@studious-lms/server 1.7.0 → 1.8.0

package/src/services/folder.ts

@@ -1,316 +1,389 @@
 /**
- * Folder service – CRUD for class folders, file uploads, and folder hierarchy.
+ * Folder service — single source of truth for folders across every scope.
+ *
+ * A `Folder` can live inside one of four scopes (see `models/cloudStorage.ts`):
+ * class files, school storage, school documents, or a user's personal storage.
+ * Permissions and ownership are derived from the scope by walking up the tree
+ * to the root, so callers can either pass a `scope` (when there is no folder
+ * id yet, e.g. browsing the root) or just a `folderId` (everything else).
+ *
+ * The class files page and the global cloud-storage view both consume these
+ * endpoints — no duplicate routers.
  */
 import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
 import {
-  findClassWithTeacher,
+  CloudScope,
+  createSubFolder,
+  deleteFolderById,
   findFolderById,
-  findOrCreateRootFolder,
-  createFolder,
   findFolderWithContents,
-  findChildFolders,
-  findRootFolderWithContents,
-  findFolderByIdWithCount,
-  deleteFolderById,
-  updateFolderParent,
-  updateFolder,
-  findFolderByIdForTraversal,
-} from "../models/folder.js";
-import { createDirectUploadFiles } from "../lib/fileUpload.js";
+  findOrCreateScopeRoot,
+  listFolderBreadcrumbs,
+  renameFolder,
+  resolveFolderScope,
+} from "../models/cloudStorage.js";
+import {
+  createDirectUploadFiles,
+  type DirectFileData,
+  confirmDirectUpload,
+} from "../lib/fileUpload.js";
 
-/** Create a folder in a class. Teacher-only. */
-export async function createFolderRecord(
-  userId: string,
-  input: {
-    classId: string;
-    name: string;
-    parentFolderId?: string | null;
-    color?: string;
-  }
-) {
-  const classData = await findClassWithTeacher(input.classId, userId);
-  if (!classData) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Class not found or you are not a teacher",
-    });
-  }
+type AccessLevel = "READ" | "WRITE";
 
-  let parentFolderId = input.parentFolderId;
-  if (!parentFolderId) {
-    const root = await findOrCreateRootFolder(input.classId);
-    parentFolderId = root.id;
-  } else {
-    const parentFolder = await findFolderById(parentFolderId);
-    if (!parentFolder) {
-      throw new TRPCError({
-        code: "NOT_FOUND",
-        message: "Parent folder not found",
+interface AccessResult {
+  scope: CloudScope;
+  canWrite: boolean;
+}
+
+async function requireScopeAccess(
+  userId: string,
+  scope: CloudScope,
+  level: AccessLevel
+): Promise<AccessResult> {
+  switch (scope.kind) {
+    case "CLASS": {
+      const classData = await prisma.class.findFirst({
+        where: { id: scope.classId },
+        select: {
+          id: true,
+          schoolId: true,
+          teachers: { where: { id: userId }, select: { id: true } },
+          students: { where: { id: userId }, select: { id: true } },
+        },
       });
+      if (!classData) {
+        throw new TRPCError({ code: "NOT_FOUND", message: "Class not found" });
+      }
+      const isTeacher = classData.teachers.length > 0;
+      const isStudent = classData.students.length > 0;
+      const isSchoolAdmin = classData.schoolId
+        ? Boolean(
+            await prisma.schoolMembership.findFirst({
+              where: {
+                schoolId: classData.schoolId,
+                userId,
+                role: "ADMIN",
+                status: "ACTIVE",
+              },
+              select: { id: true },
+            })
+          )
+        : false;
+      if (!isTeacher && !isStudent && !isSchoolAdmin) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "You don't have access to this class",
+        });
+      }
+      const canWrite = isTeacher || isSchoolAdmin;
+      if (level === "WRITE" && !canWrite) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Only class teachers can modify class files",
+        });
+      }
+      return { scope, canWrite };
+    }
+    case "SCHOOL_STORAGE": {
+      const membership = await prisma.schoolMembership.findFirst({
+        where: { schoolId: scope.schoolId, userId, status: "ACTIVE" },
+        select: { role: true },
+      });
+      if (!membership) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "You aren't a member of this institution",
+        });
+      }
+      const canWrite =
+        membership.role === "ADMIN" || membership.role === "TEACHER";
+      if (level === "WRITE" && !canWrite) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Only teachers and admins can modify institution storage",
+        });
+      }
+      return { scope, canWrite };
+    }
+    case "PERSONAL": {
+      if (scope.userId !== userId) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "You can only access your own personal storage",
+        });
+      }
+      return { scope, canWrite: true };
     }
   }
-
-  return createFolder({
-    name: input.name,
-    parentFolderId,
-    color: input.color,
-  });
 }
 
-/** Get folder with its contents (subfolders and files). */
-export async function getFolder(folderId: string) {
-  const folder = await findFolderWithContents(folderId);
-  if (!folder) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
-    });
+export async function requireFolderAccess(
+  userId: string,
+  folderId: string,
+  level: AccessLevel
+) {
+  const scope = await resolveFolderScope(folderId);
+  if (!scope) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
   }
-  return folder;
-}
-
-export async function getChildFolders(classId: string) {
-  const root = await findOrCreateRootFolder(classId);
-  return findChildFolders(root.id);
-}
-
-export async function getFolderChildren(folderId: string, classId: string) {
-  return findChildFolders(folderId);
+  return requireScopeAccess(userId, scope, level);
 }
 
-export async function getRootFolder(classId: string) {
-  const root = await findOrCreateRootFolder(classId);
-  const rootWithContents = await findRootFolderWithContents(classId);
-  if (!rootWithContents) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Root folder not found",
-    });
+function scopesEqual(a: CloudScope, b: CloudScope): boolean {
+  if (a.kind !== b.kind) return false;
+  switch (a.kind) {
+    case "CLASS":
+      return a.classId === (b as typeof a).classId;
+    case "SCHOOL_STORAGE":
+      return a.schoolId === (b as typeof a).schoolId;
+    case "PERSONAL":
+      return a.userId === (b as typeof a).userId;
   }
-  return rootWithContents;
 }
 
-export async function uploadFilesToFolder(
+/** Browse a folder. Pass `folderId` to drill into a specific folder, or a `scope` to land on its root. */
+export async function browseFolder(
   userId: string,
-  classId: string,
-  folderId: string,
-  files: { name: string; type: string; size: number }[]
+  input: { folderId: string } | { scope: CloudScope }
 ) {
-  const classData = await findClassWithTeacher(classId, userId);
-  if (!classData) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Class not found or you are not a teacher",
-    });
+  let scope: CloudScope;
+  let folderId: string | undefined;
+
+  if ("folderId" in input) {
+    folderId = input.folderId;
+    const resolved = await resolveFolderScope(input.folderId);
+    if (!resolved) {
+      throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
+    }
+    scope = resolved;
+  } else {
+    scope = input.scope;
   }
 
-  const folder = await findFolderById(folderId);
+  const access = await requireScopeAccess(userId, scope, "READ");
+  const targetId = folderId ?? (await findOrCreateScopeRoot(scope)).id;
+
+  const [folder, breadcrumbs] = await Promise.all([
+    findFolderWithContents(targetId),
+    listFolderBreadcrumbs(targetId),
+  ]);
+
   if (!folder) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
-    });
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
   }
 
-  const uploadedFiles = await createDirectUploadFiles(files, userId, folderId);
   return {
-    success: true,
-    uploadedCount: uploadedFiles.length,
+    folder,
+    breadcrumbs,
+    canWrite: access.canWrite,
+    scope,
   };
 }
 
-export async function deleteFolderRecord(
+export async function getRootFolder(userId: string, scope: CloudScope) {
+  const result = await browseFolder(userId, { scope });
+  return result.folder;
+}
+
+export async function getFolder(userId: string, folderId: string) {
+  const result = await browseFolder(userId, { folderId });
+  return result.folder;
+}
+
+export async function getFolderBreadcrumbs(userId: string, folderId: string) {
+  await requireFolderAccess(userId, folderId, "READ");
+  return listFolderBreadcrumbs(folderId);
+}
+
+export async function getFolderParents(userId: string, folderId: string) {
+  // Permission: user can read this folder.
+  await requireFolderAccess(userId, folderId, "READ");
+  const breadcrumbs = await listFolderBreadcrumbs(folderId);
+  // Existing API returned full folder records — re-fetch them.
+  return Promise.all(
+    breadcrumbs.map((b) => findFolderById(b.id))
+  );
+}
+
+export async function createFolderRecord(
   userId: string,
-  classId: string,
-  folderId: string
+  input: {
+    name: string;
+    parentFolderId?: string | null;
+    color?: string;
+    scope?: CloudScope;
+  }
 ) {
-  const classData = await findClassWithTeacher(classId, userId);
-  if (!classData) {
-    throw new TRPCError({
-      code: "FORBIDDEN",
-      message: "Class not found or you are not a teacher",
-    });
+  let parentId: string;
+  if (input.parentFolderId) {
+    parentId = input.parentFolderId;
+    await requireFolderAccess(userId, parentId, "WRITE");
+  } else {
+    if (!input.scope) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "scope is required when parentFolderId is omitted",
+      });
+    }
+    await requireScopeAccess(userId, input.scope, "WRITE");
+    parentId = (await findOrCreateScopeRoot(input.scope)).id;
   }
+  return createSubFolder({
+    name: input.name.trim(),
+    parentFolderId: parentId,
+    color: input.color,
+  });
+}
 
-  const folder = await findFolderByIdWithCount(folderId);
+export async function updateFolderRecord(
+  userId: string,
+  input: { folderId: string; name?: string; color?: string }
+) {
+  const folder = await findFolderById(input.folderId);
   if (!folder) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
+  }
+  if (!folder.parentFolderId) {
     throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
+      code: "BAD_REQUEST",
+      message: "Cannot rename a root folder",
     });
   }
+  await requireFolderAccess(userId, input.folderId, "WRITE");
+  return renameFolder(
+    input.folderId,
+    input.name?.trim() ?? folder.name,
+    input.color
+  );
+}
 
-  // Verify folder belongs to class (traverse to root)
-  let currentId: string | null = folderId;
-  let belongsToClass = false;
-  while (currentId) {
-    const current = await findFolderByIdForTraversal(currentId);
-    if (!current) break;
-    if (current.classId === classId) {
-      belongsToClass = true;
-      break;
-    }
-    currentId = current.parentFolderId;
+export async function deleteFolder(userId: string, folderId: string) {
+  const folder = await findFolderById(folderId);
+  if (!folder) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
   }
-  if (!belongsToClass) {
+  if (!folder.parentFolderId) {
     throw new TRPCError({
-      code: "FORBIDDEN",
-      message: "Folder does not belong to this class",
+      code: "BAD_REQUEST",
+      message: "Cannot delete a root folder",
     });
   }
-
+  await requireFolderAccess(userId, folderId, "WRITE");
   await deleteFolderById(folderId);
-  return {
-    success: true,
-    deletedFiles: folder._count.files,
-    deletedFolders: folder._count.childFolders + 1,
-  };
+  return { success: true };
 }
 
 export async function moveFolder(
   userId: string,
-  folderId: string,
-  targetParentFolderId: string,
-  classId: string
+  input: { folderId: string; targetParentFolderId: string }
 ) {
-  const classData = await findClassWithTeacher(classId, userId);
-  if (!classData) {
+  if (input.folderId === input.targetParentFolderId) {
     throw new TRPCError({
-      code: "FORBIDDEN",
-      message: "You must be a teacher of this class to move folders",
+      code: "BAD_REQUEST",
+      message: "Cannot move a folder into itself",
     });
   }
-
-  const folder = await findFolderById(folderId);
-  if (!folder) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
-    });
+  const [sourceScope, targetScope] = await Promise.all([
+    resolveFolderScope(input.folderId),
+    resolveFolderScope(input.targetParentFolderId),
+  ]);
+  if (!sourceScope || !targetScope) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
   }
-
-  if (!folder.parentFolderId) {
+  if (!scopesEqual(sourceScope, targetScope)) {
     throw new TRPCError({
       code: "BAD_REQUEST",
-      message: "Cannot move the root folder",
+      message: "Cannot move folders between scopes",
     });
   }
+  await requireScopeAccess(userId, sourceScope, "WRITE");
 
-  if (targetParentFolderId) {
-    const targetParent = await findFolderByIdForTraversal(targetParentFolderId);
-    if (!targetParent) {
-      throw new TRPCError({
-        code: "NOT_FOUND",
-        message: "Target parent folder not found",
-      });
-    }
-
-    if (targetParentFolderId === folderId) {
+  // Don't let a folder land under one of its own descendants.
+  let cursor: string | null = input.targetParentFolderId;
+  while (cursor) {
+    if (cursor === input.folderId) {
       throw new TRPCError({
         code: "BAD_REQUEST",
-        message: "Cannot move a folder into itself",
+        message: "Cannot move a folder into its own descendant",
       });
     }
-
-    let currentParent: typeof targetParent | null = targetParent;
-    while (currentParent?.parentFolderId) {
-      if (currentParent.parentFolderId === folderId) {
-        throw new TRPCError({
-          code: "BAD_REQUEST",
-          message: "Cannot move a folder into its descendant",
-        });
-      }
-      currentParent = await findFolderByIdForTraversal(currentParent.parentFolderId);
-      if (!currentParent) break;
-    }
-  }
-
-  return updateFolderParent(folderId, targetParentFolderId);
-}
-
-export async function updateFolderRecord(
-  folderId: string,
-  name: string,
-  color: string | undefined,
-  classId: string
-) {
-  const folder = await findFolderById(folderId);
-  if (!folder) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
-    });
-  }
-
-  if (!name.trim()) {
-    throw new TRPCError({
-      code: "BAD_REQUEST",
-      message: "Folder name cannot be empty",
+    const node = await prisma.folder.findUnique({
+      where: { id: cursor },
+      select: { parentFolderId: true },
     });
+    cursor = node?.parentFolderId ?? null;
   }
 
-  return updateFolder(folderId, {
-    name: name.trim(),
-    ...(color && { color }),
+  await prisma.folder.update({
+    where: { id: input.folderId },
+    data: { parentFolderId: input.targetParentFolderId },
   });
-}
-
-export async function getFolderParents(folderId: string) {
-  const parents: Awaited<ReturnType<typeof findFolderByIdForTraversal>>[] = [];
-  let currentId: string | null = folderId;
-
-  while (currentId) {
-    const folder = await findFolderByIdForTraversal(currentId);
-    if (!folder) break;
-    parents.push(folder);
-    currentId = folder.parentFolderId;
-  }
-
-  return parents;
+  return { success: true };
 }
 
 export async function getFolderUploadUrls(
   userId: string,
-  classId: string,
-  folderId: string,
-  files: { name: string; type: string; size: number }[]
+  input: { folderId: string; files: DirectFileData[] }
 ) {
-  const classData = await findClassWithTeacher(classId, userId);
-  if (!classData) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Class not found or you are not a teacher",
-    });
-  }
+  await requireFolderAccess(userId, input.folderId, "WRITE");
+  return createDirectUploadFiles(input.files, userId, input.folderId);
+}
 
-  const folder = await findFolderById(folderId);
-  if (!folder) {
-    throw new TRPCError({
-      code: "NOT_FOUND",
-      message: "Folder not found",
-    });
-  }
+export async function confirmFolderUpload(
+  _userId: string,
+  input: { fileId: string; uploadSuccess: boolean; errorMessage?: string }
+) {
+  // Permission was already checked at upload-url issuance — the file record
+  // exists with PENDING status, and the user holds the session id needed to
+  // PUT bytes. Confirming flips status, so we just trust the call.
+  await confirmDirectUpload(
+    input.fileId,
+    input.uploadSuccess,
+    input.errorMessage
+  );
+  return { success: true };
+}
 
-  let currentFolder: typeof folder | null = folder;
-  let belongsToClass = false;
-  while (currentFolder) {
-    if (currentFolder.classId === classId) {
-      belongsToClass = true;
-      break;
-    }
-    if (currentFolder.parentFolderId) {
-      currentFolder = await findFolderByIdForTraversal(currentFolder.parentFolderId);
-    } else {
-      break;
-    }
-  }
+/** What scopes can this user pick from in cloud-storage UIs? */
+export async function listUserScopes(userId: string) {
+  const memberships = await prisma.schoolMembership.findMany({
+    where: { userId, status: "ACTIVE" },
+    select: {
+      role: true,
+      school: {
+        select: { id: true, name: true, logoId: true },
+      },
+    },
+    orderBy: { createdAt: "asc" },
+  });
 
-  if (!belongsToClass) {
-    throw new TRPCError({
-      code: "FORBIDDEN",
-      message: "Folder does not belong to this class",
-    });
-  }
+  const classes = await prisma.class.findMany({
+    where: {
+      OR: [
+        { teachers: { some: { id: userId } } },
+        { students: { some: { id: userId } } },
+      ],
+    },
+    select: {
+      id: true,
+      name: true,
+      subject: true,
+      section: true,
+      color: true,
+      schoolId: true,
+    },
+    orderBy: { name: "asc" },
+  });
 
-  return createDirectUploadFiles(files, userId, folderId);
+  return {
+    personal: { kind: "PERSONAL" as const, userId },
+    schools: memberships.map((m) => ({
+      id: m.school.id,
+      name: m.school.name,
+      logoId: m.school.logoId,
+      role: m.role,
+    })),
+    classes,
+  };
 }

package/src/services/labChat.ts

@@ -25,6 +25,7 @@ import {
   claimMessageAttachments,
   ensureMessageHasContentOrAttachments,
 } from "./message.js";
+import { messageFileSelect } from "../models/message.js";
 
 /** Create a lab chat with conversation and teacher members. Broadcasts via Pusher. */
 export async function createLabChat(
@@ -307,7 +308,7 @@ export async function postToLabChat(
           },
         },
         attachments: {
-          select: { id: true, name: true, type: true },
+          select: messageFileSelect,
         },
       },
     });