@studious-lms/server 1.7.0 → 1.9.0

package/src/routers/department.ts

@@ -0,0 +1,174 @@
+import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
+import {
+  addMembersToDepartment,
+  applyBoundaryTemplate,
+  applyRubricTemplate,
+  createBoundaryTemplate,
+  createDepartmentRecord,
+  createRubricTemplate,
+  deleteBoundaryTemplate,
+  deleteDepartmentRecord,
+  deleteRubricTemplate,
+  getDepartmentDetails,
+  listDepartments,
+  listMyDepartments,
+  removeMemberFromDepartment,
+  setClassDepartment,
+  updateBoundaryTemplate,
+  updateDepartmentRecord,
+  updateRubricTemplate,
+} from "../services/department.js";
+
+export const departmentRouter = createTRPCRouter({
+  list: protectedProcedure
+    .input(z.object({ schoolId: z.string() }))
+    .query(({ ctx, input }) => listDepartments(ctx.user!.id, input.schoolId)),
+
+  listMine: protectedProcedure
+    .input(z.object({ schoolId: z.string() }))
+    .query(({ ctx, input }) =>
+      listMyDepartments(ctx.user!.id, input.schoolId)
+    ),
+
+  get: protectedProcedure
+    .input(z.object({ departmentId: z.string() }))
+    .query(({ ctx, input }) =>
+      getDepartmentDetails(ctx.user!.id, input.departmentId)
+    ),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        schoolId: z.string(),
+        name: z.string().min(1),
+        description: z.string().optional(),
+        color: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      createDepartmentRecord(ctx.user!.id, input)
+    ),
+
+  update: protectedProcedure
+    .input(
+      z.object({
+        departmentId: z.string(),
+        name: z.string().min(1).optional(),
+        description: z.string().nullable().optional(),
+        color: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      updateDepartmentRecord(ctx.user!.id, input)
+    ),
+
+  delete: protectedProcedure
+    .input(z.object({ departmentId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteDepartmentRecord(ctx.user!.id, input.departmentId)
+    ),
+
+  addMembers: protectedProcedure
+    .input(
+      z.object({
+        departmentId: z.string(),
+        userIds: z.array(z.string()),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      addMembersToDepartment(ctx.user!.id, input)
+    ),
+
+  removeMember: protectedProcedure
+    .input(z.object({ departmentId: z.string(), memberId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      removeMemberFromDepartment(ctx.user!.id, input)
+    ),
+
+  setClassDepartment: protectedProcedure
+    .input(
+      z.object({
+        classId: z.string(),
+        departmentId: z.string().nullable(),
+      })
+    )
+    .mutation(({ ctx, input }) => setClassDepartment(ctx.user!.id, input)),
+
+  /** Template authoring. */
+  createRubricTemplate: protectedProcedure
+    .input(
+      z.object({
+        departmentId: z.string(),
+        name: z.string(),
+        structured: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      createRubricTemplate(ctx.user!.id, input)
+    ),
+
+  updateRubricTemplate: protectedProcedure
+    .input(
+      z.object({
+        templateId: z.string(),
+        name: z.string().optional(),
+        structured: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      updateRubricTemplate(ctx.user!.id, input)
+    ),
+
+  deleteRubricTemplate: protectedProcedure
+    .input(z.object({ templateId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteRubricTemplate(ctx.user!.id, input.templateId)
+    ),
+
+  createBoundaryTemplate: protectedProcedure
+    .input(
+      z.object({
+        departmentId: z.string(),
+        name: z.string(),
+        structured: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      createBoundaryTemplate(ctx.user!.id, input)
+    ),
+
+  updateBoundaryTemplate: protectedProcedure
+    .input(
+      z.object({
+        templateId: z.string(),
+        name: z.string().optional(),
+        structured: z.string().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      updateBoundaryTemplate(ctx.user!.id, input)
+    ),
+
+  deleteBoundaryTemplate: protectedProcedure
+    .input(z.object({ templateId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteBoundaryTemplate(ctx.user!.id, input.templateId)
+    ),
+
+  applyRubricTemplate: protectedProcedure
+    .input(
+      z.object({ classId: z.string(), templateId: z.string() })
+    )
+    .mutation(({ ctx, input }) =>
+      applyRubricTemplate(ctx.user!.id, input)
+    ),
+
+  applyBoundaryTemplate: protectedProcedure
+    .input(
+      z.object({ classId: z.string(), templateId: z.string() })
+    )
+    .mutation(({ ctx, input }) =>
+      applyBoundaryTemplate(ctx.user!.id, input)
+    ),
+});

package/src/routers/file.ts

@@ -1,16 +1,20 @@
 import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
 import {
-  createTRPCRouter,
-  protectedProcedure,
-  protectedTeacherProcedure,
-} from "../trpc.js";
-import {
+  deleteFileGeneric,
   getFileSignedUrl,
-  moveFile,
-  renameFile,
-  deleteFileRecord,
+  moveFileScoped,
+  renameFileScoped,
 } from "../services/file.js";
 
+/**
+ * File router. Backed by the same unified scope-aware permission model as the
+ * folder router. The class files page and the cloud-storage page (personal /
+ * institution) both run through the same endpoints.
+ *
+ * Permissions are derived from the file's parent folder scope, so callers
+ * never need to send `classId` / `scope` — just the file id.
+ */
 export const fileRouter = createTRPCRouter({
   getSignedUrl: protectedProcedure
     .input(z.object({ fileId: z.string() }))
@@ -18,38 +22,37 @@ export const fileRouter = createTRPCRouter({
       getFileSignedUrl(ctx.user!.id, input.fileId)
     ),
 
-  move: protectedTeacherProcedure
+  move: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
         targetFolderId: z.string(),
-        classId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      moveFile(input.fileId, input.targetFolderId)
+    .mutation(({ ctx, input }) =>
+      moveFileScoped(ctx.user!.id, {
+        fileId: input.fileId,
+        targetFolderId: input.targetFolderId,
+      })
     ),
 
-  rename: protectedTeacherProcedure
+  rename: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
-        newName: z.string(),
-        classId: z.string(),
+        newName: z.string().min(1),
       })
     )
-    .mutation(({ input }) =>
-      renameFile(input.fileId, input.newName)
+    .mutation(({ ctx, input }) =>
+      renameFileScoped(ctx.user!.id, {
+        fileId: input.fileId,
+        newName: input.newName,
+      })
     ),
 
-  delete: protectedTeacherProcedure
-    .input(
-      z.object({
-        fileId: z.string(),
-        classId: z.string(),
-      })
-    )
-    .mutation(({ input }) =>
-      deleteFileRecord(input.fileId, input.classId)
+  delete: protectedProcedure
+    .input(z.object({ fileId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      deleteFileGeneric(ctx.user!.id, input.fileId)
     ),
 });

package/src/routers/folder.ts

@@ -2,28 +2,22 @@ import { z } from "zod";
 import {
   createTRPCRouter,
   protectedProcedure,
-  protectedClassMemberProcedure,
-  protectedTeacherProcedure,
 } from "../trpc.js";
 import {
+  browseFolder,
+  browseSharedWithMe,
+  confirmFolderUpload,
   createFolderRecord,
+  deleteFolder,
   getFolder,
-  getChildFolders,
-  getFolderChildren,
+  getFolderParents,
+  getFolderUploadUrls,
   getRootFolder,
-  uploadFilesToFolder,
-  deleteFolderRecord,
+  listUserScopes,
   moveFolder,
   updateFolderRecord,
-  getFolderParents,
-  getFolderUploadUrls,
 } from "../services/folder.js";
-
-const createFolderSchema = z.object({
-  name: z.string(),
-  parentFolderId: z.string().optional(),
-  color: z.string().optional(),
-});
+import { listSharedWithMe } from "../services/permissions.js";
 
 const directFileSchema = z.object({
   name: z.string(),
@@ -31,146 +25,161 @@ const directFileSchema = z.object({
   size: z.number(),
 });
 
-const uploadFilesToFolderSchema = z.object({
-  folderId: z.string(),
-  files: z.array(directFileSchema),
-});
-
-const getRootFolderSchema = z.object({
-  classId: z.string(),
-});
+/**
+ * Cloud scope discriminator. Folders live under one of:
+ * - CLASS: a class shared-files area
+ * - SCHOOL_STORAGE: institution-wide files
+ * - PERSONAL: a single user's storage
+ *
+ * All folder operations identify the location they apply to with either a
+ * `folderId` (for an existing folder) or a `scope` (when no folder exists yet,
+ * e.g. browsing a scope root). There is no `classId` shorthand — use
+ * `{ scope: { kind: "CLASS", classId } }` instead.
+ */
+const cloudScopeSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("CLASS"), classId: z.string() }),
+  z.object({ kind: z.literal("SCHOOL_STORAGE"), schoolId: z.string() }),
+  z.object({ kind: z.literal("PERSONAL"), userId: z.string() }),
+]);
+
+/**
+ * Extended scope schema for `browse` only. SHARED_WITH_ME is a *virtual*
+ * scope — it has no root row in the `Folder` table and you can't create
+ * folders inside it directly. It just collects every top-most explicit grant
+ * the user holds for "Shared with me"-style display.
+ */
+const browseScopeSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("CLASS"), classId: z.string() }),
+  z.object({ kind: z.literal("SCHOOL_STORAGE"), schoolId: z.string() }),
+  z.object({ kind: z.literal("PERSONAL"), userId: z.string() }),
+  z.object({ kind: z.literal("SHARED_WITH_ME") }),
+]);
 
 export const folderRouter = createTRPCRouter({
-  create: protectedTeacherProcedure
-    .input(createFolderSchema)
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to create a folder");
+  /** Browse a folder (or scope root) with breadcrumbs and access flag. */
+  browse: protectedProcedure
+    .input(
+      z.union([
+        z.object({ folderId: z.string() }),
+        z.object({ scope: browseScopeSchema }),
+      ])
+    )
+    .query(({ ctx, input }) => {
+      if ("scope" in input && input.scope.kind === "SHARED_WITH_ME") {
+        return browseSharedWithMe(ctx.user!.id);
       }
-      return createFolderRecord(ctx.user.id, {
-        classId: input.classId,
-        name: input.name,
-        parentFolderId: input.parentFolderId,
-        color: input.color,
-      });
+      return browseFolder(
+        ctx.user!.id,
+        "scope" in input
+          ? { scope: input.scope as Exclude<typeof input.scope, { kind: "SHARED_WITH_ME" }> }
+          : input
+      );
     }),
 
-  get: protectedClassMemberProcedure
-    .input(z.object({ folderId: z.string(), classId: z.string() }))
-    .query(({ input }) => getFolder(input.folderId)),
+  /** Top-most folders/files explicitly shared with the caller (Drive-style). */
+  listSharedWithMe: protectedProcedure.query(({ ctx }) =>
+    listSharedWithMe(ctx.user!.id)
+  ),
 
-  getChildFolders: protectedClassMemberProcedure
-    .input(z.object({ classId: z.string() }))
-    .query(({ input }) => getChildFolders(input.classId)),
+  /** What scopes can this user pick from in the cloud-storage UI? */
+  listScopes: protectedProcedure.query(({ ctx }) =>
+    listUserScopes(ctx.user!.id)
+  ),
 
-  getFolderChildren: protectedClassMemberProcedure
-    .input(z.object({ folderId: z.string(), classId: z.string() }))
-    .query(({ input }) =>
-      getFolderChildren(input.folderId, input.classId)
-    ),
-
-  getRootFolder: protectedClassMemberProcedure
-    .input(getRootFolderSchema)
-    .query(({ input }) => getRootFolder(input.classId)),
+  /** Root folder for any scope (no folderId). */
+  getRootFolder: protectedProcedure
+    .input(z.object({ scope: cloudScopeSchema }))
+    .query(({ ctx, input }) => getRootFolder(ctx.user!.id, input.scope)),
 
-  uploadFiles: protectedTeacherProcedure
-    .input(uploadFilesToFolderSchema)
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to upload files");
-      }
-      return uploadFilesToFolder(
-        ctx.user.id,
-        input.classId,
-        input.folderId,
-        input.files
-      );
-    }),
+  get: protectedProcedure
+    .input(z.object({ folderId: z.string() }))
+    .query(({ ctx, input }) => getFolder(ctx.user!.id, input.folderId)),
 
-  delete: protectedTeacherProcedure
-    .input(z.object({ classId: z.string(), folderId: z.string() }))
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to delete folders");
-      }
-      return deleteFolderRecord(ctx.user.id, input.classId, input.folderId);
-    }),
+  getParents: protectedProcedure
+    .input(z.object({ folderId: z.string() }))
+    .query(({ ctx, input }) => getFolderParents(ctx.user!.id, input.folderId)),
 
-  move: protectedTeacherProcedure
+  create: protectedProcedure
     .input(
       z.object({
-        folderId: z.string(),
-        targetParentFolderId: z.string(),
-        classId: z.string(),
+        name: z.string().min(1),
+        parentFolderId: z.string().nullable().optional(),
+        color: z.string().optional(),
+        scope: cloudScopeSchema.optional(),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to move folders");
-      }
-      return moveFolder(
-        ctx.user.id,
-        input.folderId,
-        input.targetParentFolderId,
-        input.classId
-      );
-    }),
+    .mutation(({ ctx, input }) =>
+      createFolderRecord(ctx.user!.id, {
+        name: input.name,
+        parentFolderId: input.parentFolderId ?? undefined,
+        color: input.color,
+        scope: input.scope,
+      })
+    ),
 
-  update: protectedTeacherProcedure
+  update: protectedProcedure
     .input(
       z.object({
         folderId: z.string(),
-        name: z.string(),
+        name: z.string().optional(),
         color: z.string().optional(),
-        classId: z.string(),
       })
     )
-    .mutation(({ input }) =>
-      updateFolderRecord(
-        input.folderId,
-        input.name,
-        input.color,
-        input.classId
-      )
+    .mutation(({ ctx, input }) =>
+      updateFolderRecord(ctx.user!.id, {
+        folderId: input.folderId,
+        name: input.name,
+        color: input.color,
+      })
     ),
 
-  getParents: protectedProcedure
+  delete: protectedProcedure
     .input(z.object({ folderId: z.string() }))
-    .query(({ input }) => getFolderParents(input.folderId)),
+    .mutation(({ ctx, input }) => deleteFolder(ctx.user!.id, input.folderId)),
+
+  move: protectedProcedure
+    .input(
+      z.object({
+        folderId: z.string(),
+        targetParentFolderId: z.string(),
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      moveFolder(ctx.user!.id, {
+        folderId: input.folderId,
+        targetParentFolderId: input.targetParentFolderId,
+      })
+    ),
 
-  getFolderUploadUrls: protectedTeacherProcedure
+  /** Get signed upload URLs for direct-to-GCS upload. */
+  getFolderUploadUrls: protectedProcedure
     .input(
       z.object({
-        classId: z.string(),
         folderId: z.string(),
         files: z.array(directFileSchema),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to upload files");
-      }
-      return getFolderUploadUrls(
-        ctx.user.id,
-        input.classId,
-        input.folderId,
-        input.files
-      );
-    }),
+    .mutation(({ ctx, input }) =>
+      getFolderUploadUrls(ctx.user!.id, {
+        folderId: input.folderId,
+        files: input.files,
+      })
+    ),
 
-  confirmFolderUpload: protectedTeacherProcedure
+  /** Acknowledge a direct upload completed (or failed). */
+  confirmFolderUpload: protectedProcedure
     .input(
       z.object({
         fileId: z.string(),
         uploadSuccess: z.boolean(),
+        errorMessage: z.string().optional(),
       })
     )
-    .mutation(async ({ ctx, input }) => {
-      if (!ctx.user) {
-        throw new Error("You must be logged in to confirm uploads");
-      }
-      const { confirmDirectUpload } = await import("../lib/fileUpload.js");
-      await confirmDirectUpload(input.fileId, input.uploadSuccess);
-      return { success: true };
-    }),
+    .mutation(({ ctx, input }) =>
+      confirmFolderUpload(ctx.user!.id, {
+        fileId: input.fileId,
+        uploadSuccess: input.uploadSuccess,
+        errorMessage: input.errorMessage,
+      })
+    ),
 });

package/src/routers/permissions.ts

@@ -0,0 +1,71 @@
+/**
+ * Permissions router. Backs the "Share" dialog and the "Shared with me" view.
+ *
+ * Permission semantics live in `services/permissions.ts`; this router is just
+ * a thin Zod-validated tRPC surface over those helpers.
+ *
+ * v1 grants only on folders. Files inherit from their parent folder. Adding
+ * file-level grants later is a non-breaking, additive change.
+ */
+import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
+import {
+  grantPermission,
+  listPermissions,
+  listSharedWithMe,
+  revokePermission,
+  type PermissionPrincipalInput,
+} from "../services/permissions.js";
+
+const principalSchema: z.ZodType<PermissionPrincipalInput> = z.discriminatedUnion(
+  "kind",
+  [
+    z.object({ kind: z.literal("USER"), userId: z.string() }),
+    z.object({ kind: z.literal("TAG"), tagId: z.string() }),
+    z.object({ kind: z.literal("CLASS"), classId: z.string() }),
+    z.object({ kind: z.literal("CLASS_TEACHERS"), classId: z.string() }),
+    z.object({ kind: z.literal("CLASS_STUDENTS"), classId: z.string() }),
+    z.object({ kind: z.literal("DEPARTMENT"), departmentId: z.string() }),
+    z.object({ kind: z.literal("SCHOOL"), schoolId: z.string() }),
+  ]
+);
+
+const levelSchema = z.enum(["READ", "WRITE"]);
+
+export const permissionsRouter = createTRPCRouter({
+  /** List all explicit grants on a folder. Caller must have WRITE. */
+  list: protectedProcedure
+    .input(z.object({ folderId: z.string() }))
+    .query(({ ctx, input }) =>
+      listPermissions(ctx.user!.id, input.folderId)
+    ),
+
+  /** Create a new explicit grant on a folder. */
+  grant: protectedProcedure
+    .input(
+      z.object({
+        folderId: z.string(),
+        principal: principalSchema,
+        level: levelSchema,
+      })
+    )
+    .mutation(({ ctx, input }) =>
+      grantPermission(ctx.user!.id, {
+        folderId: input.folderId,
+        principal: input.principal,
+        level: input.level,
+      })
+    ),
+
+  /** Remove an explicit grant. Allowed for the granter or anyone with WRITE on the folder. */
+  revoke: protectedProcedure
+    .input(z.object({ permissionId: z.string() }))
+    .mutation(({ ctx, input }) =>
+      revokePermission(ctx.user!.id, input.permissionId)
+    ),
+
+  /** Drive-style "Shared with me" — top-most folders explicitly granted to the caller. */
+  listSharedWithMe: protectedProcedure.query(({ ctx }) =>
+    listSharedWithMe(ctx.user!.id)
+  ),
+});