@studious-lms/server 1.4.6 → 1.4.9

package/src/routers/school.ts

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import {
+  createTRPCRouter,
+  protectedProcedure,
+  publicProcedure,
+} from "../trpc.js";
+import {
+  acceptInvite,
+  addMember,
+  createInvite,
+  createSchoolClass,
+  createSchoolRecord,
+  getAdminOverview,
+  getCurrentSchool,
+  getInvite,
+  listClasses,
+  listInvites,
+  listMembers,
+  removeMember,
+  revokeInvite,
+  updateMemberRole,
+} from "../services/school.js";
+
+const schoolRoleSchema = z.enum(["ADMIN", "TEACHER", "STUDENT"]);
+
+const schoolIdSchema = z.object({
+  schoolId: z.string(),
+});
+
+export const schoolRouter = createTRPCRouter({
+  getCurrent: protectedProcedure
+    .input(z.object({ schoolId: z.string().optional() }).optional())
+    .query(({ ctx, input }) =>
+      getCurrentSchool(ctx.user!.id, input?.schoolId)
+    ),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        name: z.string().min(1),
+        subdomain: z.string().min(1).optional(),
+        logoId: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolRecord(ctx.user!.id, input)),
+
+  getAdminOverview: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => getAdminOverview(ctx.user!.id, input.schoolId)),
+
+  listClasses: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listClasses(ctx.user!.id, input.schoolId)),
+
+  createClass: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        name: z.string(),
+        section: z.string(),
+        subject: z.string(),
+        color: z.string().optional(),
+        teachers: z.array(z.string()).optional(),
+        students: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createSchoolClass(ctx.user!.id, input)),
+
+  listMembers: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listMembers(ctx.user!.id, input.schoolId)),
+
+  addMember: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => addMember(ctx.user!.id, input)),
+
+  updateMemberRole: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        memberUserId: z.string(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => updateMemberRole(ctx.user!.id, input)),
+
+  removeMember: protectedProcedure
+    .input(z.object({ schoolId: z.string(), memberUserId: z.string() }))
+    .mutation(({ ctx, input }) => removeMember(ctx.user!.id, input)),
+
+  listInvites: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listInvites(ctx.user!.id, input.schoolId)),
+
+  createInvite: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        email: z.string().email(),
+        role: schoolRoleSchema,
+      })
+    )
+    .mutation(({ ctx, input }) => createInvite(ctx.user!.id, input)),
+
+  revokeInvite: protectedProcedure
+    .input(z.object({ schoolId: z.string(), inviteId: z.string() }))
+    .mutation(({ ctx, input }) => revokeInvite(ctx.user!.id, input)),
+
+  getInvite: publicProcedure
+    .input(z.object({ token: z.string() }))
+    .query(({ input }) => getInvite(input.token)),
+
+  acceptInvite: protectedProcedure
+    .input(z.object({ token: z.string() }))
+    .mutation(({ ctx, input }) => acceptInvite(ctx.user!.id, input.token)),
+});

package/src/routers/worksheet.ts

@@ -19,6 +19,7 @@ import {
   updateWorksheetRecord,
   deleteWorksheetRecord,
   createWorksheetRecord,
+  duplicateWorksheetRecord,
   createWorksheetFromPdf,
   createWorksheetFromUploadedPdf,
   addQuestionToWorksheet,
@@ -108,6 +109,23 @@ export const worksheetRouter = createTRPCRouter({
       createWorksheetRecord(input.classId, input.name)
     ),
 
+  duplicateWorksheet: protectedTeacherProcedure
+    .input(
+      z.object({
+        classId: z.string(),
+        name: z.string(),
+        worksheetId: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      duplicateWorksheetRecord(
+        input.worksheetId,
+        input.classId,
+        input.name,
+        ctx.user!.id
+      )
+    ),
+
   createFromPdf: protectedTeacherProcedure
     .input(z.object({ classId: z.string(), url: z.string().url() }))
     .mutation(({ input }) => createWorksheetFromPdf(input.classId, input.url)),

package/src/services/announcement.ts

@@ -157,11 +157,15 @@ export async function updateAnnouncementRecord(
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can update announcements",
+      message: "Only the announcement creator, class teachers, or school admins can update announcements",
     });
   }
 
@@ -277,11 +281,15 @@ export async function deleteAnnouncementRecord(userId: string, id: string, class
 
   const isCreator = announcement.teacherId === userId;
   const isClassTeacher = announcement.class.teachers.some((t) => t.id === userId);
+  const isSchoolAdmin = Boolean(
+    announcement.class.school?.memberships.some((admin) => admin.userId === userId) ||
+      announcement.class.school?.users.some((admin) => admin.id === userId)
+  );
 
-  if (!isCreator && !isClassTeacher) {
+  if (!isCreator && !isClassTeacher && !isSchoolAdmin) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only the announcement creator or class teachers can delete announcements",
+      message: "Only the announcement creator, class teachers, or school admins can delete announcements",
     });
   }
 

package/src/services/assignment.ts

@@ -6,6 +6,7 @@ import { prisma } from "../lib/prisma.js";
 import {
   findAssignmentById,
   findAssignmentWithDetails,
+  findAssignmentWithClassForTeacher,
   findAssignmentForDelete,
   findAssignmentsDueToday,
   findSubmissionByAssignmentAndStudent,
@@ -15,10 +16,10 @@ import {
   findSubmissionsByAssignmentForTeacher,
   createSubmission,
   findSectionsByClassId,
-  findAssignmentWithClassForTeacher,
   findAvailableEventsForAssignment,
   attachAssignmentToEvent,
   detachAssignmentFromEvent,
+  duplicateAssignment,
 } from "../models/assignment.js";
 import { createDirectUploadFiles, type UploadedFile } from "../lib/fileUpload.js";
 import { deleteFile } from "../lib/googleCloudStorage.js";
@@ -320,6 +321,51 @@ export async function createAssignmentRecord(
   return assignment;
 }
 
+/**
+ * Duplicate an assignment into another class. Caller must teach both the source assignment’s
+ * class and the target class.
+ */
+export async function duplicateAssignmentRecord(
+  assignmentId: string,
+  classId: string,
+  title: string,
+  userId: string
+) {
+  const source = await findAssignmentWithClassForTeacher(assignmentId, userId);
+  if (!source) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message:
+        "Assignment not found or you are not a teacher of the class it belongs to",
+    });
+  }
+
+  const targetOk = await prisma.class.findFirst({
+    where: {
+      id: classId,
+      teachers: { some: { id: userId } },
+    },
+    select: { id: true },
+  });
+
+  if (!targetOk) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You are not a teacher of the target class",
+    });
+  }
+
+  const created = await duplicateAssignment(assignmentId, classId, title, userId);
+  if (!created) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Assignment not found or could not be duplicated",
+    });
+  }
+
+  return created;
+}
+
 export async function updateAssignmentRecord(
   userId: string,
   input: {

package/src/services/class.ts

@@ -27,6 +27,33 @@ import {
 } from "../models/class.js";
 import { Class, Folder } from "@prisma/client";
 
+async function requireActiveSchoolMembers(schoolId: string, userIds: string[]) {
+  const uniqueUserIds = [...new Set(userIds)];
+  if (!uniqueUserIds.length) {
+    return;
+  }
+
+  const memberships = await prisma.schoolMembership.findMany({
+    where: {
+      schoolId,
+      status: "ACTIVE",
+      userId: { in: uniqueUserIds },
+    },
+    select: { userId: true },
+  });
+  const activeMemberIds = new Set(
+    memberships.map((membership) => membership.userId)
+  );
+  const hasNonMember = uniqueUserIds.some((id) => !activeMemberIds.has(id));
+
+  if (hasNonMember) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "All class members must belong to this school",
+    });
+  }
+}
+
 /** Get all classes where user is teacher or student, with assignments and members. */
 export async function getAllClasses(userId: string) {
   const [teacherClasses, studentClasses] = await Promise.all([
@@ -121,22 +148,37 @@ export async function createClass(
     section: string;
     subject: string;
     color?: string;
+    schoolId?: string;
   }
 ) {
-  const { students, teachers, name, section, subject, color } = input;
+  const { students, teachers, name, section, subject, color, schoolId } = input;
 
-  if (teachers && teachers.length > 0 && students && students.length > 0) {
-    return prisma.class.create({
-      data: {
-        name,
-        section,
-        subject,
-        color,
-        teachers: { connect: teachers.map((id) => ({ id })) },
-        students: { connect: students.map((id) => ({ id })) },
-      },
-      include: { teachers: true, students: true },
+  if (schoolId) {
+    const membership = await prisma.schoolMembership.findFirst({
+      where: { userId, schoolId, status: "ACTIVE" },
+      select: { role: true },
     });
+
+    if (!membership) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "You are not a member of this school",
+      });
+    }
+
+    if (membership.role === "STUDENT") {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "Students cannot create school classes",
+      });
+    }
+  }
+
+  const teacherIds = teachers?.length ? teachers : [userId];
+  const studentIds = students?.length ? students : [];
+
+  if (schoolId) {
+    await requireActiveSchoolMembers(schoolId, [...teacherIds, ...studentIds]);
   }
 
   return prisma.class.create({
@@ -145,8 +187,13 @@ export async function createClass(
       section,
       subject,
       color,
-      teachers: { connect: { id: userId } },
+      schoolId,
+      teachers: { connect: teacherIds.map((id) => ({ id })) },
+      ...(studentIds.length
+        ? { students: { connect: studentIds.map((id) => ({ id })) } }
+        : {}),
     },
+    include: { teachers: true, students: true },
   });
 }
 
@@ -629,4 +676,4 @@ export async function importClass(classId: string, userId: string, year: number,
       cause: err,
     });
   }
-}
+}

package/src/services/comment.ts

@@ -41,7 +41,14 @@ function getPrivateStudentId(comment: any) {
 }
 
 function isClassTeacher(comment: any, userId: string) {
-  return getCommentClass(comment)?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ?? false;
+  const classData = getCommentClass(comment);
+  return Boolean(
+    classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
+      classData?.school?.memberships?.some(
+        (admin: { userId: string }) => admin.userId === userId
+      ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
 }
 
 function isClassMember(comment: any, userId: string) {
@@ -49,6 +56,8 @@ function isClassMember(comment: any, userId: string) {
   return (
     classData?.teachers?.some((teacher: { id: string }) => teacher.id === userId) ||
     classData?.students?.some((student: { id: string }) => student.id === userId) ||
+    classData?.school?.memberships?.some((admin: { userId: string }) => admin.userId === userId) ||
+    classData?.school?.users?.some((admin: { id: string }) => admin.id === userId) ||
     false
   );
 }

package/src/services/event.ts

@@ -26,7 +26,7 @@ export async function getEvent(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to view this event",
@@ -92,7 +92,7 @@ export async function updateEventRecord(
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to update this event",
@@ -120,7 +120,7 @@ export async function deleteEventRecord(userId: string, id: string) {
       message: "Event not found",
     });
   }
-  if (event.userId !== userId) {
+  if (!canModifyEvent(event, userId)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to delete this event",
@@ -132,11 +132,24 @@ export async function deleteEventRecord(userId: string, id: string) {
 }
 
 function canModifyEvent(
-  event: { userId: string | null; class?: { teachers: { id: string }[] } | null },
+  event: {
+    userId: string | null;
+    class?: {
+      teachers: { id: string }[];
+      school?: {
+        users: { id: string }[];
+        memberships?: { userId: string }[];
+      } | null;
+    } | null;
+  },
   userId: string
 ) {
   if (event.userId === userId) return true;
-  return event.class?.teachers.some((t) => t.id === userId) ?? false;
+  return Boolean(
+    event.class?.teachers.some((t) => t.id === userId) ||
+      event.class?.school?.memberships?.some((admin) => admin.userId === userId) ||
+      event.class?.school?.users.some((admin) => admin.id === userId)
+  );
 }
 
 export async function attachAssignment(
@@ -165,7 +178,11 @@ export async function attachAssignment(
       message: "Assignment not found",
     });
   }
-  if (!assignment.class.teachers.some((t) => t.id === userId)) {
+  if (
+    !assignment.class.teachers.some((t) => t.id === userId) &&
+    !assignment.class.school?.memberships?.some((admin) => admin.userId === userId) &&
+    !assignment.class.school?.users.some((admin) => admin.id === userId)
+  ) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You are not authorized to modify this assignment",

package/src/services/file.ts

@@ -16,6 +16,15 @@ import {
 } from "../models/file.js";
 import { findConversationMembership } from "../models/message.js";
 
+function isSchoolAdminForClass(classData: any, userId: string) {
+  return Boolean(
+    classData?.school?.memberships?.some(
+      (membership: { userId: string }) => membership.userId === userId
+    ) ||
+      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+  );
+}
+
 /** Generate a signed URL for file download. Validates user has access. */
 export async function getFileSignedUrl(userId: string, fileId: string) {
   const file = await findFileById(fileId);
@@ -35,31 +44,35 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
     const isStudent = file.assignment.class.students.some(
       (s) => s.id === userId
     );
+    const isSchoolAdmin = isSchoolAdminForClass(file.assignment.class, userId);
     logger.info(
-      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`
+      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}, isSchoolAdmin: ${isSchoolAdmin}`
     );
-    hasAccess = isTeacher || isStudent;
+    hasAccess = isTeacher || isStudent || isSchoolAdmin;
   }
 
   if ((file as any).announcement?.class) {
     const ann = (file as any).announcement;
     const isTeacher = ann.class.teachers.some((t: any) => t.id === userId);
     const isStudent = ann.class.students.some((s: any) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(ann.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (file.submission?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.submission.studentId === userId ||
-      file.submission.assignment.class.teachers.some((t) => t.id === userId);
+      file.submission.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.submission.assignment.class, userId);
   }
 
   if (file.annotations?.assignment?.classId) {
     hasAccess =
       hasAccess ||
       file.annotations.studentId === userId ||
-      file.annotations.assignment.class.teachers.some((t) => t.id === userId);
+      file.annotations.assignment.class.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(file.annotations.assignment.class, userId);
   }
 
   if (file.userId === userId) {
@@ -74,7 +87,8 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
   if (file.folder?.class) {
     const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
     const isStudent = file.folder.class.students.some((s) => s.id === userId);
-    hasAccess = hasAccess || isTeacher || isStudent;
+    const isSchoolAdmin = isSchoolAdminForClass(file.folder.class, userId);
+    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
   }
 
   if (!hasAccess) {