@studious-lms/server 1.7.0 → 1.9.0

package/prisma/schema.prisma

@@ -111,18 +111,73 @@ enum SchoolInviteStatus {
 }
 
 model School {
-  id        String   @id @default(uuid())
-  name      String
-  logo      File?    @relation(references: [id], fields: [logoId])
-  logoId    String?
-  subdomain String?  @unique
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  users       User[]
-  memberships SchoolMembership[]
-  invites     SchoolInvite[]
-  classes     Class[]
+  id          String   @id @default(uuid())
+  name        String
+  description String?
+  logo        File?    @relation("SchoolLogo", references: [id], fields: [logoId])
+  logoId      String?
+  subdomain   String?  @unique
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  users         User[]
+  memberships   SchoolMembership[]
+  invites       SchoolInvite[]
+  classes       Class[]
+  departments   Department[]
+  tags          Tag[]
+  storageRoot   Folder?            @relation("SchoolStorageRoot")
+  permissions   Permission[]       @relation("SchoolPermissions")
+}
+
+model Department {
+  id          String   @id @default(uuid())
+  schoolId    String
+  name        String
+  description String?
+  color       String?  @default("#3B82F6")
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  school            School            @relation(fields: [schoolId], references: [id], onDelete: Cascade)
+  members           User[]            @relation("UserDepartments")
+  classes           Class[]
+  tags              Tag[]
+  rubricTemplates   MarkScheme[]
+  boundaryTemplates GradingBoundary[]
+  permissions       Permission[]      @relation("DepartmentPermissions")
+
+  @@unique([schoolId, name])
+  @@index([schoolId])
+}
+
+enum TagTarget {
+  USER
+  CLASS
+  RUBRIC
+  BOUNDARY
+}
+
+model Tag {
+  id           String   @id @default(uuid())
+  schoolId     String
+  departmentId String?
+  name         String
+  color        String   @default("#3B82F6")
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+
+  school     School            @relation(fields: [schoolId], references: [id], onDelete: Cascade)
+  department Department?       @relation(fields: [departmentId], references: [id], onDelete: SetNull)
+  users      User[]            @relation("UserTags")
+  classes    Class[]           @relation("ClassTags")
+  rubrics    MarkScheme[]      @relation("MarkSchemeTags")
+  boundaries GradingBoundary[] @relation("GradingBoundaryTags")
+  permissions Permission[]     @relation("TagPermissions")
+
+  @@unique([schoolId, name])
+  @@index([schoolId])
+  @@index([departmentId])
 }
 
 model User {
@@ -132,7 +187,6 @@ model User {
   password String
   profile  UserProfile?
   verified Boolean      @default(false)
-  role     UserRole     @default(NONE)
 
   teacherIn Class[] @relation("UserTeacherToClass")
   studentIn Class[] @relation("UserStudentToClass")
@@ -158,6 +212,14 @@ model User {
   schoolMemberships SchoolMembership[]
   sentSchoolInvites SchoolInvite[]     @relation("SchoolInviteInvitedBy")
 
+  departments     Department[] @relation("UserDepartments")
+  tags            Tag[]        @relation("UserTags")
+  personalStorage Folder?      @relation("UserStorageRoot")
+
+  // Permission grants where this user is the principal vs. the granter.
+  userPermissions    Permission[] @relation("UserPermissions")
+  grantedPermissions Permission[] @relation("GrantedPermissions")
+
   // Chat relations
   conversationMemberships ConversationMember[]
   sentMessages            Message[]            @relation("SentMessages")
@@ -238,8 +300,6 @@ model Class {
   worksheets        Worksheet[]
   students          User[]            @relation("UserStudentToClass")
   teachers          User[]            @relation("UserTeacherToClass")
-  // markSchemes   MarkScheme[] @relation("ClassToMarkScheme")
-  // gradingBoundaries GradingBoundary[] @relation("ClassToGradingBoundary")
   draftFiles        File[]            @relation("ClassDraftFiles")
   classFiles        Folder?           @relation("ClassFiles")
   labChats          LabChat[]         @relation("ClassLabChats")
@@ -247,36 +307,70 @@ model Class {
   gradingBoundaries GradingBoundary[]
   school            School?           @relation(fields: [schoolId], references: [id])
   schoolId          String?
+  department        Department?       @relation(fields: [departmentId], references: [id], onDelete: SetNull)
+  departmentId      String?
+  tags              Tag[]             @relation("ClassTags")
+  permissions       Permission[]      @relation("ClassPermissions")
+
+  @@index([schoolId])
+  @@index([departmentId])
 }
 
 model MarkScheme {
-  id          String       @id @default(uuid())
-  classId     String
-  // class Class[] @relation("ClassToMarkScheme")
-  class       Class?       @relation(fields: [classId], references: [id], onDelete: Cascade)
-  structured  String
-  assignments Assignment[]
+  id           String       @id @default(uuid())
+  classId      String?
+  class        Class?       @relation(fields: [classId], references: [id], onDelete: Cascade)
+  departmentId String?
+  department   Department?  @relation(fields: [departmentId], references: [id], onDelete: Cascade)
+  name         String?
+  structured   String
+  assignments  Assignment[]
+  tags         Tag[]        @relation("MarkSchemeTags")
+
+  @@index([classId])
+  @@index([departmentId])
 }
 
 model GradingBoundary {
-  id          String       @id @default(uuid())
-  classId     String
-  // class Class[] @relation("ClassToGradingBoundary")
-  class       Class?       @relation(fields: [classId], references: [id], onDelete: Cascade)
-  structured  String
-  assignments Assignment[]
+  id           String       @id @default(uuid())
+  classId      String?
+  class        Class?       @relation(fields: [classId], references: [id], onDelete: Cascade)
+  departmentId String?
+  department   Department?  @relation(fields: [departmentId], references: [id], onDelete: Cascade)
+  name         String?
+  structured   String
+  assignments  Assignment[]
+  tags         Tag[]        @relation("GradingBoundaryTags")
+
+  @@index([classId])
+  @@index([departmentId])
+}
+
+enum FolderScope {
+  CLASS
+  SCHOOL_STORAGE
+  PERSONAL
+  GENERIC
 }
 
 model Folder {
-  id             String   @id @default(uuid())
+  id             String      @id @default(uuid())
   name           String
-  files          File[]   @relation("FolderFiles")
-  childFolders   Folder[] @relation("ParentChildFolders")
-  parentFolder   Folder?  @relation("ParentChildFolders", fields: [parentFolderId], references: [id])
+  scope          FolderScope @default(GENERIC)
+  files          File[]      @relation("FolderFiles")
+  childFolders   Folder[]    @relation("ParentChildFolders")
+  parentFolder   Folder?     @relation("ParentChildFolders", fields: [parentFolderId], references: [id])
   parentFolderId String?
-  color          String?  @default("#3B82F6")
-  class          Class?   @relation("ClassFiles", fields: [classId], references: [id])
-  classId        String?  @unique
+  color          String?     @default("#3B82F6")
+
+  class           Class?  @relation("ClassFiles", fields: [classId], references: [id])
+  classId         String? @unique
+  schoolStorage   School? @relation("SchoolStorageRoot", fields: [schoolStorageId], references: [id], onDelete: Cascade)
+  schoolStorageId String? @unique
+  personalOwner   User?   @relation("UserStorageRoot", fields: [personalOwnerId], references: [id], onDelete: Cascade)
+  personalOwnerId String? @unique
+
+  permissions Permission[] @relation("FolderPermissions")
 }
 
 model File {
@@ -328,7 +422,7 @@ model File {
   announcement   Announcement? @relation("AnnouncementAttachments", fields: [announcementId], references: [id], onDelete: Cascade)
   announcementId String?
 
-  schools School[]
+  schools School[] @relation("SchoolLogo")
 
   schoolDevelopementProgram   SchoolDevelopementProgram? @relation("SchoolDevelopementProgramSupportingDocumentation", fields: [schoolDevelopementProgramId], references: [id], onDelete: Cascade)
   schoolDevelopementProgramId String?
@@ -814,3 +908,67 @@ model RunJob {
   @@index([classId, status])
   @@index([status, createdAt])
 }
+
+/// What kind of principal an explicit Permission row grants access to.
+/// CLASS = everyone in the class (teachers + students). CLASS_TEACHERS /
+/// CLASS_STUDENTS narrow that to one role. Stored alongside a single FK
+/// (`classId`, `userId`, etc.) — see service-layer invariants.
+enum PermissionPrincipalType {
+  USER
+  TAG
+  CLASS
+  CLASS_TEACHERS
+  CLASS_STUDENTS
+  DEPARTMENT
+  SCHOOL
+}
+
+enum PermissionLevel {
+  READ
+  WRITE
+}
+
+/// Explicit ACL grant on a folder. Sits on top of (and is purely additive
+/// to) the scope-derived defaults computed from FolderScope. Files inherit
+/// from their parent folder — file-level overrides are deliberately deferred
+/// to a future, additive migration that adds a `fileId` column + discriminator.
+///
+/// Schema invariant enforced in the service layer (Prisma can't express it):
+///   - Exactly one of `userId` / `tagId` / `classId` / `departmentId` /
+///     `schoolId` is set, matching `principalType`. CLASS, CLASS_TEACHERS,
+///     CLASS_STUDENTS all share `classId`.
+model Permission {
+  id       String  @id @default(uuid())
+  folderId String
+  folder   Folder  @relation("FolderPermissions", fields: [folderId], references: [id], onDelete: Cascade)
+
+  principalType PermissionPrincipalType
+  userId        String?
+  tagId         String?
+  classId       String?
+  departmentId  String?
+  schoolId      String?
+
+  user       User?       @relation("UserPermissions", fields: [userId], references: [id], onDelete: Cascade)
+  tag        Tag?        @relation("TagPermissions", fields: [tagId], references: [id], onDelete: Cascade)
+  class      Class?      @relation("ClassPermissions", fields: [classId], references: [id], onDelete: Cascade)
+  department Department? @relation("DepartmentPermissions", fields: [departmentId], references: [id], onDelete: Cascade)
+  school     School?     @relation("SchoolPermissions", fields: [schoolId], references: [id], onDelete: Cascade)
+
+  level       PermissionLevel
+  grantedById String
+  grantedBy   User            @relation("GrantedPermissions", fields: [grantedById], references: [id])
+  createdAt   DateTime        @default(now())
+
+  /// One grant per (folder, principal). Re-granting upserts the level.
+  /// Postgres treats nulls as distinct in unique indexes, but the service layer
+  /// guarantees exactly one principal id is non-null, so this still uniquely
+  /// identifies the row.
+  @@unique([folderId, principalType, userId, tagId, classId, departmentId, schoolId])
+  @@index([folderId])
+  @@index([userId])
+  @@index([tagId])
+  @@index([classId])
+  @@index([departmentId])
+  @@index([schoolId])
+}

package/src/middleware/security.ts

@@ -20,7 +20,7 @@ const rateLimitHandler = (req: Request, res: Response) => {
 // General API rate limiter - applies to all routes
 export const generalLimiter = rateLimit({
   windowMs: 10 * 60 * 1000, // 10 minutes
-  max: 100, // Limit each IP to 100 requests per windowMs
+  max: 1000, // Limit each IP to 100 requests per windowMs
   message: 'Too many requests from this IP, please try again later.',
   standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
   legacyHeaders: false, // Disable the `X-RateLimit-*` headers

package/src/models/access.ts

@@ -3,33 +3,17 @@
  */
 
 export const schoolAdminForClassWhere = (userId: string) => ({
-  OR: [
-    {
-      school: {
-        is: {
-          memberships: {
-            some: {
-              userId,
-              role: "ADMIN" as const,
-              status: "ACTIVE" as const,
-            },
-          },
+  school: {
+    is: {
+      memberships: {
+        some: {
+          userId,
+          role: "ADMIN" as const,
+          status: "ACTIVE" as const,
         },
       },
     },
-    {
-      school: {
-        is: {
-          users: {
-            some: {
-              id: userId,
-              role: "ADMIN" as const,
-            },
-          },
-        },
-      },
-    },
-  ],
+  },
 });
 
 export const classTeacherOrSchoolAdminWhere = (userId: string) => ({

package/src/models/announcement.ts

@@ -67,7 +67,6 @@ export function findAnnouncementWithClass(id: string) {
           school: {
             include: {
               users: {
-                where: { role: "ADMIN" as const },
                 select: { id: true },
               },
               memberships: {

package/src/models/auth.ts

@@ -61,7 +61,6 @@ export function findUserByEmail(email: string) {
     select: {
       id: true,
       email: true,
-      role: true,
       profile: {
         select: {
           displayName: true,

package/src/models/class.ts

@@ -54,6 +54,19 @@ const classIncludeForGetAll = {
       },
     },
   },
+  school: {
+    select: {
+      id: true,
+      name: true,
+    },
+  },
+  department: {
+    select: {
+      id: true,
+      name: true,
+      color: true,
+    },
+  },
 } as const;
 
 /** @returns Classes where user is a teacher. */

package/src/models/cloudStorage.ts

@@ -0,0 +1,327 @@
+/**
+ * CloudStorage model — scope-aware folder helpers used by the institution and
+ * personal cloud storage UI. Sits on top of the same Folder/File tables that
+ * back class folders, but adds scope (school/personal) and ownership semantics.
+ */
+import type { FolderScope } from "@prisma/client";
+import { prisma } from "../lib/prisma.js";
+
+export type CloudScope =
+  | { kind: "CLASS"; classId: string }
+  | { kind: "SCHOOL_STORAGE"; schoolId: string }
+  | { kind: "PERSONAL"; userId: string };
+
+const folderSelect = {
+  id: true,
+  name: true,
+  color: true,
+  scope: true,
+  classId: true,
+  schoolStorageId: true,
+  personalOwnerId: true,
+  parentFolderId: true,
+} as const;
+
+export async function findOrCreateScopeRoot(scope: CloudScope) {
+  switch (scope.kind) {
+    case "CLASS": {
+      let root = await prisma.folder.findFirst({
+        where: { classId: scope.classId, parentFolderId: null },
+      });
+      if (!root) {
+        root = await prisma.folder.create({
+          data: {
+            name: "Class Files",
+            scope: "CLASS" as FolderScope,
+            class: { connect: { id: scope.classId } },
+          },
+        });
+      } else if (root.scope !== "CLASS") {
+        root = await prisma.folder.update({
+          where: { id: root.id },
+          data: { scope: "CLASS" as FolderScope },
+        });
+      }
+      return root;
+    }
+    case "SCHOOL_STORAGE": {
+      let root = await prisma.folder.findFirst({
+        where: { schoolStorageId: scope.schoolId },
+      });
+      if (!root) {
+        root = await prisma.folder.create({
+          data: {
+            name: "Cloud Storage",
+            scope: "SCHOOL_STORAGE" as FolderScope,
+            schoolStorage: { connect: { id: scope.schoolId } },
+          },
+        });
+      }
+      return root;
+    }
+    case "PERSONAL": {
+      let root = await prisma.folder.findFirst({
+        where: { personalOwnerId: scope.userId },
+      });
+      if (!root) {
+        root = await prisma.folder.create({
+          data: {
+            name: "My Files",
+            scope: "PERSONAL" as FolderScope,
+            personalOwner: { connect: { id: scope.userId } },
+          },
+        });
+      }
+      return root;
+    }
+  }
+}
+
+/**
+ * Walk up the folder tree until we reach a root with a scope owner. Used to
+ * permission-check sub-folders (which only carry a parentFolderId).
+ */
+export async function resolveFolderScope(
+  folderId: string
+): Promise<CloudScope | null> {
+  let currentId: string | null = folderId;
+  let visits = 0;
+  while (currentId && visits < 64) {
+    const folder = await prisma.folder.findUnique({
+      where: { id: currentId },
+      select: folderSelect,
+    });
+    if (!folder) return null;
+    if (folder.classId) return { kind: "CLASS", classId: folder.classId };
+    if (folder.schoolStorageId)
+      return { kind: "SCHOOL_STORAGE", schoolId: folder.schoolStorageId };
+    if (folder.personalOwnerId)
+      return { kind: "PERSONAL", userId: folder.personalOwnerId };
+    if (!folder.parentFolderId) return null;
+    currentId = folder.parentFolderId;
+    visits += 1;
+  }
+  return null;
+}
+
+const fileSelect = {
+  id: true,
+  name: true,
+  type: true,
+  size: true,
+  path: true,
+  uploadedAt: true,
+  user: { select: { id: true, username: true } },
+} as const;
+
+const childFolderSelect = {
+  id: true,
+  name: true,
+  color: true,
+  _count: { select: { files: true, childFolders: true } },
+} as const;
+
+export function findFolderWithContents(folderId: string) {
+  return prisma.folder.findFirst({
+    where: { id: folderId },
+    include: {
+      files: {
+        where: { uploadStatus: "COMPLETED" },
+        select: fileSelect,
+        orderBy: { uploadedAt: "desc" },
+      },
+      childFolders: {
+        select: childFolderSelect,
+        orderBy: { name: "asc" },
+      },
+      parentFolder: { select: { id: true, name: true } },
+    },
+  });
+}
+
+export function createSubFolder(data: {
+  name: string;
+  parentFolderId: string;
+  color?: string;
+}) {
+  return prisma.folder.create({
+    data: {
+      name: data.name,
+      color: data.color,
+      parentFolder: { connect: { id: data.parentFolderId } },
+    },
+    select: folderSelect,
+  });
+}
+
+export function findFolderById(folderId: string) {
+  return prisma.folder.findUnique({
+    where: { id: folderId },
+    select: folderSelect,
+  });
+}
+
+export function deleteFolderById(folderId: string) {
+  return prisma.folder.delete({ where: { id: folderId } });
+}
+
+export function renameFolder(folderId: string, name: string, color?: string) {
+  return prisma.folder.update({
+    where: { id: folderId },
+    data: {
+      name,
+      ...(color ? { color } : {}),
+    },
+    select: folderSelect,
+  });
+}
+
+/**
+ * Build the breadcrumb chain for a folder.
+ *
+ * Without `viewerId`: walks all the way up to the scope root (owner-style
+ * view).
+ *
+ * With `viewerId`: walks up but stops at the highest folder the viewer is
+ * actually granted on, OR at the scope root if the viewer is a scope member.
+ * This is the Drive-style "Shared with me" behavior — a grantee never sees
+ * ancestor folders they weren't shared on. The result for a grantee browsing
+ * `Owner/PrivateA/SharedB/C` (granted on B) reads `SharedB / C` — the ancestor
+ * `PrivateA` is correctly hidden.
+ */
+export async function listFolderBreadcrumbs(
+  folderId: string,
+  viewerId?: string
+) {
+  const breadcrumbs: { id: string; name: string }[] = [];
+  let currentId: string | null = folderId;
+  let visits = 0;
+
+  let viewerGrantedFolderIds: Set<string> | null = null;
+  let viewerScopeMember = false;
+
+  if (viewerId) {
+    const grants = await prisma.permission.findMany({
+      where: {
+        OR: [
+          { principalType: "USER", userId: viewerId },
+          {
+            principalType: "TAG",
+            tag: { users: { some: { id: viewerId } } },
+          },
+          {
+            principalType: "CLASS",
+            class: {
+              OR: [
+                { teachers: { some: { id: viewerId } } },
+                { students: { some: { id: viewerId } } },
+              ],
+            },
+          },
+          {
+            principalType: "CLASS_TEACHERS",
+            class: { teachers: { some: { id: viewerId } } },
+          },
+          {
+            principalType: "CLASS_STUDENTS",
+            class: { students: { some: { id: viewerId } } },
+          },
+          {
+            principalType: "DEPARTMENT",
+            department: { members: { some: { id: viewerId } } },
+          },
+          {
+            principalType: "SCHOOL",
+            school: {
+              memberships: { some: { userId: viewerId, status: "ACTIVE" } },
+            },
+          },
+        ],
+      },
+      select: { folderId: true },
+    });
+    viewerGrantedFolderIds = new Set(
+      grants.map((g) => g.folderId).filter((x): x is string => Boolean(x))
+    );
+
+    // Determine if the viewer is a member of the *target* folder's scope —
+    // if so, breadcrumbs go all the way to the scope root as normal.
+    const scope = await resolveFolderScope(folderId);
+    if (scope) {
+      switch (scope.kind) {
+        case "CLASS": {
+          const c = await prisma.class.findFirst({
+            where: {
+              id: scope.classId,
+              OR: [
+                { teachers: { some: { id: viewerId } } },
+                { students: { some: { id: viewerId } } },
+              ],
+            },
+            select: { id: true },
+          });
+          viewerScopeMember = Boolean(c);
+          if (!viewerScopeMember && scope.classId) {
+            const klass = await prisma.class.findUnique({
+              where: { id: scope.classId },
+              select: { schoolId: true },
+            });
+            if (klass?.schoolId) {
+              const m = await prisma.schoolMembership.findFirst({
+                where: {
+                  schoolId: klass.schoolId,
+                  userId: viewerId,
+                  role: "ADMIN",
+                  status: "ACTIVE",
+                },
+                select: { id: true },
+              });
+              viewerScopeMember = Boolean(m);
+            }
+          }
+          break;
+        }
+        case "SCHOOL_STORAGE": {
+          const m = await prisma.schoolMembership.findFirst({
+            where: {
+              schoolId: scope.schoolId,
+              userId: viewerId,
+              status: "ACTIVE",
+            },
+            select: { id: true },
+          });
+          viewerScopeMember = Boolean(m);
+          break;
+        }
+        case "PERSONAL":
+          viewerScopeMember = scope.userId === viewerId;
+          break;
+      }
+    }
+  }
+
+  while (currentId && visits < 64) {
+    const folder = await prisma.folder.findUnique({
+      where: { id: currentId },
+      select: { id: true, name: true, parentFolderId: true },
+    });
+    if (!folder) break;
+    breadcrumbs.unshift({ id: folder.id, name: folder.name });
+
+    // Viewer-aware truncation: when the viewer is *not* a scope member but
+    // is a grantee, stop at the highest granted ancestor (we walk up one
+    // more step into the granted folder, then stop there).
+    if (
+      viewerId &&
+      !viewerScopeMember &&
+      viewerGrantedFolderIds &&
+      viewerGrantedFolderIds.has(folder.id)
+    ) {
+      break;
+    }
+
+    currentId = folder.parentFolderId;
+    visits += 1;
+  }
+  return breadcrumbs;
+}