@studious-lms/server 1.7.0 → 1.9.0

package/dist/services/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sources":["services/permissions.ts"],"sourceRoot":"/","sourcesContent":["/**\n * Permissions resolver — single source of truth for \"can user U do X to target T?\"\n *\n * Sits on top of the existing scope-derived defaults (class members, school\n * members, personal owner) computed in `getScopeDefault`. Explicit `Permission`\n * rows are *additive* — they only ever grant more access, never less. There is\n * no concept of a \"deny\" rule by design; revocation = delete the row.\n *\n * Resolution order for `requireFolderAccess(user, folder, level)`:\n *   1. Scope default (class member / school member / personal owner)\n *   2. Direct grant on the folder, OR inherited grant on any ancestor\n *      (walk up to scope root)\n *   First match wins; otherwise FORBIDDEN.\n *\n * `requireFileAccess` resolves the file's parent folder and delegates. Files\n * inherit from their folder in v1; per-file grants are deliberately deferred\n * (forward-compatible additive migration when needed).\n */\nimport { TRPCError } from \"@trpc/server\";\nimport type {\n  PermissionLevel,\n  PermissionPrincipalType,\n  Prisma,\n} from \"@prisma/client\";\nimport { prisma } from \"../lib/prisma.js\";\nimport {\n  type CloudScope,\n  resolveFolderScope,\n} from \"../models/cloudStorage.js\";\n\nexport type AccessLevel = \"READ\" | \"WRITE\";\n\n/**\n * The set of \"audiences\" a user belongs to that an explicit grant can match.\n * Generated once per request via `expandUserPrincipals` and threaded through\n * the resolver.\n */\nexport interface UserPrincipals {\n  userId: string;\n  tagIds: string[];\n  classTeacherIds: string[];\n  classStudentIds: string[];\n  /** Union of teacher + student class memberships (i.e. all CLASS principals). */\n  classIds: string[];\n  departmentIds: string[];\n  /** Active school memberships only. */\n  schoolIds: string[];\n}\n\n/**\n * Build the audience set for a user. Cheap (5 queries, all id-only) but worth\n * caching per request — most permission checks in a single tRPC call hit this.\n */\nexport async function expandUserPrincipals(\n  userId: string\n): Promise<UserPrincipals> {\n  const [user, asTeacher, asStudent, departments, schoolMemberships] =\n    await Promise.all([\n      prisma.user.findUnique({\n        where: { id: userId },\n        select: { tags: { select: { id: true } } },\n      }),\n      prisma.class.findMany({\n        where: { teachers: { some: { id: userId } } },\n        select: { id: true },\n      }),\n      prisma.class.findMany({\n        where: { students: { some: { id: userId } } },\n        select: { id: true },\n      }),\n      prisma.department.findMany({\n        where: { members: { some: { id: userId } } },\n        select: { id: true },\n      }),\n      prisma.schoolMembership.findMany({\n        where: { userId, status: \"ACTIVE\" },\n        select: { schoolId: true },\n      }),\n    ]);\n\n  const classTeacherIds = asTeacher.map((c) => c.id);\n  const classStudentIds = asStudent.map((c) => c.id);\n  return {\n    userId,\n    tagIds: user?.tags.map((t) => t.id) ?? [],\n    classTeacherIds,\n    classStudentIds,\n    classIds: Array.from(new Set([...classTeacherIds, ...classStudentIds])),\n    departmentIds: departments.map((d) => d.id),\n    schoolIds: schoolMemberships.map((m) => m.schoolId),\n  };\n}\n\n/**\n * The principal-side `where` clause that matches any explicit grant whose\n * principal applies to this user. CLASS / CLASS_TEACHERS / CLASS_STUDENTS all\n * use `classId` but with different `principalType` values, so we have to fan\n * those out into three OR branches.\n */\nfunction principalsWhere(\n  principals: UserPrincipals\n): Prisma.PermissionWhereInput {\n  const ors: Prisma.PermissionWhereInput[] = [\n    { principalType: \"USER\", userId: principals.userId },\n  ];\n  if (principals.tagIds.length) {\n    ors.push({ principalType: \"TAG\", tagId: { in: principals.tagIds } });\n  }\n  if (principals.classIds.length) {\n    ors.push({\n      principalType: \"CLASS\",\n      classId: { in: principals.classIds },\n    });\n  }\n  if (principals.classTeacherIds.length) {\n    ors.push({\n      principalType: \"CLASS_TEACHERS\",\n      classId: { in: principals.classTeacherIds },\n    });\n  }\n  if (principals.classStudentIds.length) {\n    ors.push({\n      principalType: \"CLASS_STUDENTS\",\n      classId: { in: principals.classStudentIds },\n    });\n  }\n  if (principals.departmentIds.length) {\n    ors.push({\n      principalType: \"DEPARTMENT\",\n      departmentId: { in: principals.departmentIds },\n    });\n  }\n  if (principals.schoolIds.length) {\n    ors.push({\n      principalType: \"SCHOOL\",\n      schoolId: { in: principals.schoolIds },\n    });\n  }\n  return { OR: ors };\n}\n\nfunction levelSatisfies(\n  granted: PermissionLevel,\n  required: AccessLevel\n): boolean {\n  if (required === \"READ\") return granted === \"READ\" || granted === \"WRITE\";\n  return granted === \"WRITE\";\n}\n\n/** Walk up to the scope root, collecting folder ids visited along the way (inclusive). */\nasync function findAncestorIds(folderId: string): Promise<string[]> {\n  const ids: string[] = [];\n  let cursor: string | null = folderId;\n  let visits = 0;\n  while (cursor && visits < 64) {\n    ids.push(cursor);\n    const node: { parentFolderId: string | null } | null =\n      await prisma.folder.findUnique({\n        where: { id: cursor },\n        select: { parentFolderId: true },\n      });\n    if (!node) break;\n    cursor = node.parentFolderId;\n    visits += 1;\n  }\n  return ids;\n}\n\nexport { findAncestorIds };\n\n/**\n * Compute the scope default for a user — i.e. the access level the existing\n * scope-derived rules grant, *before* any explicit ACL is consulted.\n *\n * Mirrors the logic that used to live in `requireScopeAccess` in folder.ts.\n * Returns \"WRITE\" / \"READ\" / null.\n */\nexport async function getScopeDefault(\n  userId: string,\n  scope: CloudScope\n): Promise<AccessLevel | null> {\n  switch (scope.kind) {\n    case \"CLASS\": {\n      const classData = await prisma.class.findFirst({\n        where: { id: scope.classId },\n        select: {\n          id: true,\n          schoolId: true,\n          teachers: { where: { id: userId }, select: { id: true } },\n          students: { where: { id: userId }, select: { id: true } },\n        },\n      });\n      if (!classData) return null;\n      if (classData.teachers.length > 0) return \"WRITE\";\n      const isSchoolAdmin = classData.schoolId\n        ? Boolean(\n            await prisma.schoolMembership.findFirst({\n              where: {\n                schoolId: classData.schoolId,\n                userId,\n                role: \"ADMIN\",\n                status: \"ACTIVE\",\n              },\n              select: { id: true },\n            })\n          )\n        : false;\n      if (isSchoolAdmin) return \"WRITE\";\n      if (classData.students.length > 0) return \"READ\";\n      return null;\n    }\n    case \"SCHOOL_STORAGE\": {\n      const membership = await prisma.schoolMembership.findFirst({\n        where: { schoolId: scope.schoolId, userId, status: \"ACTIVE\" },\n        select: { role: true },\n      });\n      if (!membership) return null;\n      if (membership.role === \"ADMIN\" || membership.role === \"TEACHER\")\n        return \"WRITE\";\n      return \"READ\";\n    }\n    case \"PERSONAL\": {\n      return scope.userId === userId ? \"WRITE\" : null;\n    }\n  }\n}\n\n/**\n * Does any of the given folder ids carry a grant matching this user at >=\n * `level`? Returns the matching folder id (highest-priority for caller use)\n * or null.\n */\nasync function findGrantOnFolders(\n  folderIds: string[],\n  principals: UserPrincipals,\n  level: AccessLevel\n): Promise<string | null> {\n  if (!folderIds.length) return null;\n  const grant = await prisma.permission.findFirst({\n    where: {\n      folderId: { in: folderIds },\n      ...principalsWhere(principals),\n      ...(level === \"WRITE\" ? { level: \"WRITE\" } : {}),\n    },\n    select: { folderId: true },\n  });\n  return grant?.folderId ?? null;\n}\n\nexport interface AccessResult {\n  scope: CloudScope | null;\n  scopeDefault: AccessLevel | null;\n  /** Truthy if the resolver returned because of an explicit grant (folder or file). */\n  viaGrant: boolean;\n}\n\n/**\n * Permission gate for folder-scoped operations. Throws TRPCError on denial,\n * returns the scope (and which path granted access) on success.\n *\n * `opts.mutatesSelf` (Drive-style guard): when true, the action targets the\n * folder *itself* — rename, delete, move-this-folder. Explicit grants do NOT\n * authorize these; only scope-default WRITE does. This means a teacher sharing\n * \"Math Resources\" with the parents tag can let parents read/edit children of\n * the folder, but parents cannot rename or delete the share root. Mutations\n * targeting *children* of the folder (uploads, sub-folders, child renames)\n * pass `mutatesSelf: false` and flow through the normal grant + ancestor +\n * scope-default path.\n */\nexport async function requireFolderAccess(\n  userId: string,\n  folderId: string,\n  level: AccessLevel,\n  opts: { mutatesSelf?: boolean } = {}\n): Promise<AccessResult> {\n  const scope = await resolveFolderScope(folderId);\n  if (!scope) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  const scopeDefault = await getScopeDefault(userId, scope);\n  if (scopeDefault && levelSatisfies(scopeDefault as PermissionLevel, level)) {\n    return { scope, scopeDefault, viaGrant: false };\n  }\n\n  // Mutations of the share root itself are reserved for scope-default WRITE.\n  // Explicit grants don't authorize delete/rename/move-self even at WRITE\n  // level. We've already failed the scope-default branch above, so deny.\n  if (opts.mutatesSelf && level === \"WRITE\") {\n    throw new TRPCError({\n      code: \"FORBIDDEN\",\n      message:\n        \"Only the folder's owner can rename, move, or delete it. \" +\n        \"You can edit its contents.\",\n    });\n  }\n\n  const principals = await expandUserPrincipals(userId);\n  const ancestors = await findAncestorIds(folderId);\n  const grantFolderId = await findGrantOnFolders(ancestors, principals, level);\n  if (grantFolderId) {\n    return { scope, scopeDefault, viaGrant: true };\n  }\n\n  throw new TRPCError({\n    code: \"FORBIDDEN\",\n    message:\n      level === \"WRITE\"\n        ? \"You don't have write access here\"\n        : \"You don't have access to this folder\",\n  });\n}\n\n/**\n * Per-class role check used by file-context handlers (assignment, submission,\n * annotation, announcement, class-draft attachments). Single query.\n */\nasync function userClassRole(\n  userId: string,\n  classId: string\n): Promise<\"TEACHER\" | \"STUDENT\" | \"ADMIN\" | null> {\n  const cls = await prisma.class.findFirst({\n    where: { id: classId },\n    select: {\n      schoolId: true,\n      teachers: { where: { id: userId }, select: { id: true } },\n      students: { where: { id: userId }, select: { id: true } },\n    },\n  });\n  if (!cls) return null;\n  if (cls.teachers.length) return \"TEACHER\";\n  if (cls.schoolId) {\n    const admin = await prisma.schoolMembership.findFirst({\n      where: {\n        schoolId: cls.schoolId,\n        userId,\n        role: \"ADMIN\",\n        status: \"ACTIVE\",\n      },\n      select: { id: true },\n    });\n    if (admin) return \"ADMIN\";\n  }\n  if (cls.students.length) return \"STUDENT\";\n  return null;\n}\n\nconst fileGrant = (level: AccessLevel): AccessResult => ({\n  scope: null,\n  scopeDefault: level,\n  viaGrant: false,\n});\n\n/**\n * Permission gate for file-scoped operations. Dispatches on whichever context\n * relation the file carries, so every kind of file (cloud-storage, chat\n * attachment, assignment / submission / annotation / announcement / class-draft\n * attachment, school logo) gets authorized through one entry point.\n *\n * Resolution order — first match wins:\n *   1. **Owner** — `file.userId === user`. Always WRITE.\n *   2. **Folder-bound** — delegate to `requireFolderAccess` (handles scope\n *      defaults + explicit grants + ancestor inheritance).\n *   3. **Conversation/message attachment** — any conversation member READs;\n *      only the sender (= owner, handled in step 1) WRITEs.\n *   4. **Assignment attachment** — class teacher/admin RW, class student R.\n *   5. **Submission file** — submission's student RW (until grading workflow\n *      locks it down), class teacher/admin R.\n *   6. **Annotation file** — class teacher/admin RW, submission's student R.\n *   7. **Announcement attachment** — class teacher/admin RW, class student R.\n *   8. **Class-draft attachment** — class teacher/admin RW (drafts have no\n *      students yet in practice).\n *   9. **School logo** — any active school member R, school admin W.\n *  10. **Otherwise** (incl. SDP supporting docs) — owner-only fallback already\n *      covered by step 1; deny.\n */\nexport async function requireFileAccess(\n  userId: string,\n  fileId: string,\n  level: AccessLevel\n): Promise<AccessResult> {\n  const file = await prisma.file.findUnique({\n    where: { id: fileId },\n    select: {\n      id: true,\n      userId: true,\n      folderId: true,\n      conversationId: true,\n      assignmentId: true,\n      classDraftId: true,\n      announcementId: true,\n      schoolDevelopementProgramId: true,\n      assignment: { select: { classId: true } },\n      submission: {\n        select: { studentId: true, assignment: { select: { classId: true } } },\n      },\n      annotations: {\n        select: { studentId: true, assignment: { select: { classId: true } } },\n      },\n      announcement: { select: { classId: true } },\n      schools: { select: { id: true } },\n    },\n  });\n  if (!file) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"File not found\" });\n  }\n\n  if (file.userId === userId) {\n    return { scope: null, scopeDefault: \"WRITE\", viaGrant: false };\n  }\n\n  if (file.folderId) {\n    return requireFolderAccess(userId, file.folderId, level);\n  }\n\n  if (file.conversationId) {\n    const member = await prisma.conversationMember.findFirst({\n      where: { conversationId: file.conversationId, userId },\n      select: { id: true },\n    });\n    if (member) {\n      // Non-owners can only read; only the sender (owner, already handled\n      // above) can mutate the attachment record.\n      if (level === \"READ\") return fileGrant(\"READ\");\n    }\n  }\n\n  if (file.assignment?.classId) {\n    const role = await userClassRole(userId, file.assignment.classId);\n    if (role === \"TEACHER\" || role === \"ADMIN\") return fileGrant(\"WRITE\");\n    if (role === \"STUDENT\" && level === \"READ\") return fileGrant(\"READ\");\n  }\n\n  if (file.submission?.assignment?.classId) {\n    if (file.submission.studentId === userId) return fileGrant(\"WRITE\");\n    const role = await userClassRole(userId, file.submission.assignment.classId);\n    if ((role === \"TEACHER\" || role === \"ADMIN\") && level === \"READ\") {\n      return fileGrant(\"READ\");\n    }\n  }\n\n  if (file.annotations?.assignment?.classId) {\n    const role = await userClassRole(\n      userId,\n      file.annotations.assignment.classId\n    );\n    if (role === \"TEACHER\" || role === \"ADMIN\") return fileGrant(\"WRITE\");\n    if (file.annotations.studentId === userId && level === \"READ\") {\n      return fileGrant(\"READ\");\n    }\n  }\n\n  if (file.announcement?.classId) {\n    const role = await userClassRole(userId, file.announcement.classId);\n    if (role === \"TEACHER\" || role === \"ADMIN\") return fileGrant(\"WRITE\");\n    if (role === \"STUDENT\" && level === \"READ\") return fileGrant(\"READ\");\n  }\n\n  if (file.classDraftId) {\n    const role = await userClassRole(userId, file.classDraftId);\n    if (role === \"TEACHER\" || role === \"ADMIN\") return fileGrant(\"WRITE\");\n  }\n\n  if (file.schools.length) {\n    // Files referenced as `School.logo` — readable by any active member of\n    // any school using this file, writable only by an admin of one of them.\n    const schoolIds = file.schools.map((s) => s.id);\n    if (level === \"WRITE\") {\n      const adminMembership = await prisma.schoolMembership.findFirst({\n        where: {\n          schoolId: { in: schoolIds },\n          userId,\n          role: \"ADMIN\",\n          status: \"ACTIVE\",\n        },\n        select: { id: true },\n      });\n      if (adminMembership) return fileGrant(\"WRITE\");\n    } else {\n      const membership = await prisma.schoolMembership.findFirst({\n        where: {\n          schoolId: { in: schoolIds },\n          userId,\n          status: \"ACTIVE\",\n        },\n        select: { id: true },\n      });\n      if (membership) return fileGrant(\"READ\");\n    }\n  }\n\n  throw new TRPCError({\n    code: \"FORBIDDEN\",\n    message:\n      level === \"WRITE\"\n        ? \"You don't have write access to this file\"\n        : \"You don't have access to this file\",\n  });\n}\n\n/**\n * Top-most-grant computation: surface every folder the user has an explicit\n * grant on whose nearest permissioned ancestor the user does *not* also hold a\n * grant on, AND whose scope default does not already grant access. That second\n * filter avoids \"Shared with me\" duplicating things you already see in your\n * normal class/school/personal scopes.\n *\n * Files are not surfaced here — file-level grants are deferred to a future\n * feature; in v1 files inherit from their folder.\n */\nexport async function listSharedWithMe(userId: string): Promise<{\n  folders: { id: string; name: string; color: string | null }[];\n  files: never[];\n}> {\n  const principals = await expandUserPrincipals(userId);\n\n  const grants = await prisma.permission.findMany({\n    where: principalsWhere(principals),\n    select: { id: true, folderId: true },\n  });\n\n  const grantedFolderIds = new Set<string>(\n    grants.map((g) => g.folderId).filter((x): x is string => Boolean(x))\n  );\n\n  const topFolders: { id: string; name: string; color: string | null }[] = [];\n  for (const folderId of grantedFolderIds) {\n    const ancestors = await findAncestorIds(folderId);\n    // Skip self; we want to know if any *strict* ancestor is also granted.\n    const strictAncestors = ancestors.slice(1);\n    const coveredByAncestor = strictAncestors.some((id) =>\n      grantedFolderIds.has(id)\n    );\n    if (coveredByAncestor) continue;\n\n    const scope = await resolveFolderScope(folderId);\n    if (scope) {\n      const scopeDefault = await getScopeDefault(userId, scope);\n      if (scopeDefault) continue;\n    }\n\n    const folder = await prisma.folder.findUnique({\n      where: { id: folderId },\n      select: { id: true, name: true, color: true },\n    });\n    if (folder) topFolders.push(folder);\n  }\n\n  return { folders: topFolders, files: [] };\n}\n\n/* ------------------------------------------------------------------ *\n *  Grant CRUD                                                         *\n * ------------------------------------------------------------------ */\n\nexport type PermissionPrincipalInput =\n  | { kind: \"USER\"; userId: string }\n  | { kind: \"TAG\"; tagId: string }\n  | { kind: \"CLASS\"; classId: string }\n  | { kind: \"CLASS_TEACHERS\"; classId: string }\n  | { kind: \"CLASS_STUDENTS\"; classId: string }\n  | { kind: \"DEPARTMENT\"; departmentId: string }\n  | { kind: \"SCHOOL\"; schoolId: string };\n\n/** Resolve which school an explicit grant target belongs to (for cross-school checks). */\nasync function resolveTargetSchoolId(folderId: string): Promise<string | null> {\n  const scope = await resolveFolderScope(folderId);\n  return scopeSchoolId(scope);\n}\n\nasync function scopeSchoolId(scope: CloudScope | null): Promise<string | null> {\n  if (!scope) return null;\n  switch (scope.kind) {\n    case \"CLASS\": {\n      const c = await prisma.class.findUnique({\n        where: { id: scope.classId },\n        select: { schoolId: true },\n      });\n      return c?.schoolId ?? null;\n    }\n    case \"SCHOOL_STORAGE\":\n      return scope.schoolId;\n    case \"PERSONAL\":\n      return null;\n  }\n}\n\n/** The school a principal lives in (for cross-school leak prevention). */\nasync function principalSchoolId(\n  principal: PermissionPrincipalInput\n): Promise<string | null> {\n  switch (principal.kind) {\n    case \"USER\": {\n      const u = await prisma.user.findUnique({\n        where: { id: principal.userId },\n        select: { schoolId: true },\n      });\n      return u?.schoolId ?? null;\n    }\n    case \"TAG\": {\n      const t = await prisma.tag.findUnique({\n        where: { id: principal.tagId },\n        select: { schoolId: true },\n      });\n      return t?.schoolId ?? null;\n    }\n    case \"CLASS\":\n    case \"CLASS_TEACHERS\":\n    case \"CLASS_STUDENTS\": {\n      const c = await prisma.class.findUnique({\n        where: { id: principal.classId },\n        select: { schoolId: true },\n      });\n      return c?.schoolId ?? null;\n    }\n    case \"DEPARTMENT\": {\n      const d = await prisma.department.findUnique({\n        where: { id: principal.departmentId },\n        select: { schoolId: true },\n      });\n      return d?.schoolId ?? null;\n    }\n    case \"SCHOOL\":\n      return principal.schoolId;\n  }\n}\n\nfunction principalToColumns(principal: PermissionPrincipalInput): {\n  principalType: PermissionPrincipalType;\n  userId: string | null;\n  tagId: string | null;\n  classId: string | null;\n  departmentId: string | null;\n  schoolId: string | null;\n} {\n  const base = {\n    userId: null as string | null,\n    tagId: null as string | null,\n    classId: null as string | null,\n    departmentId: null as string | null,\n    schoolId: null as string | null,\n  };\n  switch (principal.kind) {\n    case \"USER\":\n      return { ...base, principalType: \"USER\", userId: principal.userId };\n    case \"TAG\":\n      return { ...base, principalType: \"TAG\", tagId: principal.tagId };\n    case \"CLASS\":\n      return { ...base, principalType: \"CLASS\", classId: principal.classId };\n    case \"CLASS_TEACHERS\":\n      return {\n        ...base,\n        principalType: \"CLASS_TEACHERS\",\n        classId: principal.classId,\n      };\n    case \"CLASS_STUDENTS\":\n      return {\n        ...base,\n        principalType: \"CLASS_STUDENTS\",\n        classId: principal.classId,\n      };\n    case \"DEPARTMENT\":\n      return {\n        ...base,\n        principalType: \"DEPARTMENT\",\n        departmentId: principal.departmentId,\n      };\n    case \"SCHOOL\":\n      return { ...base, principalType: \"SCHOOL\", schoolId: principal.schoolId };\n  }\n}\n\n/**\n * Create a new explicit grant on a folder. Validates:\n *   - Granter has WRITE on the folder.\n *   - The principal is in the same school as the folder's scope (no\n *     cross-school leaks). Personal-scope folders cannot be granted to\n *     non-USER principals — there's no \"school\" to check membership against.\n */\nexport async function grantPermission(\n  grantedById: string,\n  input: {\n    folderId: string;\n    principal: PermissionPrincipalInput;\n    level: AccessLevel;\n  }\n) {\n  await requireFolderAccess(grantedById, input.folderId, \"WRITE\");\n\n  const [targetSchoolId, principalSchool] = await Promise.all([\n    resolveTargetSchoolId(input.folderId),\n    principalSchoolId(input.principal),\n  ]);\n\n  if (input.principal.kind !== \"USER\") {\n    if (!targetSchoolId) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message:\n          \"Personal-scope items can only be shared with specific users, not groups\",\n      });\n    }\n    if (principalSchool !== targetSchoolId) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message: \"Cannot share with a principal from a different school\",\n      });\n    }\n  } else if (targetSchoolId && principalSchool && principalSchool !== targetSchoolId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot share with a user from a different school\",\n    });\n  }\n\n  // Re-granting the same (folder, principal) pair updates the existing row's\n  // level instead of throwing P2002 against the @@unique. Prisma's composite-\n  // unique-key types refuse nullable columns, so we go through findFirst +\n  // update/create rather than a single upsert.\n  const principalCols = principalToColumns(input.principal);\n  const existing = await prisma.permission.findFirst({\n    where: {\n      folderId: input.folderId,\n      principalType: principalCols.principalType,\n      userId: principalCols.userId,\n      tagId: principalCols.tagId,\n      classId: principalCols.classId,\n      departmentId: principalCols.departmentId,\n      schoolId: principalCols.schoolId,\n    },\n    select: { id: true },\n  });\n  if (existing) {\n    return prisma.permission.update({\n      where: { id: existing.id },\n      data: { level: input.level, grantedById },\n    });\n  }\n  return prisma.permission.create({\n    data: {\n      folderId: input.folderId,\n      ...principalCols,\n      level: input.level,\n      grantedById,\n    },\n  });\n}\n\n/** Revoke a grant. Allowed for the granter or anyone with WRITE on the folder. */\nexport async function revokePermission(userId: string, permissionId: string) {\n  const grant = await prisma.permission.findUnique({\n    where: { id: permissionId },\n    select: { id: true, grantedById: true, folderId: true },\n  });\n  if (!grant) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Permission not found\" });\n  }\n  if (grant.grantedById !== userId) {\n    await requireFolderAccess(userId, grant.folderId, \"WRITE\");\n  }\n  await prisma.permission.delete({ where: { id: permissionId } });\n  return { success: true };\n}\n\n/** List all explicit grants on a folder. Caller must have WRITE on it. */\nexport async function listPermissions(userId: string, folderId: string) {\n  await requireFolderAccess(userId, folderId, \"WRITE\");\n  return prisma.permission.findMany({\n    where: { folderId },\n    include: {\n      user: { select: { id: true, username: true, email: true } },\n      tag: { select: { id: true, name: true, color: true } },\n      class: { select: { id: true, name: true, section: true } },\n      department: { select: { id: true, name: true, color: true } },\n      school: { select: { id: true, name: true } },\n    },\n    orderBy: { createdAt: \"desc\" },\n  });\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAEL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAqBnC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAChE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACrB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;SAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC5C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC;IAEL,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,MAAM;QACN,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;QACzC,eAAe;QACf,eAAe;QACf,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;QACvE,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,UAA0B;IAE1B,MAAM,GAAG,GAAkC;QACzC,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;KACrD,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,gBAAgB;YAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,eAAe,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,gBAAgB;YAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,eAAe,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,aAAa,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,QAAQ;YACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CACrB,OAAwB,EACxB,QAAqB;IAErB,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,CAAC;IAC1E,OAAO,OAAO,KAAK,OAAO,CAAC;AAC7B,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAkB,QAAQ,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjB,MAAM,IAAI,GACR,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;SACjC,CAAC,CAAC;QACL,IAAI,CAAC,IAAI;YAAE,MAAM;QACjB,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;QAC7B,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,KAAiB;IAEjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC5B,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;oBACzD,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;iBAC1D;aACF,CAAC,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ;gBACtC,CAAC,CAAC,OAAO,CACL,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;oBACtC,KAAK,EAAE;wBACL,QAAQ,EAAE,SAAS,CAAC,QAAQ;wBAC5B,MAAM;wBACN,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,QAAQ;qBACjB;oBACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;iBACrB,CAAC,CACH;gBACH,CAAC,CAAC,KAAK,CAAC;YACV,IAAI,aAAa;gBAAE,OAAO,OAAO,CAAC;YAClC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBACzD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;gBAC9D,OAAO,OAAO,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAmB,EACnB,UAA0B,EAC1B,KAAkB;IAElB,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE;YACL,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YAC3B,GAAG,eAAe,CAAC,UAAU,CAAC;YAC9B,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC;AACjC,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,QAAgB,EAChB,KAAkB,EAClB,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,YAAY,IAAI,cAAc,CAAC,YAA+B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAAI,CAAC,WAAW,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EACL,0DAA0D;gBAC1D,4BAA4B;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,SAAS,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EACL,KAAK,KAAK,OAAO;YACf,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,sCAAsC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACvC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;QACtB,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACzD,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;SAC1D;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE;gBACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM;gBACN,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,QAAQ;aACjB;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAkB,EAAgB,EAAE,CAAC,CAAC;IACvD,KAAK,EAAE,IAAI;IACX,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,MAAc,EACd,KAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QACrB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,2BAA2B,EAAE,IAAI;YACjC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YACzC,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;aACvE;YACD,WAAW,EAAE;gBACX,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;aACvE;YACD,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;SAClC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE;YACtD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,oEAAoE;YACpE,2CAA2C;YAC3C,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACjE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CACpC,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC9D,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBAC9D,KAAK,EAAE;oBACL,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;oBAC3B,MAAM;oBACN,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,QAAQ;iBACjB;gBACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;YACH,IAAI,eAAe;gBAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBACzD,KAAK,EAAE;oBACL,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;oBAC3B,MAAM;oBACN,MAAM,EAAE,QAAQ;iBACjB;gBACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,SAAS,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EACL,KAAK,KAAK,OAAO;YACf,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,oCAAoC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAInD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC;QAClC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KACrC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;IAEF,MAAM,UAAU,GAAyD,EAAE,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,uEAAuE;QACvE,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACpD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CACzB,CAAC;QACF,IAAI,iBAAiB;YAAE,SAAS;QAEhC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1D,IAAI,YAAY;gBAAE,SAAS;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAeD,0FAA0F;AAC1F,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAwB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC5B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,KAAK,CAAC,QAAQ,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,iBAAiB,CAC9B,SAAmC;IAEnC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACrC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE;gBAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,YAAY,EAAE;gBACrC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAmC;IAQ7D,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,IAAqB;QAC7B,KAAK,EAAE,IAAqB;QAC5B,OAAO,EAAE,IAAqB;QAC9B,YAAY,EAAE,IAAqB;QACnC,QAAQ,EAAE,IAAqB;KAChC,CAAC;IACF,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtE,KAAK,KAAK;YACR,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;QACnE,KAAK,OAAO;YACV,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACzE,KAAK,gBAAgB;YACnB,OAAO;gBACL,GAAG,IAAI;gBACP,aAAa,EAAE,gBAAgB;gBAC/B,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,GAAG,IAAI;gBACP,aAAa,EAAE,gBAAgB;gBAC/B,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,GAAG,IAAI;gBACP,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,SAAS,CAAC,YAAY;aACrC,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,KAIC;IAED,MAAM,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEhE,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EACL,yEAAyE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,IAAI,eAAe,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;QACnF,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,KAAK,EAAE;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC;QACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAC9B,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,aAAa;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;SACZ;KACF,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,YAAoB;IACzE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;QAC3B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IACpE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChC,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3D,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC1D,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7D,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SAC7C;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC","debug_id":"2ac7304e-3502-58ed-af8e-db3b64af3009"}

package/dist/services/school.d.ts

@@ -4,35 +4,43 @@
 import { SchoolMembershipRole } from "@prisma/client";
 export declare function getCurrentSchool(userId: string, schoolId?: string): Promise<{
     activeSchool: {
-        name: string;
         id: string;
-        logoId: string | null;
+        name: string;
+        description: string | null;
         subdomain: string | null;
-        createdAt: Date;
-        updatedAt: Date;
+        logoId: string | null;
+        logoPath: string | null;
+        logoType: string | null;
     } | null;
     activeRole: import(".prisma/client").$Enums.SchoolMembershipRole | null;
     memberships: ({
         school: {
             name: string;
             id: string;
+            description: string | null;
             logoId: string | null;
             subdomain: string | null;
             createdAt: Date;
             updatedAt: Date;
+            logo: {
+                path: string;
+                type: string;
+                id: string;
+            } | null;
         };
     } & {
         status: import(".prisma/client").$Enums.SchoolMembershipStatus;
         id: string;
         createdAt: Date;
         updatedAt: Date;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
         userId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
     })[];
 }>;
 export declare function createSchoolRecord(userId: string, input: {
     name: string;
+    description?: string;
     subdomain?: string;
     logoId?: string;
 }): Promise<{
@@ -42,19 +50,35 @@ export declare function createSchoolRecord(userId: string, input: {
             id: string;
             createdAt: Date;
             updatedAt: Date;
-            role: import(".prisma/client").$Enums.SchoolMembershipRole;
             schoolId: string;
             userId: string;
+            role: import(".prisma/client").$Enums.SchoolMembershipRole;
         }[];
     } & {
         name: string;
         id: string;
+        description: string | null;
         logoId: string | null;
         subdomain: string | null;
         createdAt: Date;
         updatedAt: Date;
     };
 }>;
+export declare function updateSchoolDetails(userId: string, input: {
+    schoolId: string;
+    name?: string;
+    description?: string | null;
+    subdomain?: string | null;
+    logoId?: string | null;
+}): Promise<{
+    school: {
+        name: string;
+        id: string;
+        description: string | null;
+        logoId: string | null;
+        subdomain: string | null;
+    };
+}>;
 export declare function getAdminOverview(userId: string, schoolId: string): Promise<{
     school: {
         id: string;
@@ -115,6 +139,7 @@ export declare function listClasses(userId: string, schoolId: string): Promise<{
         color: string | null;
         section: string;
         syllabus: string | null;
+        departmentId: string | null;
     })[];
 }>;
 export declare function createSchoolClass(userId: string, input: {
@@ -123,6 +148,7 @@ export declare function createSchoolClass(userId: string, input: {
     section: string;
     subject: string;
     color?: string;
+    departmentId?: string;
     teachers?: string[];
     students?: string[];
 }): Promise<{
@@ -133,7 +159,6 @@ export declare function createSchoolClass(userId: string, input: {
             email: string;
             password: string;
             verified: boolean;
-            role: import(".prisma/client").$Enums.UserRole;
             schoolId: string | null;
         }[];
         students: {
@@ -142,7 +167,6 @@ export declare function createSchoolClass(userId: string, input: {
             email: string;
             password: string;
             verified: boolean;
-            role: import(".prisma/client").$Enums.UserRole;
             schoolId: string | null;
         }[];
     } & {
@@ -153,6 +177,7 @@ export declare function createSchoolClass(userId: string, input: {
         color: string | null;
         section: string;
         syllabus: string | null;
+        departmentId: string | null;
     };
 }>;
 export declare function listMembers(userId: string, schoolId: string): Promise<{
@@ -184,9 +209,9 @@ export declare function addMember(userId: string, input: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
         userId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
     };
 }>;
 export declare function updateMemberRole(userId: string, input: {
@@ -199,9 +224,9 @@ export declare function updateMemberRole(userId: string, input: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
         userId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
     };
 }>;
 export declare function removeMember(userId: string, input: {
@@ -229,12 +254,113 @@ export declare function listInvites(userId: string, schoolId: string): Promise<{
         };
     }[];
 }>;
+/**
+ * Issue a direct-upload URL for a school-level asset (e.g. logo). The file
+ * is created unattached and is owned by the requester until they associate
+ * it via school.create or school.update.
+ */
+export declare function getSchoolAssetUploadUrl(userId: string, input: {
+    fileName: string;
+    fileType: string;
+    fileSize: number;
+}): Promise<import("../lib/fileUpload.js").DirectUploadFile>;
+export declare function confirmSchoolAssetUpload(userId: string, fileId: string, uploadSuccess: boolean): Promise<{
+    success: boolean;
+}>;
+/**
+ * Lightweight ID-only listing used to mask external user names in the UI.
+ * Any active institution member can fetch this.
+ */
+export declare function listMemberIds(userId: string, schoolId: string): Promise<string[]>;
+/** Search active institution members by username, displayName, or email. */
+export declare function searchMembers(userId: string, schoolId: string, query: string, limit?: number, role?: "ADMIN" | "TEACHER" | "STUDENT"): Promise<{
+    id: string;
+    username: string;
+    profile: {
+        displayName: string | null;
+        profilePicture: string | null;
+        profilePictureThumbnail: string | null;
+    } | null;
+    schoolMemberships: {
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
+    }[];
+}[]>;
+/**
+ * Combined student timeline: calendar events + assignments + attendance.
+ * Visible to school admins (any student) and to teachers who share at least
+ * one class with the student.
+ */
+export declare function getStudentTimeline(userId: string, input: {
+    schoolId: string;
+    studentId: string;
+    from?: Date;
+    to?: Date;
+}): Promise<{
+    student: {
+        id: string;
+        username: string;
+        profile: {
+            displayName: string | null;
+            profilePicture: string | null;
+        } | null;
+    };
+    events: {
+        name: string | null;
+        id: string;
+        class: {
+            name: string;
+            id: string;
+            color: string | null;
+        } | null;
+        color: string | null;
+        startTime: Date;
+        endTime: Date;
+        location: string | null;
+        remarks: string | null;
+    }[];
+    assignments: {
+        type: import(".prisma/client").$Enums.AssignmentType;
+        id: string;
+        class: {
+            name: string;
+            id: string;
+            subject: string;
+            color: string | null;
+            section: string;
+        };
+        submissions: {
+            id: string;
+            gradeReceived: number | null;
+            submittedAt: Date | null;
+            submitted: boolean | null;
+            returned: boolean | null;
+        }[];
+        title: string;
+        dueDate: Date;
+        graded: boolean;
+        maxGrade: number | null;
+        weight: number;
+    }[];
+    attendance: {
+        id: string;
+        date: Date;
+        class: {
+            name: string;
+            id: string;
+            color: string | null;
+        };
+        status: "PRESENT" | "LATE" | "ABSENT";
+    }[];
+}>;
 export declare function createInvite(userId: string, input: {
     schoolId: string;
     email: string;
     role: SchoolMembershipRole;
-    username?: string;
+    /** Optional display name set by the inviting admin. If omitted the user
+     *  picks their own when they complete the password reset flow. */
     displayName?: string;
+    /** Optional username; if omitted we generate a friendly random one. */
+    username?: string;
 }): Promise<{
     invite: {
         school: {
@@ -247,8 +373,8 @@ export declare function createInvite(userId: string, input: {
         createdAt: Date;
         updatedAt: Date;
         email: string;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         token: string;
         expiresAt: Date;
         acceptedAt: Date | null;
@@ -258,7 +384,8 @@ export declare function createInvite(userId: string, input: {
     createdUser: {
         id: string;
         username: string;
-    } | null;
+    };
+    passwordResetUrl: string;
 }>;
 export declare function revokeInvite(userId: string, input: {
     schoolId: string;
@@ -270,8 +397,8 @@ export declare function revokeInvite(userId: string, input: {
         createdAt: Date;
         updatedAt: Date;
         email: string;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         token: string;
         expiresAt: Date;
         acceptedAt: Date | null;
@@ -297,9 +424,9 @@ export declare function acceptInvite(userId: string, token: string): Promise<{
         id: string;
         createdAt: Date;
         updatedAt: Date;
-        role: import(".prisma/client").$Enums.SchoolMembershipRole;
         schoolId: string;
         userId: string;
+        role: import(".prisma/client").$Enums.SchoolMembershipRole;
     };
 }>;
 //# sourceMappingURL=school.d.ts.map

package/dist/services/school.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"school.d.ts","sourceRoot":"/","sources":["services/school.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAC;AA2DnE,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWvE;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;GAU7D;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BtE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqBF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE;;;;;;;;;;GAS9E;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE;;;;;;;;;;GAwB9E;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;;GAoBlD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;;;;;;;;;;;;;;;;;;;;;YAMsB,MAAM;kBAAY,MAAM;;GA2FhD;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;GAI9C;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;GAiB5C;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;GAsB/D"}
+{"version":3,"file":"school.d.ts","sourceRoot":"/","sources":["services/school.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAC;AA4DnE,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyBvE;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;;;;;;;;;;;;;;;;;;;;GAcF;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;GAUF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BtE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE;;;;;;;;;;GAS9E;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE;;;;;;;;;;GAwB9E;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;;GAoBlD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAGjE;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,4DAchE;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,OAAO;;GAKvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,qBAOnE;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,EACV,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS;;;;;;;;;;;KA2CvC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,EAAE,CAAC,EAAE,IAAI,CAAC;CACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyIF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,oBAAoB,CAAC;IAC3B;sEACkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;;;;;;;;;;;;;;;;;;;;;;;;;GAkGF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;GAI9C;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;GAiB5C;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;GAsB/D"}