@studious-lms/server 1.4.6 → 1.4.7

package/src/services/announcement.ts

@@ -157,11 +157,15 @@ export async function updateAnnouncementRecord(
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can update announcements",
+      message: "Only the announcement creator, class teachers, or school admins can update announcements",
     });
   }
 
@@ -277,11 +281,15 @@ export async function deleteAnnouncementRecord(userId: string, id: string, class
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can delete announcements",
+      message: "Only the announcement creator, class teachers, or school admins can delete announcements",
     });
   }
 

package/src/services/class.ts

@@ -25,6 +25,7 @@ import {
   findFullExportableClass,
   createClassByImport,
 } from "../models/class.js";
+import { listUserSchoolMemberships } from "../models/school.js";
 import { Class, Folder } from "@prisma/client";
 
 /** Get all classes where user is teacher or student, with assignments and members. */
@@ -121,9 +122,29 @@ export async function createClass(
     section: string;
     subject: string;
     color?: string;
+    schoolId?: string;
   }
 ) {
-  const { students, teachers, name, section, subject, color } = input;
+  const { students, teachers, name, section, subject, color, schoolId } = input;
+
+  if (schoolId) {
+    const memberships = await listUserSchoolMemberships(userId);
+    const membership = memberships.find((item) => item.schoolId === schoolId);
+
+    if (!membership) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "You are not a member of this school",
+      });
+    }
+
+    if (membership.role === "STUDENT") {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "Students cannot create school classes",
+      });
+    }
+  }
 
   if (teachers && teachers.length > 0 && students && students.length > 0) {
     return prisma.class.create({
@@ -132,6 +153,7 @@ export async function createClass(
         section,
         subject,
         color,
+        schoolId,
         teachers: { connect: teachers.map((id) => ({ id })) },
         students: { connect: students.map((id) => ({ id })) },
       },
@@ -145,6 +167,7 @@ export async function createClass(
       section,
       subject,
       color,
+      schoolId,
       teachers: { connect: { id: userId } },
     },
   });
@@ -629,4 +652,4 @@ export async function importClass(classId: string, userId: string, year: number,
       cause: err,
     });
   }
-}
+}

package/src/services/comment.ts

@@ -41,7 +41,14 @@ function getPrivateStudentId(comment: any) {
 }
 
 function isClassTeacher(comment: any, userId: string) {
-  return getCommentClass(comment)?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ?? false;
+  const classData = getCommentClass(comment);
+  return Boolean(
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+      classData?.school?.memberships?.some(
+        (admin: { userId: string }) => admin.userId === userId
+      ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
 }
 
 function isClassMember(comment: any, userId: string) {
@@ -49,6 +56,8 @@ function isClassMember(comment: any, userId: string) {
   return (
     classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
     classData?.students?.some((student: { id: string }) => student.id === userId) ||
+    classData?.school?.memberships?.some((admin: { userId: string }) => admin.userId === userId) ||
+    classData?.school?.users?.some((admin: { id: string }) => admin.id === userId) ||
     false
   );
 }

package/src/services/event.ts

@@ -26,7 +26,7 @@ export async function getEvent(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to view this event",
@@ -92,7 +92,7 @@ export async function updateEventRecord(
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to update this event",
@@ -120,7 +120,7 @@ export async function deleteEventRecord(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to delete this event",
@@ -132,11 +132,24 @@ export async function deleteEventRecord(userId: string, id: string) {
 }
 
 function canModifyEvent(
-  event: { userId: string | null; class?: { teachers: { id: string }[] } | null },
+  event: {
+    userId: string | null;
+    class?: {
+      teachers: { id: string }[];
+      school?: {
+        users: { id: string }[];
+        memberships?: { userId: string }[];
+      } | null;
+    } | null;
+  },
   userId: string
 ) {
   if (event.userId === userId) return true;
-  return event.class?.teachers.some((t) => t.id === userId) ?? false;
+  return Boolean(
+    event.class?.teachers.some((t) => t.id === userId) ||
+      event.class?.school?.memberships?.some((admin) => admin.userId === userId) ||
+      event.class?.school?.users.some((admin) => admin.id === userId)
+  );
 }
 
 export async function attachAssignment(
@@ -165,7 +178,11 @@ export async function attachAssignment(
       message: "Assignment not found",
     });
   }
-  if (!assignment.class.teachers.some((t) => t.id === userId)) {
+  if (
+    !assignment.class.teachers.some((t) => t.id === userId) &&
+    !assignment.class.school?.memberships?.some((admin) => admin.userId === userId) &&
+    !assignment.class.school?.users.some((admin) => admin.id === userId)
+  ) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to modify this assignment",

package/src/services/file.ts

@@ -16,6 +16,15 @@ import {
 } from "../models/file.js";
 import { findConversationMembership } from "../models/message.js";
 
+function isSchoolAdminForClass(classData: any, userId: string) {
+  return Boolean(
+    classData?.school?.memberships?.some(
+      (membership: { userId: string }) => membership.userId === userId
+    ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
+}
+
 /** Generate a signed URL for file download. Validates user has access. */
 export async function getFileSignedUrl(userId: string, fileId: string) {
   const file = await findFileById(fileId);
@@ -35,31 +44,35 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
     const isStudent = file.assignment.class.students.some(
       (s) => s.id === userId
     );
+    const isSchoolAdmin = isSchoolAdminForClass(file.assignment.class, userId);
     logger.info(
-      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`
+      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}, isSchoolAdmin: ${isSchoolAdmin}`
     );
-    hasAccess = isTeacher || isStudent;
+    hasAccess = isTeacher || isStudent || isSchoolAdmin;
   }
 
   if ((file as any).announcement?.class) {
     const ann = (file as any).announcement;
     const isTeacher = ann.class.teachers.some((t: any) => t.id === userId);
     const isStudent = ann.class.students.some((s: any) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(ann.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (file.submission?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.submission.studentId === userId ||
-      file.submission.assignment.class.teachers.some((t) => t.id === userId);
+      file.submission.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.submission.assignment.class, userId);
   }
 
   if (file.annotations?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.annotations.studentId === userId ||
-      file.annotations.assignment.class.teachers.some((t) => t.id === userId);
+      file.annotations.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.annotations.assignment.class, userId);
   }
 
   if (file.userId === userId) {
@@ -74,7 +87,8 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
   if (file.folder?.class) {
     const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
     const isStudent = file.folder.class.students.some((s) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(file.folder.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (!hasAccess) {

package/src/services/school.ts

@@ -0,0 +1,308 @@
+/**
+ * School service - school admin workflow, memberships, and invites.
+ */
+import { SchoolMembershipRole } from "@prisma/client";
+import { TRPCError } from "@trpc/server";
+import { v4 as uuidv4 } from "uuid";
+import { env } from "../lib/config/env.js";
+import { prisma } from "../lib/prisma.js";
+import { sendMail } from "../utils/email.js";
+import { logger } from "../utils/logger.js";
+import {
+  acceptSchoolInvite,
+  countActiveAdmins,
+  createSchoolInvite,
+  createSchoolWithAdmin,
+  findActiveSchoolAdminMembership,
+  findPendingInviteByToken,
+  findSchoolMembership,
+  findUserByIdForSchool,
+  getSchoolById,
+  getSchoolOverview,
+  listSchoolClasses,
+  listSchoolInvites,
+  listSchoolMembers,
+  listUserSchoolMemberships,
+  removeSchoolMembershipPreservingContent,
+  revokeSchoolInvite,
+  updateSchoolMembershipRole,
+  upsertSchoolMembership,
+} from "../models/school.js";
+
+async function requireSchoolAdmin(schoolId: string, userId: string) {
+  const membership = await findActiveSchoolAdminMembership(schoolId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only school admins can perform this action",
+    });
+  }
+  return membership;
+}
+
+async function requireSchoolMember(schoolId: string, userId: string) {
+  const membership = await findSchoolMembership(schoolId, userId);
+  if (!membership || membership.status !== "ACTIVE") {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You are not a member of this school",
+    });
+  }
+  return membership;
+}
+
+export async function getCurrentSchool(userId: string, schoolId?: string) {
+  const memberships = await listUserSchoolMemberships(userId);
+  const activeMembership = schoolId
+    ? memberships.find((membership) => membership.schoolId === schoolId)
+    : memberships[0];
+
+  return {
+    activeSchool: activeMembership?.school ?? null,
+    activeRole: activeMembership?.role ?? null,
+    memberships,
+  };
+}
+
+export async function createSchoolRecord(
+  userId: string,
+  input: { name: string; subdomain?: string; logoId?: string }
+) {
+  const school = await createSchoolWithAdmin({
+    userId,
+    name: input.name,
+    subdomain: input.subdomain,
+    logoId: input.logoId,
+  });
+
+  return { school };
+}
+
+export async function getAdminOverview(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  const school = await getSchoolOverview(schoolId);
+  if (!school) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "School not found" });
+  }
+
+  const roleCounts = school.memberships.reduce(
+    (counts, membership) => {
+      counts[membership.role] += 1;
+      return counts;
+    },
+    { ADMIN: 0, TEACHER: 0, STUDENT: 0 } satisfies Record<SchoolMembershipRole, number>
+  );
+
+  return {
+    school: {
+      id: school.id,
+      name: school.name,
+      subdomain: school.subdomain,
+      counts: {
+        classes: school._count.classes,
+        members: school._count.memberships,
+        pendingInvites: school._count.invites,
+        ...roleCounts,
+      },
+      recentClasses: school.classes,
+      recentInvites: school.invites,
+    },
+  };
+}
+
+export async function listClasses(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { classes: await listSchoolClasses(schoolId) };
+}
+
+export async function createSchoolClass(
+  userId: string,
+  input: {
+    schoolId: string;
+    name: string;
+    section: string;
+    subject: string;
+    color?: string;
+    teachers?: string[];
+    students?: string[];
+  }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const createdClass = await prisma.class.create({
+    data: {
+      name: input.name,
+      section: input.section,
+      subject: input.subject,
+      color: input.color,
+      schoolId: input.schoolId,
+      teachers: input.teachers?.length
+        ? { connect: input.teachers.map((id) => ({ id })) }
+        : undefined,
+      students: input.students?.length
+        ? { connect: input.students.map((id) => ({ id })) }
+        : undefined,
+    },
+    include: { teachers: true, students: true },
+  });
+
+  return { class: createdClass };
+}
+
+export async function listMembers(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { members: await listSchoolMembers(schoolId) };
+}
+
+export async function addMember(
+  userId: string,
+  input: { schoolId: string; memberUserId: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const membership = await upsertSchoolMembership({
+    schoolId: input.schoolId,
+    userId: input.memberUserId,
+    role: input.role,
+  });
+  return { membership };
+}
+
+export async function updateMemberRole(
+  userId: string,
+  input: { schoolId: string; memberUserId: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const current = await findSchoolMembership(input.schoolId, input.memberUserId);
+  if (!current) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Member not found" });
+  }
+
+  if (current.role === "ADMIN" && input.role !== "ADMIN") {
+    const adminCount = await countActiveAdmins(input.schoolId);
+    if (adminCount <= 1) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "A school must have at least one active admin",
+      });
+    }
+  }
+
+  const membership = await updateSchoolMembershipRole(
+    input.schoolId,
+    input.memberUserId,
+    input.role
+  );
+  return { membership };
+}
+
+export async function removeMember(
+  userId: string,
+  input: { schoolId: string; memberUserId: string }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const current = await findSchoolMembership(input.schoolId, input.memberUserId);
+  if (!current) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Member not found" });
+  }
+
+  if (current.role === "ADMIN" && current.status === "ACTIVE") {
+    const adminCount = await countActiveAdmins(input.schoolId);
+    if (adminCount <= 1) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "A school must have at least one active admin",
+      });
+    }
+  }
+
+  await removeSchoolMembershipPreservingContent(input.schoolId, input.memberUserId);
+  return { success: true };
+}
+
+export async function listInvites(userId: string, schoolId: string) {
+  await requireSchoolAdmin(schoolId, userId);
+  return { invites: await listSchoolInvites(schoolId) };
+}
+
+export async function createInvite(
+  userId: string,
+  input: { schoolId: string; email: string; role: SchoolMembershipRole }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const token = uuidv4();
+  const invite = await createSchoolInvite({
+    schoolId: input.schoolId,
+    invitedById: userId,
+    email: input.email,
+    role: input.role,
+    token,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 14),
+  });
+
+  try {
+    await sendMail({
+      from: "hello@studious.sh",
+      to: input.email,
+      subject: `Join ${invite.school.name} on Studious`,
+      text: `Click the link to join ${invite.school.name}: ${env.NEXT_PUBLIC_APP_URL}/school/invite/${token}`,
+    });
+  } catch (err) {
+    logger.error("Failed to send school invite email", {
+      schoolId: input.schoolId,
+      email: input.email,
+      err,
+    });
+  }
+
+  return { invite };
+}
+
+export async function revokeInvite(
+  userId: string,
+  input: { schoolId: string; inviteId: string }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  return { invite: await revokeSchoolInvite(input.inviteId, input.schoolId) };
+}
+
+export async function getInvite(token: string) {
+  const invite = await findPendingInviteByToken(token);
+  if (!invite || invite.status !== "PENDING") {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Invite not found" });
+  }
+  if (invite.expiresAt < new Date()) {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invite expired" });
+  }
+  return {
+    invite: {
+      id: invite.id,
+      email: invite.email,
+      role: invite.role,
+      school: invite.school,
+      expiresAt: invite.expiresAt,
+    },
+  };
+}
+
+export async function acceptInvite(userId: string, token: string) {
+  const invite = await findPendingInviteByToken(token);
+  if (!invite || invite.status !== "PENDING") {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Invite not found" });
+  }
+  if (invite.expiresAt < new Date()) {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invite expired" });
+  }
+
+  const user = await findUserByIdForSchool(userId);
+  if (!user) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "User not found" });
+  }
+  if (user.email.toLowerCase() !== invite.email.toLowerCase()) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "This invite was sent to a different account",
+    });
+  }
+
+  const membership = await acceptSchoolInvite(invite.id, userId);
+  return { membership };
+}