@studious-lms/server 1.7.0 → 1.9.0

package/src/services/school.ts

@@ -35,6 +35,7 @@ import {
   removeSchoolMembershipPreservingContent,
   revokeSchoolInvite,
   updateSchoolMembershipRole,
+  updateSchoolRecord,
   upsertSchoolMembership,
 } from "../models/school.js";
 
@@ -66,8 +67,22 @@ export async function getCurrentSchool(userId: string, schoolId?: string) {
     ? memberships.find((membership) => membership.schoolId === schoolId)
     : memberships[0];
 
+  const activeSchool = activeMembership?.school
+    ? {
+        id: activeMembership.school.id,
+        name: activeMembership.school.name,
+        description: activeMembership.school.description ?? null,
+        subdomain: activeMembership.school.subdomain ?? null,
+        logoId: activeMembership.school.logoId ?? null,
+        // The path is the GCS object key — the frontend resolves it to a
+        // signed URL through trpc.file.getSignedUrl when needed.
+        logoPath: activeMembership.school.logo?.path ?? null,
+        logoType: activeMembership.school.logo?.type ?? null,
+      }
+    : null;
+
   return {
-    activeSchool: activeMembership?.school ?? null,
+    activeSchool,
     activeRole: activeMembership?.role ?? null,
     memberships,
   };
@@ -75,7 +90,12 @@ export async function getCurrentSchool(userId: string, schoolId?: string) {
 
 export async function createSchoolRecord(
   userId: string,
-  input: { name: string; subdomain?: string; logoId?: string }
+  input: {
+    name: string;
+    description?: string;
+    subdomain?: string;
+    logoId?: string;
+  }
 ) {
   const school = await createSchoolWithAdmin({
     userId,
@@ -84,9 +104,33 @@ export async function createSchoolRecord(
     logoId: input.logoId,
   });
 
+  if (input.description) {
+    await updateSchoolRecord(school.id, { description: input.description });
+  }
+
   return { school };
 }
 
+export async function updateSchoolDetails(
+  userId: string,
+  input: {
+    schoolId: string;
+    name?: string;
+    description?: string | null;
+    subdomain?: string | null;
+    logoId?: string | null;
+  }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+  const updated = await updateSchoolRecord(input.schoolId, {
+    name: input.name,
+    description: input.description,
+    subdomain: input.subdomain,
+    logoId: input.logoId,
+  });
+  return { school: updated };
+}
+
 export async function getAdminOverview(userId: string, schoolId: string) {
   await requireSchoolAdmin(schoolId, userId);
   const school = await getSchoolOverview(schoolId);
@@ -132,11 +176,26 @@ export async function createSchoolClass(
     section: string;
     subject: string;
     color?: string;
+    departmentId?: string;
     teachers?: string[];
     students?: string[];
   }
 ) {
   await requireSchoolAdmin(input.schoolId, userId);
+
+  if (input.departmentId) {
+    const dept = await prisma.department.findUnique({
+      where: { id: input.departmentId },
+      select: { schoolId: true },
+    });
+    if (!dept || dept.schoolId !== input.schoolId) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "Department does not belong to this institution",
+      });
+    }
+  }
+
   const createdClass = await prisma.class.create({
     data: {
       name: input.name,
@@ -144,6 +203,7 @@ export async function createSchoolClass(
       subject: input.subject,
       color: input.color,
       schoolId: input.schoolId,
+      departmentId: input.departmentId,
       teachers: input.teachers?.length
         ? { connect: input.teachers.map((id) => ({ id })) }
         : undefined,
@@ -232,63 +292,319 @@ export async function listInvites(userId: string, schoolId: string) {
   return { invites: await listSchoolInvites(schoolId) };
 }
 
+/**
+ * Issue a direct-upload URL for a school-level asset (e.g. logo). The file
+ * is created unattached and is owned by the requester until they associate
+ * it via school.create or school.update.
+ */
+export async function getSchoolAssetUploadUrl(
+  userId: string,
+  input: { fileName: string; fileType: string; fileSize: number }
+) {
+  const { createDirectUploadFiles } = await import("../lib/fileUpload.js");
+  const [uploadFile] = await createDirectUploadFiles(
+    [
+      {
+        name: input.fileName,
+        type: input.fileType,
+        size: input.fileSize,
+      },
+    ],
+    userId
+  );
+  return uploadFile;
+}
+
+export async function confirmSchoolAssetUpload(
+  userId: string,
+  fileId: string,
+  uploadSuccess: boolean
+) {
+  const { confirmDirectUpload } = await import("../lib/fileUpload.js");
+  await confirmDirectUpload(fileId, uploadSuccess);
+  return { success: true };
+}
+
+/**
+ * Lightweight ID-only listing used to mask external user names in the UI.
+ * Any active institution member can fetch this.
+ */
+export async function listMemberIds(userId: string, schoolId: string) {
+  await requireSchoolMember(schoolId, userId);
+  const rows = await prisma.schoolMembership.findMany({
+    where: { schoolId, status: "ACTIVE" },
+    select: { userId: true },
+  });
+  return rows.map((r) => r.userId);
+}
+
+/** Search active institution members by username, displayName, or email. */
+export async function searchMembers(
+  userId: string,
+  schoolId: string,
+  query: string,
+  limit = 10,
+  role?: "ADMIN" | "TEACHER" | "STUDENT"
+) {
+  await requireSchoolMember(schoolId, userId);
+  const trimmed = query.trim();
+  if (!trimmed) return [];
+  return prisma.user.findMany({
+    where: {
+      id: { not: userId },
+      schoolMemberships: {
+        some: {
+          schoolId,
+          status: "ACTIVE",
+          ...(role ? { role } : {}),
+        },
+      },
+      OR: [
+        { username: { contains: trimmed, mode: "insensitive" } },
+        { email: { contains: trimmed, mode: "insensitive" } },
+        {
+          profile: {
+            displayName: { contains: trimmed, mode: "insensitive" },
+          },
+        },
+      ],
+    },
+    take: limit,
+    select: {
+      id: true,
+      username: true,
+      profile: {
+        select: {
+          displayName: true,
+          profilePicture: true,
+          profilePictureThumbnail: true,
+        },
+      },
+      schoolMemberships: {
+        where: { schoolId, status: "ACTIVE" },
+        select: { role: true },
+      },
+    },
+    orderBy: { username: "asc" },
+  });
+}
+
+/**
+ * Combined student timeline: calendar events + assignments + attendance.
+ * Visible to school admins (any student) and to teachers who share at least
+ * one class with the student.
+ */
+export async function getStudentTimeline(
+  userId: string,
+  input: {
+    schoolId: string;
+    studentId: string;
+    from?: Date;
+    to?: Date;
+  }
+) {
+  const isAdmin = await findActiveSchoolAdminMembership(
+    input.schoolId,
+    userId
+  );
+
+  // Permission: admin OR shares a class.
+  if (!isAdmin) {
+    const sharedClass = await prisma.class.findFirst({
+      where: {
+        schoolId: input.schoolId,
+        teachers: { some: { id: userId } },
+        students: { some: { id: input.studentId } },
+      },
+      select: { id: true },
+    });
+    if (!sharedClass) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "You don't share a class with this student",
+      });
+    }
+  }
+
+  // Make sure student is in the institution.
+  const studentMembership = await prisma.schoolMembership.findFirst({
+    where: { schoolId: input.schoolId, userId: input.studentId, status: "ACTIVE" },
+    select: { role: true, user: { select: { id: true, username: true, profile: { select: { displayName: true, profilePicture: true } } } } },
+  });
+  if (!studentMembership) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Student is not in this institution",
+    });
+  }
+
+  const range = {
+    ...(input.from ? { gte: input.from } : {}),
+    ...(input.to ? { lte: input.to } : {}),
+  };
+  const hasRange = Object.keys(range).length > 0;
+
+  const [events, assignments, attendance] = await Promise.all([
+    prisma.event.findMany({
+      where: {
+        userId: input.studentId,
+        ...(hasRange ? { startTime: range } : {}),
+      },
+      select: {
+        id: true,
+        name: true,
+        startTime: true,
+        endTime: true,
+        location: true,
+        remarks: true,
+        color: true,
+        class: { select: { id: true, name: true, color: true } },
+      },
+      orderBy: { startTime: "asc" },
+    }),
+    prisma.assignment.findMany({
+      where: {
+        class: {
+          students: { some: { id: input.studentId } },
+        },
+        template: false,
+        ...(hasRange ? { dueDate: range } : {}),
+      },
+      select: {
+        id: true,
+        title: true,
+        dueDate: true,
+        type: true,
+        graded: true,
+        maxGrade: true,
+        weight: true,
+        class: {
+          select: {
+            id: true,
+            name: true,
+            section: true,
+            subject: true,
+            color: true,
+          },
+        },
+        submissions: {
+          where: { studentId: input.studentId },
+          select: {
+            id: true,
+            submitted: true,
+            submittedAt: true,
+            returned: true,
+            gradeReceived: true,
+          },
+        },
+      },
+      orderBy: { dueDate: "asc" },
+    }),
+    prisma.attendance.findMany({
+      where: {
+        OR: [
+          { present: { some: { id: input.studentId } } },
+          { late: { some: { id: input.studentId } } },
+          { absent: { some: { id: input.studentId } } },
+        ],
+        ...(hasRange ? { date: range } : {}),
+      },
+      select: {
+        id: true,
+        date: true,
+        class: { select: { id: true, name: true, color: true } },
+        present: { where: { id: input.studentId }, select: { id: true } },
+        late: { where: { id: input.studentId }, select: { id: true } },
+        absent: { where: { id: input.studentId }, select: { id: true } },
+      },
+      orderBy: { date: "asc" },
+    }),
+  ]);
+
+  const attendanceShaped = attendance.map((record) => ({
+    id: record.id,
+    date: record.date,
+    class: record.class,
+    status: record.present.length
+      ? ("PRESENT" as const)
+      : record.late.length
+        ? ("LATE" as const)
+        : ("ABSENT" as const),
+  }));
+
+  return {
+    student: studentMembership.user,
+    events,
+    assignments,
+    attendance: attendanceShaped,
+  };
+}
+
 export async function createInvite(
   userId: string,
   input: {
     schoolId: string;
     email: string;
     role: SchoolMembershipRole;
-    username?: string;
+    /** Optional display name set by the inviting admin. If omitted the user
+     *  picks their own when they complete the password reset flow. */
     displayName?: string;
+    /** Optional username; if omitted we generate a friendly random one. */
+    username?: string;
   }
 ) {
   await requireSchoolAdmin(input.schoolId, userId);
 
+  // The institution invite flow is "new account only": if the email is
+  // already in use we reject. This keeps the join experience simple — every
+  // new institution member always lands on a password reset link.
   const existingUser = await findUserByEmail(input.email);
+  if (existingUser) {
+    throw new TRPCError({
+      code: "CONFLICT",
+      message:
+        "An account with this email already exists. Ask them to log in and you can add them via search.",
+    });
+  }
 
-  let createdUser: { id: string; username: string } | null = null;
-  let passwordResetToken: string | null = null;
-
-  if (!existingUser) {
-    let username: string;
-    if (input.username) {
-      const taken = await findUserByUsername(input.username);
-      if (taken) {
-        throw new TRPCError({
-          code: "CONFLICT",
-          message: "Username already taken",
-        });
-      }
-      username = input.username;
-    } else {
-      username = await generateUniqueUsername(async (candidate) => {
-        const existing = await findUserByUsername(candidate);
-        return Boolean(existing);
+  let username: string;
+  if (input.username) {
+    const taken = await findUserByUsername(input.username);
+    if (taken) {
+      throw new TRPCError({
+        code: "CONFLICT",
+        message: "Username already taken",
       });
     }
-
-    const placeholderPassword = await hash(uuidv4(), 10);
-    const user = await createUser({
-      username,
-      email: input.email,
-      password: placeholderPassword,
-      verified: true,
+    username = input.username;
+  } else {
+    username = await generateUniqueUsername(async (candidate) => {
+      const existing = await findUserByUsername(candidate);
+      return Boolean(existing);
     });
-    createdUser = { id: user.id, username: user.username };
+  }
 
-    if (input.displayName) {
-      await upsertUserProfile(user.id, { displayName: input.displayName });
-    }
+  const placeholderPassword = await hash(uuidv4(), 10);
+  const user = await createUser({
+    username,
+    email: input.email,
+    password: placeholderPassword,
+    verified: true,
+  });
+  const createdUser = { id: user.id, username: user.username };
 
-    const resetSession = await createSession({
-      id: uuidv4(),
-      type: SessionType.PASSWORD_RESET,
-      userId: user.id,
-      expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 14),
-    });
-    passwordResetToken = resetSession.id;
+  if (input.displayName) {
+    await upsertUserProfile(user.id, { displayName: input.displayName });
   }
 
+  const resetSession = await createSession({
+    id: uuidv4(),
+    type: SessionType.PASSWORD_RESET,
+    userId: user.id,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 14),
+  });
+  const passwordResetToken = resetSession.id;
+
   const token = uuidv4();
   const invite = await createSchoolInvite({
     schoolId: input.schoolId,
@@ -299,27 +615,19 @@ export async function createInvite(
     expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 14),
   });
 
-  if (createdUser) {
-    await acceptSchoolInvite(invite.id, createdUser.id);
-  }
-
-  const inviteUrl = `${env.NEXT_PUBLIC_APP_URL}/school/invite/${token}`;
-  const passwordResetUrl = passwordResetToken
-    ? `${env.NEXT_PUBLIC_APP_URL}/reset-password/${passwordResetToken}`
-    : null;
+  await acceptSchoolInvite(invite.id, createdUser.id);
 
+  const passwordResetUrl = `${env.NEXT_PUBLIC_APP_URL}/reset-password/${passwordResetToken}`;
   const emailLines = [
-    `You've been invited to ${invite.school.name} on Studious.`,
+    `You've been added to ${invite.school.name} on Studious.`,
     "",
+    `We created an account for you with the username "${createdUser.username}".`,
+    input.displayName
+      ? `Your name is set to "${input.displayName}" — you can change it after signing in.`
+      : `You can set your name once you sign in for the first time.`,
+    "",
+    `Set your password to get started: ${passwordResetUrl}`,
   ];
-  if (createdUser && passwordResetUrl) {
-    emailLines.push(
-      `We created an account for you with the username "${createdUser.username}" and added you to ${invite.school.name}.`,
-      `Set your password to get started: ${passwordResetUrl}`
-    );
-  } else {
-    emailLines.push(`Click the link to confirm: ${inviteUrl}`);
-  }
 
   try {
     await sendMail({
@@ -336,7 +644,11 @@ export async function createInvite(
     });
   }
 
-  return { invite, createdUser };
+  return {
+    invite,
+    createdUser,
+    passwordResetUrl,
+  };
 }
 
 export async function revokeInvite(