@studious-lms/server 1.6.0 → 1.8.0

package/src/routers/file.ts

@@ -1,16 +1,20 @@
 import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
 import {
-  createTRPCRouter,
-  protectedProcedure,
-  protectedTeacherProcedure,
-} from "../trpc.js";
-import {
+  deleteFileGeneric,
   getFileSignedUrl,
-  moveFile,
-  renameFile,
-  deleteFileRecord,
+  moveFileScoped,
+  renameFileScoped,
 } from "../services/file.js";
 
+/**
+ * File router. Backed by the same unified scope-aware permission model as the
+ * folder router. The class files page and the cloud-storage page (personal /
+ * institution) both run through the same endpoints.
+ *
+ * Permissions are derived from the file's parent folder scope, so callers
+ * never need to send `classId` / `scope` — just the file id.
+ */
 export const fileRouter = createTRPCRouter({
   getSignedUrl: protectedProcedure
     .input(z.object({ fileId: z.string() }))
@@ -18,38 +22,37 @@ export const fileRouter = createTRPCRouter({
       getFileSignedUrl(ctx.user!.id, input.fileId)
     ),
 
-  move: protectedTeacherProcedure
+  move: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
         targetFolderId: z.string(),
-        classId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      moveFile(input.fileId, input.targetFolderId)
+    .mutation(({ ctx, input }) =>
+      moveFileScoped(ctx.user!.id, {
+        fileId: input.fileId,
+        targetFolderId: input.targetFolderId,
+      })
     ),
 
-  rename: protectedTeacherProcedure
+  rename: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
-        newName: z.string(),
-        classId: z.string(),
+        newName: z.string().min(1),
       })
     )
-    .mutation(({ input }) =>
-      renameFile(input.fileId, input.newName)
+    .mutation(({ ctx, input }) =>
+      renameFileScoped(ctx.user!.id, {
+        fileId: input.fileId,
+        newName: input.newName,
+      })
     ),
 
-  delete: protectedTeacherProcedure
-    .input(
-      z.object({
-        fileId: z.string(),
-        classId: z.string(),
-      })
-    )
-    .mutation(({ input }) =>
-      deleteFileRecord(input.fileId, input.classId)
+  delete: protectedProcedure
+    .input(z.object({ fileId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteFileGeneric(ctx.user!.id, input.fileId)
     ),
 });

package/src/routers/folder.ts

@@ -2,175 +2,154 @@ import { z } from "zod";
 import {
   createTRPCRouter,
   protectedProcedure,
-  protectedClassMemberProcedure,
-  protectedTeacherProcedure,
 } from "../trpc.js";
 import {
+  browseFolder,
+  confirmFolderUpload,
   createFolderRecord,
+  deleteFolder,
   getFolder,
-  getChildFolders,
-  getFolderChildren,
+  getFolderParents,
+  getFolderUploadUrls,
   getRootFolder,
-  uploadFilesToFolder,
-  deleteFolderRecord,
+  listUserScopes,
   moveFolder,
   updateFolderRecord,
-  getFolderParents,
-  getFolderUploadUrls,
 } from "../services/folder.js";
 
-const createFolderSchema = z.object({
-  name: z.string(),
-  parentFolderId: z.string().optional(),
-  color: z.string().optional(),
-});
-
 const directFileSchema = z.object({
   name: z.string(),
   type: z.string(),
   size: z.number(),
 });
 
-const uploadFilesToFolderSchema = z.object({
-  folderId: z.string(),
-  files: z.array(directFileSchema),
-});
-
-const getRootFolderSchema = z.object({
-  classId: z.string(),
-});
+/**
+ * Cloud scope discriminator. Folders live under one of:
+ * - CLASS: a class shared-files area
+ * - SCHOOL_STORAGE: institution-wide files
+ * - PERSONAL: a single user's storage
+ *
+ * All folder operations identify the location they apply to with either a
+ * `folderId` (for an existing folder) or a `scope` (when no folder exists yet,
+ * e.g. browsing a scope root). There is no `classId` shorthand — use
+ * `{ scope: { kind: "CLASS", classId } }` instead.
+ */
+const cloudScopeSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("CLASS"), classId: z.string() }),
+  z.object({ kind: z.literal("SCHOOL_STORAGE"), schoolId: z.string() }),
+  z.object({ kind: z.literal("PERSONAL"), userId: z.string() }),
+]);
 
 export const folderRouter = createTRPCRouter({
-  create: protectedTeacherProcedure
-    .input(createFolderSchema)
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to create a folder");
-      }
-      return createFolderRecord(ctx.user.id, {
-        classId: input.classId,
-        name: input.name,
-        parentFolderId: input.parentFolderId,
-        color: input.color,
-      });
-    }),
-
-  get: protectedClassMemberProcedure
-    .input(z.object({ folderId: z.string(), classId: z.string() }))
-    .query(({ input }) => getFolder(input.folderId)),
-
-  getChildFolders: protectedClassMemberProcedure
-    .input(z.object({ classId: z.string() }))
-    .query(({ input }) => getChildFolders(input.classId)),
+  /** Browse a folder (or scope root) with breadcrumbs and access flag. */
+  browse: protectedProcedure
+    .input(
+      z.union([
+        z.object({ folderId: z.string() }),
+        z.object({ scope: cloudScopeSchema }),
+      ])
+    )
+    .query(({ ctx, input }) => browseFolder(ctx.user!.id, input)),
 
-  getFolderChildren: protectedClassMemberProcedure
-    .input(z.object({ folderId: z.string(), classId: z.string() }))
-    .query(({ input }) =>
-      getFolderChildren(input.folderId, input.classId)
-    ),
+  /** What scopes can this user pick from in the cloud-storage UI? */
+  listScopes: protectedProcedure.query(({ ctx }) =>
+    listUserScopes(ctx.user!.id)
+  ),
 
-  getRootFolder: protectedClassMemberProcedure
-    .input(getRootFolderSchema)
-    .query(({ input }) => getRootFolder(input.classId)),
+  /** Root folder for any scope (no folderId). */
+  getRootFolder: protectedProcedure
+    .input(z.object({ scope: cloudScopeSchema }))
+    .query(({ ctx, input }) => getRootFolder(ctx.user!.id, input.scope)),
 
-  uploadFiles: protectedTeacherProcedure
-    .input(uploadFilesToFolderSchema)
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to upload files");
-      }
-      return uploadFilesToFolder(
-        ctx.user.id,
-        input.classId,
-        input.folderId,
-        input.files
-      );
-    }),
+  get: protectedProcedure
+    .input(z.object({ folderId: z.string() }))
+    .query(({ ctx, input }) => getFolder(ctx.user!.id, input.folderId)),
 
-  delete: protectedTeacherProcedure
-    .input(z.object({ classId: z.string(), folderId: z.string() }))
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to delete folders");
-      }
-      return deleteFolderRecord(ctx.user.id, input.classId, input.folderId);
-    }),
+  getParents: protectedProcedure
+    .input(z.object({ folderId: z.string() }))
+    .query(({ ctx, input }) => getFolderParents(ctx.user!.id, input.folderId)),
 
-  move: protectedTeacherProcedure
+  create: protectedProcedure
     .input(
       z.object({
-        folderId: z.string(),
-        targetParentFolderId: z.string(),
-        classId: z.string(),
+        name: z.string().min(1),
+        parentFolderId: z.string().nullable().optional(),
+        color: z.string().optional(),
+        scope: cloudScopeSchema.optional(),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to move folders");
-      }
-      return moveFolder(
-        ctx.user.id,
-        input.folderId,
-        input.targetParentFolderId,
-        input.classId
-      );
-    }),
+    .mutation(({ ctx, input }) =>
+      createFolderRecord(ctx.user!.id, {
+        name: input.name,
+        parentFolderId: input.parentFolderId ?? undefined,
+        color: input.color,
+        scope: input.scope,
+      })
+    ),
 
-  update: protectedTeacherProcedure
+  update: protectedProcedure
     .input(
       z.object({
         folderId: z.string(),
-        name: z.string(),
+        name: z.string().optional(),
         color: z.string().optional(),
-        classId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      updateFolderRecord(
-        input.folderId,
-        input.name,
-        input.color,
-        input.classId
-      )
+    .mutation(({ ctx, input }) =>
+      updateFolderRecord(ctx.user!.id, {
+        folderId: input.folderId,
+        name: input.name,
+        color: input.color,
+      })
     ),
 
-  getParents: protectedProcedure
+  delete: protectedProcedure
     .input(z.object({ folderId: z.string() }))
-    .query(({ input }) => getFolderParents(input.folderId)),
+    .mutation(({ ctx, input }) => deleteFolder(ctx.user!.id, input.folderId)),
+
+  move: protectedProcedure
+    .input(
+      z.object({
+        folderId: z.string(),
+        targetParentFolderId: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      moveFolder(ctx.user!.id, {
+        folderId: input.folderId,
+        targetParentFolderId: input.targetParentFolderId,
+      })
+    ),
 
-  getFolderUploadUrls: protectedTeacherProcedure
+  /** Get signed upload URLs for direct-to-GCS upload. */
+  getFolderUploadUrls: protectedProcedure
     .input(
       z.object({
-        classId: z.string(),
         folderId: z.string(),
         files: z.array(directFileSchema),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to upload files");
-      }
-      return getFolderUploadUrls(
-        ctx.user.id,
-        input.classId,
-        input.folderId,
-        input.files
-      );
-    }),
+    .mutation(({ ctx, input }) =>
+      getFolderUploadUrls(ctx.user!.id, {
+        folderId: input.folderId,
+        files: input.files,
+      })
+    ),
 
-  confirmFolderUpload: protectedTeacherProcedure
+  /** Acknowledge a direct upload completed (or failed). */
+  confirmFolderUpload: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
         uploadSuccess: z.boolean(),
+        errorMessage: z.string().optional(),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to confirm uploads");
-      }
-      const { confirmDirectUpload } = await import("../lib/fileUpload.js");
-      await confirmDirectUpload(input.fileId, input.uploadSuccess);
-      return { success: true };
-    }),
+    .mutation(({ ctx, input }) =>
+      confirmFolderUpload(ctx.user!.id, {
+        fileId: input.fileId,
+        uploadSuccess: input.uploadSuccess,
+        errorMessage: input.errorMessage,
+      })
+    ),
 });

package/src/routers/school.ts

@@ -7,18 +7,24 @@ import {
 import {
   acceptInvite,
   addMember,
+  confirmSchoolAssetUpload,
   createInvite,
   createSchoolClass,
   createSchoolRecord,
   getAdminOverview,
   getCurrentSchool,
   getInvite,
+  getSchoolAssetUploadUrl,
+  getStudentTimeline,
   listClasses,
   listInvites,
+  listMemberIds,
   listMembers,
   removeMember,
   revokeInvite,
+  searchMembers,
   updateMemberRole,
+  updateSchoolDetails,
 } from "../services/school.js";
 
 const schoolRoleSchema = z.enum(["ADMIN", "TEACHER", "STUDENT"]);
@@ -38,12 +44,88 @@ export const schoolRouter = createTRPCRouter({
     .input(
       z.object({
         name: z.string().min(1),
+        description: z.string().optional(),
         subdomain: z.string().min(1).optional(),
         logoId: z.string().optional(),
       })
     )
     .mutation(({ ctx, input }) => createSchoolRecord(ctx.user!.id, input)),
 
+  update: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        name: z.string().min(1).optional(),
+        description: z.string().nullable().optional(),
+        subdomain: z.string().nullable().optional(),
+        logoId: z.string().nullable().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => updateSchoolDetails(ctx.user!.id, input)),
+
+  searchMembers: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        query: z.string(),
+        limit: z.number().min(1).max(50).optional(),
+        role: schoolRoleSchema.optional(),
+      })
+    )
+    .query(({ ctx, input }) =>
+      searchMembers(
+        ctx.user!.id,
+        input.schoolId,
+        input.query,
+        input.limit,
+        input.role
+      )
+    ),
+
+  listMemberIds: protectedProcedure
+    .input(schoolIdSchema)
+    .query(({ ctx, input }) => listMemberIds(ctx.user!.id, input.schoolId)),
+
+  getAssetUploadUrl: protectedProcedure
+    .input(
+      z.object({
+        fileName: z.string(),
+        fileType: z.string(),
+        fileSize: z.number(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      getSchoolAssetUploadUrl(ctx.user!.id, input)
+    ),
+
+  confirmAssetUpload: protectedProcedure
+    .input(
+      z.object({
+        fileId: z.string(),
+        uploadSuccess: z.boolean(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      confirmSchoolAssetUpload(
+        ctx.user!.id,
+        input.fileId,
+        input.uploadSuccess
+      )
+    ),
+
+  getStudentTimeline: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        studentId: z.string(),
+        from: z.date().optional(),
+        to: z.date().optional(),
+      })
+    )
+    .query(({ ctx, input }) =>
+      getStudentTimeline(ctx.user!.id, input)
+    ),
+
   getAdminOverview: protectedProcedure
     .input(schoolIdSchema)
     .query(({ ctx, input }) => getAdminOverview(ctx.user!.id, input.schoolId)),
@@ -60,6 +142,7 @@ export const schoolRouter = createTRPCRouter({
         section: z.string(),
         subject: z.string(),
         color: z.string().optional(),
+        departmentId: z.string().optional(),
         teachers: z.array(z.string()).optional(),
         students: z.array(z.string()).optional(),
       })

package/src/routers/tag.ts

@@ -0,0 +1,78 @@
+import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
+import {
+  attachTag,
+  createTagRecord,
+  deleteTagRecord,
+  detachTag,
+  getAttachedTags,
+  listTags,
+  updateTagRecord,
+} from "../services/tag.js";
+
+const tagTargetSchema = z.enum(["USER", "CLASS", "RUBRIC", "BOUNDARY"]);
+
+export const tagRouter = createTRPCRouter({
+  list: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        departmentId: z.string().nullable().optional(),
+      })
+    )
+    .query(({ ctx, input }) => listTags(ctx.user!.id, input)),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        departmentId: z.string().nullable().optional(),
+        name: z.string().min(1),
+        color: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createTagRecord(ctx.user!.id, input)),
+
+  update: protectedProcedure
+    .input(
+      z.object({
+        tagId: z.string(),
+        name: z.string().min(1).optional(),
+        color: z.string().optional(),
+        departmentId: z.string().nullable().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => updateTagRecord(ctx.user!.id, input)),
+
+  delete: protectedProcedure
+    .input(z.object({ tagId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteTagRecord(ctx.user!.id, input.tagId)
+    ),
+
+  attach: protectedProcedure
+    .input(
+      z.object({
+        tagId: z.string(),
+        target: tagTargetSchema,
+        targetId: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) => attachTag(ctx.user!.id, input)),
+
+  detach: protectedProcedure
+    .input(
+      z.object({
+        tagId: z.string(),
+        target: tagTargetSchema,
+        targetId: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) => detachTag(ctx.user!.id, input)),
+
+  getAttached: protectedProcedure
+    .input(
+      z.object({ target: tagTargetSchema, targetId: z.string() })
+    )
+    .query(({ ctx, input }) => getAttachedTags(ctx.user!.id, input)),
+});

package/src/services/assignment.ts

@@ -24,9 +24,8 @@ import {
 import { createDirectUploadFiles, type UploadedFile } from "../lib/fileUpload.js";
 import { deleteFile } from "../lib/googleCloudStorage.js";
 import { sendToMultiple } from "./notification.js";
-import { enqueueRunJob, QUEUE_NAMES } from "../workers/queues.js";
+import { enqueueRunJob } from "../workers/queues.js";
 import { logger } from "../utils/logger.js";
-import { RunJobType } from "@prisma/client";
 
 export async function assignmentExists(id: string) {
   const assignment = await findAssignmentById(id);
@@ -670,7 +669,7 @@ export async function updateSubmissionRecord(
       for (const wr of worksheetResponses) {
         try {
           await enqueueRunJob(
-            QUEUE_NAMES.GRADE_WORKSHEET as RunJobType,
+            "GRADE_WORKSHEET",
             { worksheetResponseId: wr.id },
             { classId: submission.assignment.classId, userId },
           );