@studious-lms/server 1.6.0 → 1.8.0

package/src/services/file.ts

@@ -1,6 +1,11 @@
 /**
  * File service – signed URLs, move, rename, delete. Handles permission checks
  * for assignment, submission, announcement, folder, and user-owned files.
+ *
+ * The class files page calls the legacy class-scoped helpers; the unified
+ * cloud-storage page calls the `*Scoped` / `*Generic` helpers below, which
+ * derive permissions from the parent folder's CloudScope so the same endpoint
+ * can serve class, school, and personal storage.
  */
 import { TRPCError } from "@trpc/server";
 import { getSignedUrl, deleteFile } from "../lib/googleCloudStorage.js";
@@ -15,6 +20,9 @@ import {
   deleteFileById,
 } from "../models/file.js";
 import { findConversationMembership } from "../models/message.js";
+import { prisma } from "../lib/prisma.js";
+import { resolveFolderScope } from "../models/cloudStorage.js";
+import { requireFolderAccess } from "./folder.js";
 
 function isSchoolAdminForClass(classData: any, userId: string) {
   return Boolean(
@@ -185,3 +193,95 @@ export async function deleteFileRecord(fileId: string, classId: string) {
   await deleteFileById(fileId);
   return { success: true };
 }
+
+/**
+ * Scope-aware move: works for class, school, and personal storage. Source
+ * and target must live in the same scope (no cross-scope moves).
+ */
+export async function moveFileScoped(
+  userId: string,
+  input: { fileId: string; targetFolderId: string }
+) {
+  const file = await findFileWithFolder(input.fileId);
+  if (!file?.folderId) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  const [sourceScope, targetScope] = await Promise.all([
+    resolveFolderScope(file.folderId),
+    resolveFolderScope(input.targetFolderId),
+  ]);
+  if (!sourceScope || !targetScope) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
+  }
+  if (JSON.stringify(sourceScope) !== JSON.stringify(targetScope)) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Cannot move files between scopes",
+    });
+  }
+  await requireFolderAccess(userId, file.folderId, "WRITE");
+  await requireFolderAccess(userId, input.targetFolderId, "WRITE");
+  return updateFileFolder(input.fileId, input.targetFolderId);
+}
+
+/** Scope-aware rename. */
+export async function renameFileScoped(
+  userId: string,
+  input: { fileId: string; newName: string }
+) {
+  const trimmed = input.newName.trim();
+  if (!trimmed) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "File name cannot be empty",
+    });
+  }
+  const file = await findFileWithFolder(input.fileId);
+  if (!file) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  if (file.folderId) {
+    await requireFolderAccess(userId, file.folderId, "WRITE");
+  } else if (file.userId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You don't own this file",
+    });
+  }
+  return updateFileName(input.fileId, trimmed);
+}
+
+/**
+ * Generic delete that works across class / school / personal storage by
+ * deriving permissions from the parent folder's CloudScope (or owning user
+ * for unfiled files).
+ */
+export async function deleteFileGeneric(userId: string, fileId: string) {
+  const file = await findFileWithFolderAndThumbnail(fileId);
+  if (!file) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  if (file.folderId) {
+    await requireFolderAccess(userId, file.folderId, "WRITE");
+  } else if (file.userId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You don't own this file",
+    });
+  }
+  try {
+    if (file.uploadStatus === "COMPLETED") {
+      await deleteFile(file.path);
+      if (file.thumbnail) {
+        await deleteFile(file.thumbnail.path);
+      }
+    }
+  } catch (error) {
+    logger.warn(
+      `Failed to delete file ${file.path}:`,
+      error as Record<string, unknown>
+    );
+  }
+  await deleteFileById(fileId);
+  return { success: true };
+}