@studious-lms/server 1.7.0 → 1.9.0

package/src/services/file.ts

@@ -1,6 +1,23 @@
 /**
- * File service – signed URLs, move, rename, delete. Handles permission checks
- * for assignment, submission, announcement, folder, and user-owned files.
+ * File service – signed URLs, move, rename, delete.
+ *
+ * Two access concepts coexist here, and they should not be conflated:
+ *
+ *   1. **Contextual access** — assignment, submission, announcement, and chat
+ *      attachments. A teacher viewing a student's submission has access by
+ *      virtue of teaching the class, not because anyone explicitly "shared"
+ *      the file with them. These checks live inline in `getFileSignedUrl`
+ *      below and predate the explicit-share system.
+ *
+ *   2. **Explicit-share access** — folder-scoped files in cloud storage.
+ *      Permission flows through the central resolver in `permissions.ts`,
+ *      which consults explicit `Permission` rows in addition to the
+ *      scope-derived defaults. The cloud-storage helpers (`*Scoped` /
+ *      `*Generic`) below all use this path.
+ *
+ * If you're tempted to refactor the contextual checks into the resolver,
+ * don't — they intentionally key off the file's domain context, not its
+ * filesystem location.
  */
 import { TRPCError } from "@trpc/server";
 import { getSignedUrl, deleteFile } from "../lib/googleCloudStorage.js";
@@ -15,17 +32,37 @@ import {
   deleteFileById,
 } from "../models/file.js";
 import { findConversationMembership } from "../models/message.js";
+import { prisma } from "../lib/prisma.js";
+import { resolveFolderScope } from "../models/cloudStorage.js";
+import { requireFolderAccess } from "./folder.js";
+import { requireFileAccess } from "./permissions.js";
 
 function isSchoolAdminForClass(classData: any, userId: string) {
   return Boolean(
     classData?.school?.memberships?.some(
       (membership: { userId: string }) => membership.userId === userId
-    ) ||
-      classData?.school?.users?.some((admin: { id: string }) => admin.id === userId)
+    )
   );
 }
 
-/** Generate a signed URL for file download. Validates user has access. */
+/**
+ * Generate a signed URL for file download.
+ *
+ * Access resolution, in order — first match wins:
+ *   1. Owner of the file.
+ *   2. Member of the conversation the file is attached to (chat upload).
+ *   3. Contextual access via the file's class context: assignment / announcement
+ *      / submission / annotations attached to a class the user teaches, learns
+ *      in, or is a school admin for.
+ *   4. The central permissions resolver, which covers folder-scoped files —
+ *      explicit Permission grants (USER / TAG / CLASS / DEPARTMENT / SCHOOL
+ *      principals) plus scope defaults (school members read SCHOOL_STORAGE,
+ *      class members read class folders, owners read personal folders).
+ *
+ * The resolver is invoked unconditionally as the last step, so files shared
+ * via the new Permission system reach this code path even when they have no
+ * matching domain context.
+ */
 export async function getFileSignedUrl(userId: string, fileId: string) {
   const file = await findFileById(fileId);
   if (!file) {
@@ -37,58 +74,58 @@ export async function getFileSignedUrl(userId: string, fileId: string) {
 
   let hasAccess = false;
 
-  if (file.assignment?.class) {
-    const isTeacher = file.assignment.class.teachers.some(
-      (t) => t.id === userId
-    );
-    const isStudent = file.assignment.class.students.some(
-      (s) => s.id === userId
-    );
-    const isSchoolAdmin = isSchoolAdminForClass(file.assignment.class, userId);
-    logger.info(
-      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}, isSchoolAdmin: ${isSchoolAdmin}`
-    );
-    hasAccess = isTeacher || isStudent || isSchoolAdmin;
+  if (file.userId === userId) {
+    hasAccess = true;
   }
 
-  if ((file as any).announcement?.class) {
-    const ann = (file as any).announcement;
-    const isTeacher = ann.class.teachers.some((t: any) => t.id === userId);
-    const isStudent = ann.class.students.some((s: any) => s.id === userId);
-    const isSchoolAdmin = isSchoolAdminForClass(ann.class, userId);
-    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
+  if (!hasAccess && file.conversationId) {
+    const membership = await findConversationMembership(file.conversationId, userId);
+    hasAccess = Boolean(membership);
   }
 
-  if (file.submission?.assignment?.classId) {
+  if (!hasAccess && file.assignment?.class) {
+    const cls = file.assignment.class;
     hasAccess =
-      hasAccess ||
-      file.submission.studentId === userId ||
-      file.submission.assignment.class.teachers.some((t) => t.id === userId) ||
-      isSchoolAdminForClass(file.submission.assignment.class, userId);
+      cls.teachers.some((t) => t.id === userId) ||
+      cls.students.some((s) => s.id === userId) ||
+      isSchoolAdminForClass(cls, userId);
   }
 
-  if (file.annotations?.assignment?.classId) {
+  if (!hasAccess && (file as any).announcement?.class) {
+    const cls = (file as any).announcement.class;
     hasAccess =
-      hasAccess ||
-      file.annotations.studentId === userId ||
-      file.annotations.assignment.class.teachers.some((t) => t.id === userId) ||
-      isSchoolAdminForClass(file.annotations.assignment.class, userId);
+      cls.teachers.some((t: { id: string }) => t.id === userId) ||
+      cls.students.some((s: { id: string }) => s.id === userId) ||
+      isSchoolAdminForClass(cls, userId);
   }
 
-  if (file.userId === userId) {
-    hasAccess = true;
+  if (!hasAccess && file.submission?.assignment?.classId) {
+    const cls = file.submission.assignment.class;
+    hasAccess =
+      file.submission.studentId === userId ||
+      cls.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(cls, userId);
   }
 
-  if (file.conversationId) {
-    const membership = await findConversationMembership(file.conversationId, userId);
-    hasAccess = hasAccess || Boolean(membership);
+  if (!hasAccess && file.annotations?.assignment?.classId) {
+    const cls = file.annotations.assignment.class;
+    hasAccess =
+      file.annotations.studentId === userId ||
+      cls.teachers.some((t) => t.id === userId) ||
+      isSchoolAdminForClass(cls, userId);
   }
 
-  if (file.folder?.class) {
-    const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
-    const isStudent = file.folder.class.students.some((s) => s.id === userId);
-    const isSchoolAdmin = isSchoolAdminForClass(file.folder.class, userId);
-    hasAccess = hasAccess || isTeacher || isStudent || isSchoolAdmin;
+  // Final fallback: the explicit-share + scope-default resolver. Covers
+  // folder-scoped files shared via Permission grants (incl. SCHOOL/CLASS/TAG
+  // principals) and any institution member reading SCHOOL_STORAGE files.
+  // Safe to call for unfiled files — the resolver returns owner-only there.
+  if (!hasAccess) {
+    try {
+      await requireFileAccess(userId, fileId, "READ");
+      hasAccess = true;
+    } catch {
+      // resolver denied — fall through to FORBIDDEN below.
+    }
   }
 
   if (!hasAccess) {
@@ -185,3 +222,95 @@ export async function deleteFileRecord(fileId: string, classId: string) {
   await deleteFileById(fileId);
   return { success: true };
 }
+
+/**
+ * Scope-aware move: works for class, school, and personal storage. Source
+ * and target must live in the same scope (no cross-scope moves).
+ */
+export async function moveFileScoped(
+  userId: string,
+  input: { fileId: string; targetFolderId: string }
+) {
+  const file = await findFileWithFolder(input.fileId);
+  if (!file?.folderId) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  const [sourceScope, targetScope] = await Promise.all([
+    resolveFolderScope(file.folderId),
+    resolveFolderScope(input.targetFolderId),
+  ]);
+  if (!sourceScope || !targetScope) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
+  }
+  if (JSON.stringify(sourceScope) !== JSON.stringify(targetScope)) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Cannot move files between scopes",
+    });
+  }
+  await requireFolderAccess(userId, file.folderId, "WRITE");
+  await requireFolderAccess(userId, input.targetFolderId, "WRITE");
+  return updateFileFolder(input.fileId, input.targetFolderId);
+}
+
+/** Scope-aware rename. */
+export async function renameFileScoped(
+  userId: string,
+  input: { fileId: string; newName: string }
+) {
+  const trimmed = input.newName.trim();
+  if (!trimmed) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "File name cannot be empty",
+    });
+  }
+  const file = await findFileWithFolder(input.fileId);
+  if (!file) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  if (file.folderId) {
+    await requireFolderAccess(userId, file.folderId, "WRITE");
+  } else if (file.userId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You don't own this file",
+    });
+  }
+  return updateFileName(input.fileId, trimmed);
+}
+
+/**
+ * Generic delete that works across class / school / personal storage by
+ * deriving permissions from the parent folder's CloudScope (or owning user
+ * for unfiled files).
+ */
+export async function deleteFileGeneric(userId: string, fileId: string) {
+  const file = await findFileWithFolderAndThumbnail(fileId);
+  if (!file) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "File not found" });
+  }
+  if (file.folderId) {
+    await requireFolderAccess(userId, file.folderId, "WRITE");
+  } else if (file.userId !== userId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You don't own this file",
+    });
+  }
+  try {
+    if (file.uploadStatus === "COMPLETED") {
+      await deleteFile(file.path);
+      if (file.thumbnail) {
+        await deleteFile(file.thumbnail.path);
+      }
+    }
+  } catch (error) {
+    logger.warn(
+      `Failed to delete file ${file.path}:`,
+      error as Record<string, unknown>
+    );
+  }
+  await deleteFileById(fileId);
+  return { success: true };
+}