@studious-lms/server 1.6.0 → 1.8.0

package/src/services/tag.ts

@@ -0,0 +1,229 @@
+/**
+ * Tag service — institution-scoped tag CRUD and assignment to taggable
+ * targets (users, classes, rubrics, boundaries).
+ */
+import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
+import {
+  attachTagToTarget,
+  createTag,
+  deleteTag,
+  detachTagFromTarget,
+  getTag,
+  listTagsAttachedTo,
+  listTagsForSchool,
+  type TagTarget,
+  updateTag,
+} from "../models/tag.js";
+import {
+  findActiveSchoolAdminMembership,
+  findSchoolMembership,
+} from "../models/school.js";
+
+async function requireAdmin(schoolId: string, userId: string) {
+  const membership = await findActiveSchoolAdminMembership(schoolId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only school admins can manage tags",
+    });
+  }
+}
+
+async function requireMember(schoolId: string, userId: string) {
+  const membership = await findSchoolMembership(schoolId, userId);
+  if (!membership || membership.status !== "ACTIVE") {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You aren't a member of this institution",
+    });
+  }
+  return membership;
+}
+
+export async function listTags(
+  userId: string,
+  input: { schoolId: string; departmentId?: string | null }
+) {
+  await requireMember(input.schoolId, userId);
+  return listTagsForSchool(input.schoolId, {
+    departmentId: input.departmentId,
+  });
+}
+
+export async function createTagRecord(
+  userId: string,
+  input: {
+    schoolId: string;
+    departmentId?: string | null;
+    name: string;
+    color?: string;
+  }
+) {
+  await requireAdmin(input.schoolId, userId);
+  if (input.departmentId) {
+    const dept = await prisma.department.findUnique({
+      where: { id: input.departmentId },
+      select: { schoolId: true },
+    });
+    if (!dept || dept.schoolId !== input.schoolId) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "Department does not belong to this institution",
+      });
+    }
+  }
+  return createTag(input);
+}
+
+export async function updateTagRecord(
+  userId: string,
+  input: {
+    tagId: string;
+    name?: string;
+    color?: string;
+    departmentId?: string | null;
+  }
+) {
+  const tag = await getTag(input.tagId);
+  if (!tag) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Tag not found" });
+  }
+  await requireAdmin(tag.schoolId, userId);
+  if (input.departmentId) {
+    const dept = await prisma.department.findUnique({
+      where: { id: input.departmentId },
+      select: { schoolId: true },
+    });
+    if (!dept || dept.schoolId !== tag.schoolId) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "Department does not belong to this institution",
+      });
+    }
+  }
+  return updateTag(input.tagId, {
+    name: input.name,
+    color: input.color,
+    departmentId: input.departmentId,
+  });
+}
+
+export async function deleteTagRecord(userId: string, tagId: string) {
+  const tag = await getTag(tagId);
+  if (!tag) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Tag not found" });
+  }
+  await requireAdmin(tag.schoolId, userId);
+  await deleteTag(tagId);
+  return { success: true };
+}
+
+async function ensureTargetInScope(
+  schoolId: string,
+  target: TagTarget,
+  targetId: string
+) {
+  switch (target) {
+    case "USER": {
+      const inSchool = await prisma.schoolMembership.findFirst({
+        where: { schoolId, userId: targetId, status: "ACTIVE" },
+        select: { id: true },
+      });
+      if (!inSchool) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "User is not in this institution",
+        });
+      }
+      return;
+    }
+    case "CLASS": {
+      const inSchool = await prisma.class.findFirst({
+        where: { id: targetId, schoolId },
+        select: { id: true },
+      });
+      if (!inSchool) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "Class is not in this institution",
+        });
+      }
+      return;
+    }
+    case "RUBRIC": {
+      const inSchool = await prisma.markScheme.findFirst({
+        where: {
+          id: targetId,
+          OR: [
+            { class: { schoolId } },
+            { department: { schoolId } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!inSchool) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "Rubric is not in this institution",
+        });
+      }
+      return;
+    }
+    case "BOUNDARY": {
+      const inSchool = await prisma.gradingBoundary.findFirst({
+        where: {
+          id: targetId,
+          OR: [
+            { class: { schoolId } },
+            { department: { schoolId } },
+          ],
+        },
+        select: { id: true },
+      });
+      if (!inSchool) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "Boundary is not in this institution",
+        });
+      }
+      return;
+    }
+  }
+}
+
+export async function attachTag(
+  userId: string,
+  input: { tagId: string; target: TagTarget; targetId: string }
+) {
+  const tag = await getTag(input.tagId);
+  if (!tag) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Tag not found" });
+  }
+  await requireMember(tag.schoolId, userId);
+  await ensureTargetInScope(tag.schoolId, input.target, input.targetId);
+  return attachTagToTarget(input);
+}
+
+export async function detachTag(
+  userId: string,
+  input: { tagId: string; target: TagTarget; targetId: string }
+) {
+  const tag = await getTag(input.tagId);
+  if (!tag) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Tag not found" });
+  }
+  await requireMember(tag.schoolId, userId);
+  return detachTagFromTarget(input);
+}
+
+export async function getAttachedTags(
+  userId: string,
+  input: { target: TagTarget; targetId: string }
+) {
+  const tags = await listTagsAttachedTo(input.target, input.targetId);
+  if (tags[0]) {
+    await requireMember(tags[0].schoolId, userId);
+  }
+  return tags;
+}

package/src/utils/aiUser.ts

@@ -26,7 +26,6 @@ export async function ensureAIUserExists(): Promise<void> {
         email: 'ai@studious-lms.com',
         password: 'ai-system-user', // Not used for login
         verified: true,
-        role: 'NONE', // Special role for AI
         profile: {
           create: {
             displayName: 'AI Assistant',

package/tests/integration/routers/conversation.test.ts

@@ -1,4 +1,4 @@
-import { test, expect, describe, beforeAll } from 'vitest';
+import { test, expect, describe, beforeAll, afterAll } from 'vitest';
 import { prisma } from '../../../src/lib/prisma';
 import { user1Caller, user2Caller, user3Caller } from '../setup';
 import { expectUnauth } from '../helpers';
@@ -7,16 +7,19 @@ describe('Conversation Router', () => {
   let dmConversation: any;
   let groupConversation: any;
   let user1Id: string;
+  let user2Id: string;
   let user3Id: string;
   let hideConversationCounter = 0;
 
   beforeAll(async () => {
-    const [user1Profile, user3Profile] = await Promise.all([
+    const [user1Profile, user2Profile, user3Profile] = await Promise.all([
       user1Caller.user.getProfile(),
+      user2Caller.user.getProfile(),
       user3Caller.user.getProfile(),
     ]);
 
     user1Id = user1Profile.id;
+    user2Id = user2Profile.id;
     user3Id = user3Profile.id;
   });
 
@@ -89,6 +92,122 @@ describe('Conversation Router', () => {
     });
   });
 
+  describe('searchMembers', () => {
+    let schoolId: string;
+    let previousUser2DisplayName: string | null = null;
+    let user2ProfileExisted = false;
+
+    beforeAll(async () => {
+      const existingProfile = await prisma.userProfile.findUnique({
+        where: { userId: user2Id },
+        select: { displayName: true },
+      });
+      user2ProfileExisted = Boolean(existingProfile);
+      previousUser2DisplayName = existingProfile?.displayName ?? null;
+
+      const school = await prisma.school.create({
+        data: {
+          name: 'Conversation Search School',
+          memberships: {
+            create: [
+              { userId: user1Id, role: 'TEACHER', status: 'ACTIVE' },
+              { userId: user2Id, role: 'STUDENT', status: 'ACTIVE' },
+            ],
+          },
+        },
+      });
+      schoolId = school.id;
+
+      await prisma.userProfile.upsert({
+        where: { userId: user2Id },
+        update: { displayName: 'Searchable Student' },
+        create: { userId: user2Id, displayName: 'Searchable Student' },
+      });
+    });
+
+    test('should search active institution members by username', async () => {
+      const results = await user1Caller.conversation.searchMembers({
+        query: 'testuser2',
+      });
+
+      expect(results.map((user) => user.id)).toContain(user2Id);
+      expect(results.map((user) => user.id)).not.toContain(user1Id);
+      expect(results.map((user) => user.id)).not.toContain(user3Id);
+    });
+
+    test('should not search active institution members for one-character queries', async () => {
+      const results = await user1Caller.conversation.searchMembers({
+        query: 't',
+      });
+
+      expect(results).toEqual([]);
+    });
+
+    test('should search active institution members by display name', async () => {
+      const results = await user1Caller.conversation.searchMembers({
+        query: 'searchable',
+      });
+
+      expect(results).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            id: user2Id,
+            username: 'testuser2',
+            profile: expect.objectContaining({
+              displayName: 'Searchable Student',
+            }),
+          }),
+        ]),
+      );
+    });
+
+    test('should not expose users outside the requester institution', async () => {
+      const results = await user1Caller.conversation.searchMembers({
+        query: 'testuser3',
+      });
+
+      expect(results).toEqual([]);
+    });
+
+    test('should not expose inactive members from the requester institution', async () => {
+      await prisma.schoolMembership.create({
+        data: {
+          schoolId,
+          userId: user3Id,
+          role: 'STUDENT',
+          status: 'INACTIVE',
+        },
+      });
+
+      const results = await user1Caller.conversation.searchMembers({
+        query: 'testuser3',
+      });
+
+      expect(results).toEqual([]);
+    });
+
+    test('should return no institution search results for users without an active school', async () => {
+      const results = await user3Caller.conversation.searchMembers({
+        query: 'testuser1',
+      });
+
+      expect(results).toEqual([]);
+    });
+
+    afterAll(async () => {
+      if (user2ProfileExisted) {
+        await prisma.userProfile.update({
+          where: { userId: user2Id },
+          data: { displayName: previousUser2DisplayName },
+        });
+      } else {
+        await prisma.userProfile.deleteMany({ where: { userId: user2Id } });
+      }
+
+      await prisma.school.delete({ where: { id: schoolId } });
+    });
+  });
+
   describe('get', () => {
     test('should get conversation by ID', async () => {
       const conversation = await user1Caller.conversation.get({