.map((id) => ({ id })) },
       },
@@ -145,6 +167,7 @@ export async function createClass(
       section,
       subject,
       color,
+      schoolId,
       teachers: { connect: { id: userId } },
     },
   });
@@ -629,4 +652,4 @@ export async function importClass(classId: string, userId: string, year: number,
       cause: err,
     });
   }
-}
+}