@studious-lms/server 1.4.5 → 1.4.7

package/src/services/comment.ts

@@ -1,7 +1,8 @@
 /**
- * Comment service – get comments, replies, and reactions. Used for announcements and worksheets.
+ * Comment service – get comments, replies, and reactions.
  */
 import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
 import {
   findCommentById,
   findRepliesByCommentId,
@@ -9,12 +10,90 @@ import {
   findReactionByUserAndComment,
   upsertReaction,
   deleteReactionById,
-  findCommentWithAnnouncement,
+  findCommentWithContext,
   getReactionCountsByCommentId,
 } from "../models/comment.js";
 
+function getCommentClass(comment: any) {
+  return (
+    comment.announcement?.class ??
+    comment.assignment?.class ??
+    comment.submission?.assignment?.class ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    comment.parentComment?.announcement?.class ??
+    comment.parentComment?.assignment?.class ??
+    comment.parentComment?.submission?.assignment?.class ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.assignment?.class ??
+    null
+  );
+}
+
+function getPrivateStudentId(comment: any) {
+  return (
+    comment.submission?.studentId ??
+    comment.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.studentQuestionProgress?.studentId ??
+    comment.parentComment?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentWorksheetResponse?.submission?.studentId ??
+    comment.parentComment?.studentQuestionProgress?.studentId ??
+    null
+  );
+}
+
+function isClassTeacher(comment: any, userId: string) {
+  const classData = getCommentClass(comment);
+  return Boolean(
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+      classData?.school?.memberships?.some(
+        (admin: { userId: string }) => admin.userId === userId
+      ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
+}
+
+function isClassMember(comment: any, userId: string) {
+  const classData = getCommentClass(comment);
+  return (
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+    classData?.students?.some((student: { id: string }) => student.id === userId) ||
+    classData?.school?.memberships?.some((admin: { userId: string }) => admin.userId === userId) ||
+    classData?.school?.users?.some((admin: { id: string }) => admin.id === userId) ||
+    false
+  );
+}
+
+function canReadComment(comment: any, userId: string) {
+  const privateStudentId = getPrivateStudentId(comment);
+  if (privateStudentId) {
+    return privateStudentId === userId || isClassTeacher(comment, userId);
+  }
+  return isClassMember(comment, userId);
+}
+
+function canDeleteComment(comment: any, userId: string) {
+  return comment.authorId === userId || isClassTeacher(comment, userId);
+}
+
+async function requireCommentAccess(commentId: string, userId: string) {
+  const comment = await findCommentWithContext(commentId);
+  if (!comment) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Comment not found",
+    });
+  }
+  if (!canReadComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You do not have access to this comment",
+    });
+  }
+  return comment;
+}
+
 /** Get a comment by ID. */
-export async function getComment(id: string) {
+export async function getComment(userId: string, id: string) {
+  await requireCommentAccess(id, userId);
   const comment = await findCommentById(id);
   if (!comment) {
     throw new TRPCError({
@@ -26,7 +105,8 @@ export async function getComment(id: string) {
 }
 
 /** Get all replies to a comment. */
-export async function getReplies(commentId: string) {
+export async function getReplies(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   return findRepliesByCommentId(commentId);
 }
 
@@ -36,26 +116,55 @@ export async function replyToComment(
   parentCommentId: string,
   content: string
 ) {
+  const parentComment = await requireCommentAccess(parentCommentId, userId);
   return createComment({
     parentCommentId,
     content,
     authorId: userId,
+    announcementId: parentComment.announcementId,
+    assignmentId: parentComment.assignmentId,
+    submissionId: parentComment.submissionId,
+    studentQuestionProgressId: parentComment.studentQuestionProgressId,
   });
 }
 
+/** Update a comment authored by the user. */
+export async function updateComment(userId: string, id: string, content: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (comment.authorId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author can update this comment",
+    });
+  }
+
+  return prisma.comment.update({
+    where: { id },
+    data: { content },
+  });
+}
+
+/** Delete a comment authored by the user or moderated by a class teacher. */
+export async function deleteComment(userId: string, id: string) {
+  const comment = await requireCommentAccess(id, userId);
+  if (!canDeleteComment(comment, userId)) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only the comment author or class teachers can delete comments",
+    });
+  }
+
+  await prisma.comment.delete({ where: { id } });
+  return { success: true };
+}
+
 /** Add or update a reaction (emoji) on a comment. */
 export async function addReaction(
   userId: string,
   commentId: string,
   type: string
 ) {
-  const comment = await findCommentById(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: "Unexpected error",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reaction = await upsertReaction({ userId, commentId, type });
   return { reaction };
@@ -63,6 +172,7 @@ export async function addReaction(
 
 /** Remove user's reaction from a comment. */
 export async function removeReaction(userId: string, commentId: string) {
+  await requireCommentAccess(commentId, userId);
   const reaction = await findReactionByUserAndComment(userId, commentId);
   if (!reaction) {
     throw new TRPCError({
@@ -75,13 +185,7 @@ export async function removeReaction(userId: string, commentId: string) {
 }
 
 export async function getReactions(userId: string, commentId: string) {
-  const comment = await findCommentWithAnnouncement(commentId);
-  if (!comment) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Comment not found",
-    });
-  }
+  await requireCommentAccess(commentId, userId);
 
   const reactionCounts = await getReactionCountsByCommentId(commentId);
   const userReaction = await findReactionByUserAndComment(userId, commentId);

package/src/services/event.ts

@@ -26,7 +26,7 @@ export async function getEvent(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to view this event",
@@ -92,7 +92,7 @@ export async function updateEventRecord(
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to update this event",
@@ -120,7 +120,7 @@ export async function deleteEventRecord(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to delete this event",
@@ -132,11 +132,24 @@ export async function deleteEventRecord(userId: string, id: string) {
 }
 
 function canModifyEvent(
-  event: { userId: string | null; class?: { teachers: { id: string }[] } | null },
+  event: {
+    userId: string | null;
+    class?: {
+      teachers: { id: string }[];
+      school?: {
+        users: { id: string }[];
+        memberships?: { userId: string }[];
+      } | null;
+    } | null;
+  },
   userId: string
 ) {
   if (event.userId === userId) return true;
-  return event.class?.teachers.some((t) => t.id === userId) ?? false;
+  return Boolean(
+    event.class?.teachers.some((t) => t.id === userId) ||
+      event.class?.school?.memberships?.some((admin) => admin.userId === userId) ||
+      event.class?.school?.users.some((admin) => admin.id === userId)
+  );
 }
 
 export async function attachAssignment(
@@ -165,7 +178,11 @@ export async function attachAssignment(
       message: "Assignment not found",
     });
   }
-  if (!assignment.class.teachers.some((t) => t.id === userId)) {
+  if (
+    !assignment.class.teachers.some((t) => t.id === userId) &&
+    !assignment.class.school?.memberships?.some((admin) => admin.userId === userId) &&
+    !assignment.class.school?.users.some((admin) => admin.id === userId)
+  ) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to modify this assignment",

package/src/services/file.ts

@@ -16,6 +16,15 @@ import {
 } from "../models/file.js";
 import { findConversationMembership } from "../models/message.js";
 
+function isSchoolAdminForClass(classData: any, userId: string) {
+  return Boolean(
+    classData?.school?.memberships?.some(
+      (membership: { userId: string }) => membership.userId === userId
+    ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
+}
+
 /** Generate a signed URL for file download. Validates user has access. */
 export async function getFileSignedUrl(userId: string, fileId: string) {
   const file = await findFileById(fileId);
@@ -35,31 +44,35 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
     const isStudent = file.assignment.class.students.some(
       (s) => s.id === userId
     );
+    const isSchoolAdmin = isSchoolAdminForClass(file.assignment.class, userId);
     logger.info(
-      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`
+      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}, isSchoolAdmin: ${isSchoolAdmin}`
     );
-    hasAccess = isTeacher || isStudent;
+    hasAccess = isTeacher || isStudent || isSchoolAdmin;
   }
 
   if ((file as any).announcement?.class) {
     const ann = (file as any).announcement;
     const isTeacher = ann.class.teachers.some((t: any) => t.id === userId);
     const isStudent = ann.class.students.some((s: any) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(ann.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (file.submission?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.submission.studentId === userId ||
-      file.submission.assignment.class.teachers.some((t) => t.id === userId);
+      file.submission.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.submission.assignment.class, userId);
   }
 
   if (file.annotations?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.annotations.studentId === userId ||
-      file.annotations.assignment.class.teachers.some((t) => t.id === userId);
+      file.annotations.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.annotations.assignment.class, userId);
   }
 
   if (file.userId === userId) {
@@ -74,7 +87,8 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
   if (file.folder?.class) {
     const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
     const isStudent = file.folder.class.students.some((s) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(file.folder.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (!hasAccess) {

package/src/services/school.ts

@@ -0,0 +1,308 @@
+/**
+ * School service - school admin workflow, memberships, and invites.
+ */
+import { SchoolMembershipRole } from "@prisma/client";
+import { TRPCError } from "@trpc/server";
+import { v4 as uuidv4 } from "uuid";
+import { env } from "../lib/config/env.js";
+import { prisma } from "../lib/prisma.js";
+import { sendMail } from "../utils/email.js";
+import { logger } from "../utils/logger.js";
+import {
+  acceptSchoolInvite,
+  countActiveAdmins,
+  createSchoolInvite,
+  createSchoolWithAdmin,
+  findActiveSchoolAdminMembership,
+  findPendingInviteByToken,
+  findSchoolMembership,
+  findUserByIdForSchool,
+  getSchoolById,
+  getSchoolOverview,
+  listSchoolClasses,
+  listSchoolInvites,
+  listSchoolMembers,
+  listUserSchoolMemberships,
+  removeSchoolMembershipPreservingContent,
+  revokeSchoolInvite,
+  updateSchoolMembershipRole,
+  upsertSchoolMembership,
+} from "../models/school.js";
+
+async function requireSchoolAdmin(schoolId: string, userId: string) {
+  const membership = await findActiveSchoolAdminMembership(schoolId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only school admins can perform this action",
+    });
+  }
+  return membership;
+}
+
+async function requireSchoolMember(schoolId: string, userId: string) {
+  const membership = await findSchoolMembership(schoolId, userId);
+  if (!membership || membership.status !== "ACTIVE") {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You are not a member of this school",
+    });
+  }
+  return membership;
+}
+
+export async function getCurrentSchool(userId: string, schoolId?: string) {
+  const memberships = await listUserSchoolMemberships(userId);
+  const activeMembership = schoolId
+    ? memberships.find((membership) => membership.schoolId === schoolId)
+    : memberships[0];
+
+  return {
+    activeSchool: activeMembership?.school ?? null,
+    activeRole: activeMembership?.role ?? null,
+    memberships,
+  };
+}
+
+export async function createSchoolRecord(
+  userId: string,
+  input: { name: string; subdomain?: string; logoId?: string }
+) {
+  const school = await createSchoolWithAdmin({
+    userId,
+    name: input.name,
+    subdomain: input.subdomain,
+    logoId: input.logoId,
+  });
+
+  return { school };
+}
+
+export async function getAdminOverview(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  const school = await getSchoolOverview(schoolId);
+  if (!school) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "School not found" });
+  }
+
+  const roleCounts = school.memberships.reduce(
+    (counts, membership) => {
+      counts[membership.role] += 1;
+      return counts;
+    },
+    { ADMIN: 0, TEACHER: 0, STUDENT: 0 } satisfies Record<SchoolMembershipRole, number>
+  );
+
+  return {
+    school: {
+      id: school.id,
+      name: school.name,
+      subdomain: school.subdomain,
+      counts: {
+        classes: school._count.classes,
+        members: school._count.memberships,
+        pendingInvites: school._count.invites,
+        ...roleCounts,
+      },
+      recentClasses: school.classes,
+      recentInvites: school.invites,
+    },
+  };
+}
+
+export async function listClasses(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { classes: await listSchoolClasses(schoolId) };
+}
+
+export async function createSchoolClass(
+  userId: string,
+  input: {
+    schoolId: string;
+    name: string;
+    section: string;
+    subject: string;
+    color?: string;
+    teachers?: string[];
+    students?: string[];
+  }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const createdClass = await prisma.class.create({
+    data: {
+      name: input.name,
+      section: input.section,
+      subject: input.subject,
+      color: input.color,
+      schoolId: input.schoolId,
+      teachers: input.teachers?.length
+        ? { connect: input.teachers.map((id) => ({ id })) }
+        : undefined,
+      students: input.students?.length
+        ? { connect: input.students.map((id) => ({ id })) }
+        : undefined,
+    },
+    include: { teachers: true, students: true },
+  });
+
+  return { class: createdClass };
+}
+
+export async function listMembers(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { members: await listSchoolMembers(schoolId) };
+}
+
+export async function addMember(
+  userId: string,
+  input: { schoolId: string; memberUserId: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const membership = await upsertSchoolMembership({
+    schoolId: input.schoolId,
+    userId: input.memberUserId,
+    role: input.role,
+  });
+  return { membership };
+}
+
+export async function updateMemberRole(
+  userId: string,
+  input: { schoolId: string; memberUserId: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const current = await findSchoolMembership(input.schoolId, input.memberUserId);
+  if (!current) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Member not found" });
+  }
+
+  if (current.role === "ADMIN" && input.role !== "ADMIN") {
+    const adminCount = await countActiveAdmins(input.schoolId);
+    if (adminCount <= 1) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "A school must have at least one active admin",
+      });
+    }
+  }
+
+  const membership = await updateSchoolMembershipRole(
+    input.schoolId,
+    input.memberUserId,
+    input.role
+  );
+  return { membership };
+}
+
+export async function removeMember(
+  userId: string,
+  input: { schoolId: string; memberUserId: string }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const current = await findSchoolMembership(input.schoolId, input.memberUserId);
+  if (!current) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Member not found" });
+  }
+
+  if (current.role === "ADMIN" && current.status === "ACTIVE") {
+    const adminCount = await countActiveAdmins(input.schoolId);
+    if (adminCount <= 1) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "A school must have at least one active admin",
+      });
+    }
+  }
+
+  await removeSchoolMembershipPreservingContent(input.schoolId, input.memberUserId);
+  return { success: true };
+}
+
+export async function listInvites(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { invites: await listSchoolInvites(schoolId) };
+}
+
+export async function createInvite(
+  userId: string,
+  input: { schoolId: string; email: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const token = uuidv4();
+  const invite = await createSchoolInvite({
+    schoolId: input.schoolId,
+    invitedById: userId,
+    email: input.email,
+    role: input.role,
+    token,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 14),
+  });
+
+  try {
+    await sendMail({
+      from: "hello@studious.sh",
+      to: input.email,
+      subject: `Join ${invite.school.name} on Studious`,
+      text: `Click the link to join ${invite.school.name}: ${env.NEXT_PUBLIC_APP_URL}/school/invite/${token}`,
+    });
+  } catch (err) {
+    logger.error("Failed to send school invite email", {
+      schoolId: input.schoolId,
+      email: input.email,
+      err,
+    });
+  }
+
+  return { invite };
+}
+
+export async function revokeInvite(
+  userId: string,
+  input: { schoolId: string; inviteId: string }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  return { invite: await revokeSchoolInvite(input.inviteId, input.schoolId) };
+}
+
+export async function getInvite(token: string) {
+  const invite = await findPendingInviteByToken(token);
+  if (!invite || invite.status !== "PENDING") {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Invite not found" });
+  }
+  if (invite.expiresAt < new Date()) {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invite expired" });
+  }
+  return {
+    invite: {
+      id: invite.id,
+      email: invite.email,
+      role: invite.role,
+      school: invite.school,
+      expiresAt: invite.expiresAt,
+    },
+  };
+}
+
+export async function acceptInvite(userId: string, token: string) {
+  const invite = await findPendingInviteByToken(token);
+  if (!invite || invite.status !== "PENDING") {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Invite not found" });
+  }
+  if (invite.expiresAt < new Date()) {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invite expired" });
+  }
+
+  const user = await findUserByIdForSchool(userId);
+  if (!user) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "User not found" });
+  }
+  if (user.email.toLowerCase() !== invite.email.toLowerCase()) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "This invite was sent to a different account",
+    });
+  }
+
+  const membership = await acceptSchoolInvite(invite.id, userId);
+  return { membership };
+}

package/tests/lib/cors.test.ts

@@ -64,7 +64,19 @@ describe('CORS configuration', () => {
     });
 
     expect(isAllowedOrigin('https://studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(true);
-    expect(isAllowedOrigin('https://malicious-studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(false);
+    // Same shape on a non-.vercel.app host must not match the env-only pattern.
+    expect(isAllowedOrigin('https://studious-git-fake-studious-lms.evil.example')).toBe(false);
+  });
+
+  test('allows any https://*.vercel.app origin', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+    });
+
+    expect(isAllowedOrigin('https://preview-abc123.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('https://my-app-git-main-username.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('http://preview.vercel.app')).toBe(false);
   });
 
   test('rejects missing and unconfigured origins instead of using a fallback', () => {