@studious-lms/server 1.4.6 → 1.4.7

package/src/models/school.ts

@@ -0,0 +1,361 @@
+/**
+ * School model - school membership, invites, and admin lookups.
+ */
+import { SchoolMembershipRole } from "@prisma/client";
+import { prisma } from "../lib/prisma.js";
+
+const memberSelect = {
+  id: true,
+  role: true,
+  status: true,
+  createdAt: true,
+  updatedAt: true,
+  user: {
+    select: {
+      id: true,
+      username: true,
+      email: true,
+      profile: {
+        select: {
+          displayName: true,
+          profilePicture: true,
+          profilePictureThumbnail: true,
+        },
+      },
+    },
+  },
+} as const;
+
+export function findSchoolMembership(schoolId: string, userId: string) {
+  return prisma.schoolMembership.findUnique({
+    where: { schoolId_userId: { schoolId, userId } },
+  });
+}
+
+export function findActiveSchoolMembership(schoolId: string, userId: string) {
+  return prisma.schoolMembership.findFirst({
+    where: { schoolId, userId, status: "ACTIVE" },
+  });
+}
+
+export function findActiveSchoolAdminMembership(schoolId: string, userId: string) {
+  return prisma.schoolMembership.findFirst({
+    where: { schoolId, userId, role: "ADMIN", status: "ACTIVE" },
+  });
+}
+
+export function listUserSchoolMemberships(userId: string) {
+  return prisma.schoolMembership.findMany({
+    where: { userId, status: "ACTIVE" },
+    include: {
+      school: {
+        select: {
+          id: true,
+          name: true,
+          subdomain: true,
+          logoId: true,
+          createdAt: true,
+          updatedAt: true,
+        },
+      },
+    },
+    orderBy: { createdAt: "asc" },
+  });
+}
+
+export function createSchoolWithAdmin(data: {
+  name: string;
+  subdomain?: string;
+  logoId?: string;
+  userId: string;
+}) {
+  return prisma.school.create({
+    data: {
+      name: data.name,
+      subdomain: data.subdomain,
+      logoId: data.logoId,
+      memberships: {
+        create: {
+          userId: data.userId,
+          role: "ADMIN",
+          status: "ACTIVE",
+        },
+      },
+    },
+    include: {
+      memberships: {
+        where: { userId: data.userId },
+      },
+    },
+  });
+}
+
+export function getSchoolById(schoolId: string) {
+  return prisma.school.findUnique({
+    where: { id: schoolId },
+    select: {
+      id: true,
+      name: true,
+      subdomain: true,
+      logoId: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+  });
+}
+
+export function getSchoolOverview(schoolId: string) {
+  return prisma.school.findUnique({
+    where: { id: schoolId },
+    select: {
+      id: true,
+      name: true,
+      subdomain: true,
+      _count: {
+        select: {
+          classes: true,
+          memberships: { where: { status: "ACTIVE" } },
+          invites: { where: { status: "PENDING" } },
+        },
+      },
+      memberships: {
+        where: { status: "ACTIVE" },
+        select: { role: true },
+      },
+      classes: {
+        orderBy: { name: "asc" },
+        take: 5,
+        select: {
+          id: true,
+          name: true,
+          subject: true,
+          section: true,
+          color: true,
+          _count: { select: { teachers: true, students: true } },
+        },
+      },
+      invites: {
+        where: { status: "PENDING" },
+        orderBy: { createdAt: "desc" },
+        take: 5,
+        select: {
+          id: true,
+          email: true,
+          role: true,
+          expiresAt: true,
+          createdAt: true,
+        },
+      },
+    },
+  });
+}
+
+export function listSchoolClasses(schoolId: string) {
+  return prisma.class.findMany({
+    where: { schoolId },
+    orderBy: [{ name: "asc" }, { section: "asc" }],
+    include: {
+      teachers: {
+        select: {
+          id: true,
+          username: true,
+          profile: {
+            select: {
+              displayName: true,
+              profilePicture: true,
+              profilePictureThumbnail: true,
+            },
+          },
+        },
+      },
+      students: { select: { id: true } },
+      _count: { select: { teachers: true, students: true, assignments: true } },
+    },
+  });
+}
+
+export function listSchoolMembers(schoolId: string) {
+  return prisma.schoolMembership.findMany({
+    where: { schoolId },
+    select: memberSelect,
+    orderBy: [{ role: "asc" }, { createdAt: "asc" }],
+  });
+}
+
+export function countActiveAdmins(schoolId: string) {
+  return prisma.schoolMembership.count({
+    where: { schoolId, role: "ADMIN", status: "ACTIVE" },
+  });
+}
+
+export function upsertSchoolMembership(data: {
+  schoolId: string;
+  userId: string;
+  role: SchoolMembershipRole;
+}) {
+  return prisma.schoolMembership.upsert({
+    where: {
+      schoolId_userId: {
+        schoolId: data.schoolId,
+        userId: data.userId,
+      },
+    },
+    update: {
+      role: data.role,
+      status: "ACTIVE",
+    },
+    create: {
+      schoolId: data.schoolId,
+      userId: data.userId,
+      role: data.role,
+      status: "ACTIVE",
+    },
+  });
+}
+
+export function updateSchoolMembershipRole(
+  schoolId: string,
+  userId: string,
+  role: SchoolMembershipRole
+) {
+  return prisma.schoolMembership.update({
+    where: { schoolId_userId: { schoolId, userId } },
+    data: { role },
+  });
+}
+
+export function removeSchoolMembershipPreservingContent(schoolId: string, userId: string) {
+  return prisma.$transaction(async (tx) => {
+    const classes = await tx.class.findMany({
+      where: { schoolId },
+      select: { id: true },
+    });
+    const classIds = classes.map((cls) => ({ id: cls.id }));
+
+    for (const classWhere of classIds) {
+      await tx.class.update({
+        where: classWhere,
+        data: {
+          teachers: { disconnect: { id: userId } },
+          students: { disconnect: { id: userId } },
+        },
+      });
+    }
+
+    return tx.schoolMembership.delete({
+      where: { schoolId_userId: { schoolId, userId } },
+    });
+  });
+}
+
+export function findUserByEmailForSchool(email: string) {
+  return prisma.user.findFirst({
+    where: { email },
+    select: { id: true, email: true, username: true },
+  });
+}
+
+export function findUserByIdForSchool(userId: string) {
+  return prisma.user.findUnique({
+    where: { id: userId },
+    select: { id: true, email: true, username: true },
+  });
+}
+
+export function createSchoolInvite(data: {
+  schoolId: string;
+  invitedById: string;
+  email: string;
+  role: SchoolMembershipRole;
+  token: string;
+  expiresAt: Date;
+}) {
+  return prisma.schoolInvite.create({
+    data,
+    include: {
+      school: { select: { id: true, name: true } },
+    },
+  });
+}
+
+export function listSchoolInvites(schoolId: string) {
+  return prisma.schoolInvite.findMany({
+    where: { schoolId },
+    orderBy: { createdAt: "desc" },
+    select: {
+      id: true,
+      email: true,
+      role: true,
+      status: true,
+      expiresAt: true,
+      acceptedAt: true,
+      revokedAt: true,
+      createdAt: true,
+      invitedBy: {
+        select: {
+          id: true,
+          username: true,
+          profile: { select: { displayName: true } },
+        },
+      },
+    },
+  });
+}
+
+export function revokeSchoolInvite(inviteId: string, schoolId: string) {
+  return prisma.schoolInvite.update({
+    where: { id: inviteId, schoolId },
+    data: {
+      status: "REVOKED",
+      revokedAt: new Date(),
+    },
+  });
+}
+
+export function findPendingInviteByToken(token: string) {
+  return prisma.schoolInvite.findUnique({
+    where: { token },
+    include: { school: { select: { id: true, name: true } } },
+  });
+}
+
+export function acceptSchoolInvite(inviteId: string, userId: string) {
+  return prisma.$transaction(async (tx) => {
+    const invite = await tx.schoolInvite.findUnique({
+      where: { id: inviteId },
+    });
+
+    if (!invite) {
+      throw new Error("Invite not found");
+    }
+
+    const membership = await tx.schoolMembership.upsert({
+      where: {
+        schoolId_userId: {
+          schoolId: invite.schoolId,
+          userId,
+        },
+      },
+      update: {
+        role: invite.role,
+        status: "ACTIVE",
+      },
+      create: {
+        schoolId: invite.schoolId,
+        userId,
+        role: invite.role,
+        status: "ACTIVE",
+      },
+    });
+
+    await tx.schoolInvite.update({
+      where: { id: inviteId },
+      data: {
+        status: "ACCEPTED",
+        acceptedAt: new Date(),
+      },
+    });
+
+    return membership;
+  });
+}

package/src/models/section.ts

@@ -2,6 +2,7 @@
  * Section model – class sections, ordering, assignment grouping.
  */
 import { prisma } from "../lib/prisma.js";
+import { classTeacherOrSchoolAdminWhere } from "./access.js";
 
 /** @returns Section by ID. */
 export function findSectionById(id: string) {
@@ -10,12 +11,12 @@ export function findSectionById(id: string) {
   });
 }
 
-/** @returns Class if user is a teacher. */
+/** @returns Class if user is a teacher or school admin. */
 export function findClassWithTeacher(classId: string, teacherId: string) {
   return prisma.class.findFirst({
     where: {
       id: classId,
-      teachers: { some: { id: teacherId } },
+      ...classTeacherOrSchoolAdminWhere(teacherId),
     },
   });
 }

package/src/models/worksheet.ts

@@ -3,20 +3,17 @@
  */
 import { prisma } from "../lib/prisma.js";
 import type { WorksheetQuestionType, GenerationStatus } from "@prisma/client";
+import {
+  classMemberOrSchoolAdminWhere,
+  classTeacherOrSchoolAdminWhere,
+} from "./access.js";
 
 const worksheetClassMemberWhere = (userId: string) => ({
-  class: {
-    OR: [
-      { teachers: { some: { id: userId } } },
-      { students: { some: { id: userId } } },
-    ],
-  },
+  class: classMemberOrSchoolAdminWhere(userId),
 });
 
 const worksheetTeacherWhere = (userId: string) => ({
-  class: {
-    teachers: { some: { id: userId } },
-  },
+  class: classTeacherOrSchoolAdminWhere(userId),
 });
 
 /** @returns Worksheet with questions and class. */
@@ -207,9 +204,7 @@ export function findSubmissionByIdForWorksheetAccess(
         },
         {
           assignment: {
-            class: {
-              teachers: { some: { id: userId } },
-            },
+            class: classTeacherOrSchoolAdminWhere(userId),
           },
         },
       ],

package/src/routers/_app.ts

@@ -22,6 +22,7 @@ import { worksheetRouter } from "./worksheet.js";
 import { commentRouter } from "./comment.js";
 import { studentProgressRouter } from "./studentProgress.js";
 import { searchRouter } from "./search.js";
+import { schoolRouter } from "./school.js";
 
 export const appRouter = createTRPCRouter({
   class: classRouter,
@@ -45,6 +46,7 @@ export const appRouter = createTRPCRouter({
   comment: commentRouter,
   studentProgress: studentProgressRouter,
   search: searchRouter,
+  school: schoolRouter,
 });
 
 // Export type router type definition

package/src/routers/announcement.ts

@@ -339,6 +339,24 @@ export const announcementRouter = createTRPCRouter({
                             class: {
                                 include: {
                                     teachers: true,
+                                    school: {
+                                        include: {
+                                            users: {
+                                                where: {
+                                                    role: "ADMIN",
+                                                },
+                                            },
+                                            memberships: {
+                                                where: {
+                                                    role: "ADMIN",
+                                                    status: "ACTIVE",
+                                                },
+                                                select: {
+                                                    userId: true,
+                                                },
+                                            },
+                                        },
+                                    },
                                 },
                             },
                         },
@@ -353,17 +371,25 @@ export const announcementRouter = createTRPCRouter({
                 });
             }
 
-            // Only the author or a class teacher can delete comments
+            // Only the author, a class teacher, or the class school admin can delete comments
             const userId = ctx.user.id;
             const isAuthor = comment.authorId === userId;
             const isClassTeacher = comment.announcement!.class.teachers.some(
                 (teacher) => teacher.id === userId
             );
+            const isSchoolAdmin = Boolean(
+                comment.announcement!.class.school?.memberships.some(
+                    (admin) => admin.userId === userId
+                ) ||
+                comment.announcement!.class.school?.users.some(
+                    (admin) => admin.id === userId
+                )
+            );
 
-            if (!isAuthor && !isClassTeacher) {
+            if (!isAuthor && !isClassTeacher && !isSchoolAdmin) {
                 throw new TRPCError({
                     code: "FORBIDDEN",
-                    message: "Only the comment author or class teachers can delete comments",
+                    message: "Only the comment author, class teachers, or school admins can delete comments",
                 });
             }
 
@@ -696,4 +722,4 @@ export const announcementRouter = createTRPCRouter({
                 message: "Unexpected error",
             });
         }),
-}); 
+});

package/src/routers/assignment.ts

@@ -6,6 +6,10 @@ import { createDirectUploadFiles, type DirectUploadFile, confirmDirectUpload, up
 import { deleteFile } from "../lib/googleCloudStorage.js";
 import { logger } from "../utils/logger.js";
 import { gradeWorksheetPipeline } from "../pipelines/gradeWorksheet.js";
+import {
+  classMemberOrSchoolAdminWhere,
+  classTeacherOrSchoolAdminWhere,
+} from "../models/access.js";
 import {
   assignmentExists,
   getDueToday,
@@ -394,16 +398,11 @@ export const assignmentRouter = createTRPCRouter({
           assignmentId: input.assignmentId,
           assignment: {
             classId: input.classId,
-            class: {
-              OR: [
-                { teachers: { some: { id: ctx.user!.id } } },
-                { students: { some: { id: ctx.user!.id } } },
-              ],
-            },
+            class: classMemberOrSchoolAdminWhere(ctx.user!.id),
           },
           OR: [
             { studentId: ctx.user!.id },
-            { assignment: { class: { teachers: { some: { id: ctx.user!.id } } } } },
+            { assignment: { class: classTeacherOrSchoolAdminWhere(ctx.user!.id) } },
           ],
         },
         select: { id: true },
@@ -437,7 +436,7 @@ export const assignmentRouter = createTRPCRouter({
           assignment: { classId: input.classId },
           OR: [
             { studentId: ctx.user!.id },
-            { assignment: { class: { teachers: { some: { id: ctx.user!.id } } } } },
+            { assignment: { class: classTeacherOrSchoolAdminWhere(ctx.user!.id) } },
           ],
         },
         select: { id: true },
@@ -630,6 +629,21 @@ export const assignmentRouter = createTRPCRouter({
                 include: {
                   students: true,
                   teachers: true,
+                  school: {
+                    include: {
+                      users: {
+                        where: { role: "ADMIN" },
+                        select: { id: true },
+                      },
+                      memberships: {
+                        where: {
+                          role: "ADMIN",
+                          status: "ACTIVE",
+                        },
+                        select: { userId: true },
+                      },
+                    },
+                  },
                 },
               },
             },
@@ -647,8 +661,12 @@ export const assignmentRouter = createTRPCRouter({
       // Check if user is the student who owns the submission or a teacher of the class
       const isStudent = submission.studentId === ctx.user.id;
       const isTeacher = submission.assignment.class.teachers.some(teacher => teacher.id === ctx.user?.id);
+      const isSchoolAdmin = Boolean(
+        submission.assignment.class.school?.memberships.some(admin => admin.userId === ctx.user?.id) ||
+          submission.assignment.class.school?.users.some(admin => admin.id === ctx.user?.id)
+      );
 
-      if (!isStudent && !isTeacher) {
+      if (!isStudent && !isTeacher && !isSchoolAdmin) {
         throw new TRPCError({
           code: "FORBIDDEN",
           message: "You don't have permission to upload files to this submission",

package/src/routers/class.ts

@@ -74,6 +74,7 @@ export const classRouter = createTRPCRouter({
         section: z.string(),
         subject: z.string(),
         color: z.string().optional(),
+        schoolId: z.string().optional(),
       })
     )
     .mutation(({ ctx, input }) =>

package/src/routers/school.ts

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import {
+  createTRPCRouter,
+  protectedProcedure,
+  publicProcedure,
+} from "../trpc.js";
+import {
+  acceptInvite,
+  addMember,
+  createInvite,
+  createSchoolClass,
+  createSchoolRecord,
+  getAdminOverview,
+  getCurrentSchool,
+  getInvite,
+  listClasses,
+  listInvites,
+  listMembers,
+  removeMember,
+  revokeInvite,
+  updateMemberRole,
+} from "../services/school.js";
+
+const schoolRoleSchema = z.enum(["ADMIN", "TEACHER", "STUDENT"]);
+
+const schoolIdSchema = z.object({
+  schoolId: z.string(),
+});
+
+export const schoolRouter = createTRPCRouter({
+  getCurrent: protectedProcedure
+    .input(z.object({ schoolId: z.string().optional() }).optional())
+    .query(({ ctx, input }) =>
+      getCurrentSchool(ctx.user!.id, input?.schoolId)
+    ),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        name: z.string().min(1),
+        subdomain: z.string().min(1).optional(),
+        logoId: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolRecord(ctx.user!.id, input)),
+
+  getAdminOverview: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => getAdminOverview(ctx.user!.id, input.schoolId)),
+
+  listClasses: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listClasses(ctx.user!.id, input.schoolId)),
+
+  createClass: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        name: z.string(),
+        section: z.string(),
+        subject: z.string(),
+        color: z.string().optional(),
+        teachers: z.array(z.string()).optional(),
+        students: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolClass(ctx.user!.id, input)),
+
+  listMembers: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listMembers(ctx.user!.id, input.schoolId)),
+
+  addMember: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => addMember(ctx.user!.id, input)),
+
+  updateMemberRole: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => updateMemberRole(ctx.user!.id, input)),
+
+  removeMember: protectedProcedure
+    .input(z.object({ schoolId: z.string(), memberUserId: z.string() }))
+    .mutation(({ ctx, input }) => removeMember(ctx.user!.id, input)),
+
+  listInvites: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listInvites(ctx.user!.id, input.schoolId)),
+
+  createInvite: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        email: z.string().email(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => createInvite(ctx.user!.id, input)),
+
+  revokeInvite: protectedProcedure
+    .input(z.object({ schoolId: z.string(), inviteId: z.string() }))
+    .mutation(({ ctx, input }) => revokeInvite(ctx.user!.id, input)),
+
+  getInvite: publicProcedure
+    .input(z.object({ token: z.string() }))
+    .query(({ input }) => getInvite(input.token)),
+
+  acceptInvite: protectedProcedure
+    .input(z.object({ token: z.string() }))
+    .mutation(({ ctx, input }) => acceptInvite(ctx.user!.id, input.token)),
+});