@studious-lms/server 1.8.0 → 1.11.0

package/dist/services/folder.js

@@ -11,91 +11,84 @@
  * endpoints — no duplicate routers.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1e1a55f0-d115-5d93-9636-a89ae577bf45")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="338c145a-d8eb-5931-9a42-2a9c7c9acc94")}catch(e){}}();
 import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
 import { createSubFolder, deleteFolderById, findFolderById, findFolderWithContents, findOrCreateScopeRoot, listFolderBreadcrumbs, renameFolder, resolveFolderScope, } from "../models/cloudStorage.js";
 import { createDirectUploadFiles, confirmDirectUpload, } from "../lib/fileUpload.js";
+import { getScopeDefault, listSharedWithMe, requireFolderAccess as requireFolderAccessResolved, } from "./permissions.js";
+/**
+ * Scope-default-only check: used when there is no folder id yet (browsing or
+ * creating at the scope root). Does *not* consult explicit grants — those only
+ * apply to specific folders. Explicit-grant access to sub-folders surfaces via
+ * the "Shared with me" virtual scope, not by being a scope member.
+ */
 async function requireScopeAccess(userId, scope, level) {
-    switch (scope.kind) {
-        case "CLASS": {
-            const classData = await prisma.class.findFirst({
-                where: { id: scope.classId },
-                select: {
-                    id: true,
-                    schoolId: true,
-                    teachers: { where: { id: userId }, select: { id: true } },
-                    students: { where: { id: userId }, select: { id: true } },
-                },
-            });
-            if (!classData) {
-                throw new TRPCError({ code: "NOT_FOUND", message: "Class not found" });
-            }
-            const isTeacher = classData.teachers.length > 0;
-            const isStudent = classData.students.length > 0;
-            const isSchoolAdmin = classData.schoolId
-                ? Boolean(await prisma.schoolMembership.findFirst({
-                    where: {
-                        schoolId: classData.schoolId,
-                        userId,
-                        role: "ADMIN",
-                        status: "ACTIVE",
-                    },
-                    select: { id: true },
-                }))
-                : false;
-            if (!isTeacher && !isStudent && !isSchoolAdmin) {
-                throw new TRPCError({
-                    code: "FORBIDDEN",
-                    message: "You don't have access to this class",
-                });
-            }
-            const canWrite = isTeacher || isSchoolAdmin;
-            if (level === "WRITE" && !canWrite) {
-                throw new TRPCError({
-                    code: "FORBIDDEN",
-                    message: "Only class teachers can modify class files",
-                });
-            }
-            return { scope, canWrite };
-        }
-        case "SCHOOL_STORAGE": {
-            const membership = await prisma.schoolMembership.findFirst({
-                where: { schoolId: scope.schoolId, userId, status: "ACTIVE" },
-                select: { role: true },
-            });
-            if (!membership) {
-                throw new TRPCError({
-                    code: "FORBIDDEN",
-                    message: "You aren't a member of this institution",
-                });
-            }
-            const canWrite = membership.role === "ADMIN" || membership.role === "TEACHER";
-            if (level === "WRITE" && !canWrite) {
-                throw new TRPCError({
-                    code: "FORBIDDEN",
-                    message: "Only teachers and admins can modify institution storage",
-                });
-            }
-            return { scope, canWrite };
-        }
-        case "PERSONAL": {
-            if (scope.userId !== userId) {
-                throw new TRPCError({
-                    code: "FORBIDDEN",
-                    message: "You can only access your own personal storage",
-                });
-            }
-            return { scope, canWrite: true };
+    if (scope.kind === "CLASS") {
+        const classExists = await prisma.class.findFirst({
+            where: { id: scope.classId },
+            select: { id: true },
+        });
+        if (!classExists) {
+            throw new TRPCError({ code: "NOT_FOUND", message: "Class not found" });
         }
     }
+    const granted = await getScopeDefault(userId, scope);
+    if (!granted) {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: scope.kind === "CLASS"
+                ? "You don't have access to this class"
+                : scope.kind === "SCHOOL_STORAGE"
+                    ? "You aren't a member of this institution"
+                    : "You can only access your own personal storage",
+        });
+    }
+    if (level === "WRITE" && granted !== "WRITE") {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: scope.kind === "CLASS"
+                ? "Only class teachers can modify class files"
+                : "Only teachers and admins can modify institution storage",
+        });
+    }
+    // Scope-default-only path; access cannot be via a grant here.
+    return { scope, canWrite: granted === "WRITE", viaGrant: false };
 }
-export async function requireFolderAccess(userId, folderId, level) {
-    const scope = await resolveFolderScope(folderId);
-    if (!scope) {
+/**
+ * Folder-level access check. Delegates to the central resolver which consults
+ * explicit grants in addition to the scope default. Returns the scope and a
+ * canWrite flag indicating whether the user has WRITE here (used by the UI to
+ * gate the "New folder" / "Upload" buttons during a READ-level browse).
+ *
+ * Pass `mutatesSelf: true` for actions that target the folder itself (rename,
+ * delete, move-this-folder). Drive-style: explicit grants don't authorize
+ * those — only scope-default WRITE does. Mutations of children should NOT
+ * pass this flag.
+ */
+export async function requireFolderAccess(userId, folderId, level, opts = {}) {
+    const result = await requireFolderAccessResolved(userId, folderId, level, opts);
+    if (!result.scope) {
+        // resolveFolderScope returns null only for missing folders; the resolver
+        // would have already thrown NOT_FOUND in that case.
         throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
     }
-    return requireScopeAccess(userId, scope, level);
+    let canWrite = result.scopeDefault === "WRITE";
+    if (!canWrite && level !== "WRITE") {
+        // We came in with READ; check whether the user *also* has WRITE so the UI
+        // can show the right affordances. Cheaper to do this only when needed.
+        try {
+            await requireFolderAccessResolved(userId, folderId, "WRITE");
+            canWrite = true;
+        }
+        catch {
+            canWrite = false;
+        }
+    }
+    else if (level === "WRITE") {
+        canWrite = true;
+    }
+    return { scope: result.scope, canWrite, viaGrant: result.viaGrant };
 }
 function scopesEqual(a, b) {
     if (a.kind !== b.kind)
@@ -113,22 +106,28 @@ function scopesEqual(a, b) {
 export async function browseFolder(userId, input) {
     let scope;
     let folderId;
+    let canWrite;
+    let viaGrant;
     if ("folderId" in input) {
         folderId = input.folderId;
-        const resolved = await resolveFolderScope(input.folderId);
-        if (!resolved) {
-            throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
-        }
-        scope = resolved;
+        // `requireFolderAccess` consults explicit grants in addition to the scope
+        // default, so users can drill into folders shared with them via "Shared
+        // with me" without being scope members.
+        const access = await requireFolderAccess(userId, folderId, "READ");
+        scope = access.scope;
+        canWrite = access.canWrite;
+        viaGrant = access.viaGrant;
     }
     else {
         scope = input.scope;
+        const access = await requireScopeAccess(userId, scope, "READ");
+        canWrite = access.canWrite;
+        viaGrant = false;
     }
-    const access = await requireScopeAccess(userId, scope, "READ");
     const targetId = folderId ?? (await findOrCreateScopeRoot(scope)).id;
     const [folder, breadcrumbs] = await Promise.all([
         findFolderWithContents(targetId),
-        listFolderBreadcrumbs(targetId),
+        listFolderBreadcrumbs(targetId, userId),
     ]);
     if (!folder) {
         throw new TRPCError({ code: "NOT_FOUND", message: "Folder not found" });
@@ -136,8 +135,61 @@ export async function browseFolder(userId, input) {
     return {
         folder,
         breadcrumbs,
-        canWrite: access.canWrite,
+        canWrite,
         scope,
+        /**
+         * When the viewer's access comes through an explicit grant (not scope
+         * membership), the UI should label the root as "Shared with me" rather
+         * than the underlying scope's title. The grantee may not even be a
+         * member of that scope — showing "My Files" or "Class Files" would be
+         * misleading. Null when the viewer is a regular scope member.
+         */
+        displayRoot: viaGrant
+            ? { kind: "SHARED_WITH_ME", name: "Shared with me" }
+            : null,
+    };
+}
+/**
+ * Drive-style "Shared with me" — surfaces every top-most folder/file the user
+ * has an explicit grant on (filtering out anything already covered by their
+ * scope defaults). Shaped like a folder so the existing folder-browser UI can
+ * render it without special cases.
+ *
+ * The pseudo-folder has a synthetic id (`shared-with-me`) and the foreign-key
+ * columns set to null — the UI should never try to mutate it directly. The
+ * union shape matches `browseFolder`'s return type so the same client query
+ * can render either.
+ */
+export async function browseSharedWithMe(userId) {
+    const { folders } = await listSharedWithMe(userId);
+    return {
+        folder: {
+            id: "shared-with-me",
+            name: "Shared with me",
+            color: null,
+            classId: null,
+            schoolStorageId: null,
+            personalOwnerId: null,
+            scope: "GENERIC",
+            parentFolderId: null,
+            parentFolder: null,
+            childFolders: folders.map((f) => ({
+                id: f.id,
+                name: f.name,
+                color: f.color,
+                _count: { files: 0, childFolders: 0 },
+            })),
+            // No file-level grants in v1 — files always live under a granted folder.
+            files: [],
+        },
+        breadcrumbs: [{ id: "shared-with-me", name: "Shared with me" }],
+        canWrite: false,
+        scope: { kind: "PERSONAL", userId },
+        /** Same `displayRoot` shape as `browseFolder` so the client union is uniform. */
+        displayRoot: {
+            kind: "SHARED_WITH_ME",
+            name: "Shared with me",
+        },
     };
 }
 export async function getRootFolder(userId, scope) {
@@ -192,7 +244,11 @@ export async function updateFolderRecord(userId, input) {
             message: "Cannot rename a root folder",
         });
     }
-    await requireFolderAccess(userId, input.folderId, "WRITE");
+    // Rename targets the folder itself — Drive-style guard reserves this for
+    // scope-default WRITE (explicit grants don't authorize renaming the share).
+    await requireFolderAccess(userId, input.folderId, "WRITE", {
+        mutatesSelf: true,
+    });
     return renameFolder(input.folderId, input.name?.trim() ?? folder.name, input.color);
 }
 export async function deleteFolder(userId, folderId) {
@@ -206,7 +262,8 @@ export async function deleteFolder(userId, folderId) {
             message: "Cannot delete a root folder",
         });
     }
-    await requireFolderAccess(userId, folderId, "WRITE");
+    // Delete targets the folder itself — same Drive-style guard as rename.
+    await requireFolderAccess(userId, folderId, "WRITE", { mutatesSelf: true });
     await deleteFolderById(folderId);
     return { success: true };
 }
@@ -230,7 +287,12 @@ export async function moveFolder(userId, input) {
             message: "Cannot move folders between scopes",
         });
     }
-    await requireScopeAccess(userId, sourceScope, "WRITE");
+    // Moving the folder targets it (and the new parent's contents). Source-side
+    // is mutates-self; target-side is regular WRITE on the new parent.
+    await requireFolderAccess(userId, input.folderId, "WRITE", {
+        mutatesSelf: true,
+    });
+    await requireFolderAccess(userId, input.targetParentFolderId, "WRITE");
     // Don't let a folder land under one of its own descendants.
     let cursor = input.targetParentFolderId;
     while (cursor) {
@@ -292,6 +354,10 @@ export async function listUserScopes(userId) {
         },
         orderBy: { name: "asc" },
     });
+    // Light counts for the "Shared with me" bucket so the UI can hide the entry
+    // when there's nothing to show. Cheap to compute — just counts top-most
+    // grants, not folder/file metadata.
+    const sharedWithMe = await listSharedWithMe(userId);
     return {
         personal: { kind: "PERSONAL", userId },
         schools: memberships.map((m) => ({
@@ -301,7 +367,12 @@ export async function listUserScopes(userId) {
             role: m.role,
         })),
         classes,
+        sharedWithMe: {
+            kind: "SHARED_WITH_ME",
+            folderCount: sharedWithMe.folders.length,
+            fileCount: sharedWithMe.files.length,
+        },
     };
 }
 //# sourceMappingURL=folder.js.map
-//# debugId=1e1a55f0-d115-5d93-9636-a89ae577bf45
+//# debugId=338c145a-d8eb-5931-9a42-2a9c7c9acc94

package/dist/services/folder.js.map

@@ -1 +1 @@
-{"version":3,"file":"folder.js","sources":["services/folder.ts"],"sourceRoot":"/","sourcesContent":["/**\n * Folder service — single source of truth for folders across every scope.\n *\n * A `Folder` can live inside one of four scopes (see `models/cloudStorage.ts`):\n * class files, school storage, school documents, or a user's personal storage.\n * Permissions and ownership are derived from the scope by walking up the tree\n * to the root, so callers can either pass a `scope` (when there is no folder\n * id yet, e.g. browsing the root) or just a `folderId` (everything else).\n *\n * The class files page and the global cloud-storage view both consume these\n * endpoints — no duplicate routers.\n */\nimport { TRPCError } from \"@trpc/server\";\nimport { prisma } from \"../lib/prisma.js\";\nimport {\n  CloudScope,\n  createSubFolder,\n  deleteFolderById,\n  findFolderById,\n  findFolderWithContents,\n  findOrCreateScopeRoot,\n  listFolderBreadcrumbs,\n  renameFolder,\n  resolveFolderScope,\n} from \"../models/cloudStorage.js\";\nimport {\n  createDirectUploadFiles,\n  type DirectFileData,\n  confirmDirectUpload,\n} from \"../lib/fileUpload.js\";\n\ntype AccessLevel = \"READ\" | \"WRITE\";\n\ninterface AccessResult {\n  scope: CloudScope;\n  canWrite: boolean;\n}\n\nasync function requireScopeAccess(\n  userId: string,\n  scope: CloudScope,\n  level: AccessLevel\n): Promise<AccessResult> {\n  switch (scope.kind) {\n    case \"CLASS\": {\n      const classData = await prisma.class.findFirst({\n        where: { id: scope.classId },\n        select: {\n          id: true,\n          schoolId: true,\n          teachers: { where: { id: userId }, select: { id: true } },\n          students: { where: { id: userId }, select: { id: true } },\n        },\n      });\n      if (!classData) {\n        throw new TRPCError({ code: \"NOT_FOUND\", message: \"Class not found\" });\n      }\n      const isTeacher = classData.teachers.length > 0;\n      const isStudent = classData.students.length > 0;\n      const isSchoolAdmin = classData.schoolId\n        ? Boolean(\n            await prisma.schoolMembership.findFirst({\n              where: {\n                schoolId: classData.schoolId,\n                userId,\n                role: \"ADMIN\",\n                status: \"ACTIVE\",\n              },\n              select: { id: true },\n            })\n          )\n        : false;\n      if (!isTeacher && !isStudent && !isSchoolAdmin) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"You don't have access to this class\",\n        });\n      }\n      const canWrite = isTeacher || isSchoolAdmin;\n      if (level === \"WRITE\" && !canWrite) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"Only class teachers can modify class files\",\n        });\n      }\n      return { scope, canWrite };\n    }\n    case \"SCHOOL_STORAGE\": {\n      const membership = await prisma.schoolMembership.findFirst({\n        where: { schoolId: scope.schoolId, userId, status: \"ACTIVE\" },\n        select: { role: true },\n      });\n      if (!membership) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"You aren't a member of this institution\",\n        });\n      }\n      const canWrite =\n        membership.role === \"ADMIN\" || membership.role === \"TEACHER\";\n      if (level === \"WRITE\" && !canWrite) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"Only teachers and admins can modify institution storage\",\n        });\n      }\n      return { scope, canWrite };\n    }\n    case \"PERSONAL\": {\n      if (scope.userId !== userId) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"You can only access your own personal storage\",\n        });\n      }\n      return { scope, canWrite: true };\n    }\n  }\n}\n\nexport async function requireFolderAccess(\n  userId: string,\n  folderId: string,\n  level: AccessLevel\n) {\n  const scope = await resolveFolderScope(folderId);\n  if (!scope) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  return requireScopeAccess(userId, scope, level);\n}\n\nfunction scopesEqual(a: CloudScope, b: CloudScope): boolean {\n  if (a.kind !== b.kind) return false;\n  switch (a.kind) {\n    case \"CLASS\":\n      return a.classId === (b as typeof a).classId;\n    case \"SCHOOL_STORAGE\":\n      return a.schoolId === (b as typeof a).schoolId;\n    case \"PERSONAL\":\n      return a.userId === (b as typeof a).userId;\n  }\n}\n\n/** Browse a folder. Pass `folderId` to drill into a specific folder, or a `scope` to land on its root. */\nexport async function browseFolder(\n  userId: string,\n  input: { folderId: string } | { scope: CloudScope }\n) {\n  let scope: CloudScope;\n  let folderId: string | undefined;\n\n  if (\"folderId\" in input) {\n    folderId = input.folderId;\n    const resolved = await resolveFolderScope(input.folderId);\n    if (!resolved) {\n      throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n    }\n    scope = resolved;\n  } else {\n    scope = input.scope;\n  }\n\n  const access = await requireScopeAccess(userId, scope, \"READ\");\n  const targetId = folderId ?? (await findOrCreateScopeRoot(scope)).id;\n\n  const [folder, breadcrumbs] = await Promise.all([\n    findFolderWithContents(targetId),\n    listFolderBreadcrumbs(targetId),\n  ]);\n\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n\n  return {\n    folder,\n    breadcrumbs,\n    canWrite: access.canWrite,\n    scope,\n  };\n}\n\nexport async function getRootFolder(userId: string, scope: CloudScope) {\n  const result = await browseFolder(userId, { scope });\n  return result.folder;\n}\n\nexport async function getFolder(userId: string, folderId: string) {\n  const result = await browseFolder(userId, { folderId });\n  return result.folder;\n}\n\nexport async function getFolderBreadcrumbs(userId: string, folderId: string) {\n  await requireFolderAccess(userId, folderId, \"READ\");\n  return listFolderBreadcrumbs(folderId);\n}\n\nexport async function getFolderParents(userId: string, folderId: string) {\n  // Permission: user can read this folder.\n  await requireFolderAccess(userId, folderId, \"READ\");\n  const breadcrumbs = await listFolderBreadcrumbs(folderId);\n  // Existing API returned full folder records — re-fetch them.\n  return Promise.all(\n    breadcrumbs.map((b) => findFolderById(b.id))\n  );\n}\n\nexport async function createFolderRecord(\n  userId: string,\n  input: {\n    name: string;\n    parentFolderId?: string | null;\n    color?: string;\n    scope?: CloudScope;\n  }\n) {\n  let parentId: string;\n  if (input.parentFolderId) {\n    parentId = input.parentFolderId;\n    await requireFolderAccess(userId, parentId, \"WRITE\");\n  } else {\n    if (!input.scope) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message: \"scope is required when parentFolderId is omitted\",\n      });\n    }\n    await requireScopeAccess(userId, input.scope, \"WRITE\");\n    parentId = (await findOrCreateScopeRoot(input.scope)).id;\n  }\n  return createSubFolder({\n    name: input.name.trim(),\n    parentFolderId: parentId,\n    color: input.color,\n  });\n}\n\nexport async function updateFolderRecord(\n  userId: string,\n  input: { folderId: string; name?: string; color?: string }\n) {\n  const folder = await findFolderById(input.folderId);\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!folder.parentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot rename a root folder\",\n    });\n  }\n  await requireFolderAccess(userId, input.folderId, \"WRITE\");\n  return renameFolder(\n    input.folderId,\n    input.name?.trim() ?? folder.name,\n    input.color\n  );\n}\n\nexport async function deleteFolder(userId: string, folderId: string) {\n  const folder = await findFolderById(folderId);\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!folder.parentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot delete a root folder\",\n    });\n  }\n  await requireFolderAccess(userId, folderId, \"WRITE\");\n  await deleteFolderById(folderId);\n  return { success: true };\n}\n\nexport async function moveFolder(\n  userId: string,\n  input: { folderId: string; targetParentFolderId: string }\n) {\n  if (input.folderId === input.targetParentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot move a folder into itself\",\n    });\n  }\n  const [sourceScope, targetScope] = await Promise.all([\n    resolveFolderScope(input.folderId),\n    resolveFolderScope(input.targetParentFolderId),\n  ]);\n  if (!sourceScope || !targetScope) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!scopesEqual(sourceScope, targetScope)) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot move folders between scopes\",\n    });\n  }\n  await requireScopeAccess(userId, sourceScope, \"WRITE\");\n\n  // Don't let a folder land under one of its own descendants.\n  let cursor: string | null = input.targetParentFolderId;\n  while (cursor) {\n    if (cursor === input.folderId) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message: \"Cannot move a folder into its own descendant\",\n      });\n    }\n    const node = await prisma.folder.findUnique({\n      where: { id: cursor },\n      select: { parentFolderId: true },\n    });\n    cursor = node?.parentFolderId ?? null;\n  }\n\n  await prisma.folder.update({\n    where: { id: input.folderId },\n    data: { parentFolderId: input.targetParentFolderId },\n  });\n  return { success: true };\n}\n\nexport async function getFolderUploadUrls(\n  userId: string,\n  input: { folderId: string; files: DirectFileData[] }\n) {\n  await requireFolderAccess(userId, input.folderId, \"WRITE\");\n  return createDirectUploadFiles(input.files, userId, input.folderId);\n}\n\nexport async function confirmFolderUpload(\n  _userId: string,\n  input: { fileId: string; uploadSuccess: boolean; errorMessage?: string }\n) {\n  // Permission was already checked at upload-url issuance — the file record\n  // exists with PENDING status, and the user holds the session id needed to\n  // PUT bytes. Confirming flips status, so we just trust the call.\n  await confirmDirectUpload(\n    input.fileId,\n    input.uploadSuccess,\n    input.errorMessage\n  );\n  return { success: true };\n}\n\n/** What scopes can this user pick from in cloud-storage UIs? */\nexport async function listUserScopes(userId: string) {\n  const memberships = await prisma.schoolMembership.findMany({\n    where: { userId, status: \"ACTIVE\" },\n    select: {\n      role: true,\n      school: {\n        select: { id: true, name: true, logoId: true },\n      },\n    },\n    orderBy: { createdAt: \"asc\" },\n  });\n\n  const classes = await prisma.class.findMany({\n    where: {\n      OR: [\n        { teachers: { some: { id: userId } } },\n        { students: { some: { id: userId } } },\n      ],\n    },\n    select: {\n      id: true,\n      name: true,\n      subject: true,\n      section: true,\n      color: true,\n      schoolId: true,\n    },\n    orderBy: { name: \"asc\" },\n  });\n\n  return {\n    personal: { kind: \"PERSONAL\" as const, userId },\n    schools: memberships.map((m) => ({\n      id: m.school.id,\n      name: m.school.name,\n      logoId: m.school.logoId,\n      role: m.role,\n    })),\n    classes,\n  };\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAEL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EAEvB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAS9B,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,KAAiB,EACjB,KAAkB;IAElB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC5B,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;oBACzD,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;iBAC1D;aACF,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ;gBACtC,CAAC,CAAC,OAAO,CACL,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;oBACtC,KAAK,EAAE;wBACL,QAAQ,EAAE,SAAS,CAAC,QAAQ;wBAC5B,MAAM;wBACN,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,QAAQ;qBACjB;oBACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;iBACrB,CAAC,CACH;gBACH,CAAC,CAAC,KAAK,CAAC;YACV,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/C,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,qCAAqC;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa,CAAC;YAC5C,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,4CAA4C;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBACzD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,yCAAyC;iBACnD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC;YAC/D,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,QAAgB,EAChB,KAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,CAAa,EAAE,CAAa;IAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,OAAO,KAAM,CAAc,CAAC,OAAO,CAAC;QAC/C,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,KAAM,CAAc,CAAC,QAAQ,CAAC;QACjD,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,MAAM,KAAM,CAAc,CAAC,MAAM,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmD;IAEnD,IAAI,KAAiB,CAAC;IACtB,IAAI,QAA4B,CAAC;IAEjC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,sBAAsB,CAAC,QAAQ,CAAC;QAChC,qBAAqB,CAAC,QAAQ,CAAC;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,MAAM;QACN,WAAW;QACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAiB;IACnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACzE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACrE,yCAAyC;IACzC,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,6DAA6D;IAC7D,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAKC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,QAAQ,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACvB,cAAc,EAAE,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAA0D;IAE1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,YAAY,CACjB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EACjC,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAyD;IAEzD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,CAAC;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAEvD,4DAA4D;IAC5D,IAAI,MAAM,GAAkB,KAAK,CAAC,oBAAoB,CAAC;IACvD,OAAO,MAAM,EAAE,CAAC;QACd,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,oBAAoB,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAoD;IAEpD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,KAAwE;IAExE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,mBAAmB,CACvB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,MAAM,EAAE;gBACN,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;aAC/C;SACF;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;KAC9B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE;YACL,EAAE,EAAE;gBACF,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACtC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;aACvC;SACF;QACD,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;SACf;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE;QAC/C,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;QACH,OAAO;KACR,CAAC;AACJ,CAAC","debug_id":"1e1a55f0-d115-5d93-9636-a89ae577bf45"}
+{"version":3,"file":"folder.js","sources":["services/folder.ts"],"sourceRoot":"/","sourcesContent":["/**\n * Folder service — single source of truth for folders across every scope.\n *\n * A `Folder` can live inside one of four scopes (see `models/cloudStorage.ts`):\n * class files, school storage, school documents, or a user's personal storage.\n * Permissions and ownership are derived from the scope by walking up the tree\n * to the root, so callers can either pass a `scope` (when there is no folder\n * id yet, e.g. browsing the root) or just a `folderId` (everything else).\n *\n * The class files page and the global cloud-storage view both consume these\n * endpoints — no duplicate routers.\n */\nimport { TRPCError } from \"@trpc/server\";\nimport { prisma } from \"../lib/prisma.js\";\nimport {\n  CloudScope,\n  createSubFolder,\n  deleteFolderById,\n  findFolderById,\n  findFolderWithContents,\n  findOrCreateScopeRoot,\n  listFolderBreadcrumbs,\n  renameFolder,\n  resolveFolderScope,\n} from \"../models/cloudStorage.js\";\nimport {\n  createDirectUploadFiles,\n  type DirectFileData,\n  confirmDirectUpload,\n} from \"../lib/fileUpload.js\";\nimport {\n  type AccessLevel,\n  getScopeDefault,\n  listSharedWithMe,\n  requireFolderAccess as requireFolderAccessResolved,\n} from \"./permissions.js\";\n\ninterface AccessResult {\n  scope: CloudScope;\n  canWrite: boolean;\n  /**\n   * True when the viewer's access comes through an explicit grant rather than\n   * scope membership. Used by `browseFolder` to surface a \"Shared with me\"\n   * heading instead of the underlying scope's title — the grantee shouldn't\n   * see the folder labelled with the owner's scope.\n   */\n  viaGrant: boolean;\n}\n\n/**\n * Scope-default-only check: used when there is no folder id yet (browsing or\n * creating at the scope root). Does *not* consult explicit grants — those only\n * apply to specific folders. Explicit-grant access to sub-folders surfaces via\n * the \"Shared with me\" virtual scope, not by being a scope member.\n */\nasync function requireScopeAccess(\n  userId: string,\n  scope: CloudScope,\n  level: AccessLevel\n): Promise<AccessResult> {\n  if (scope.kind === \"CLASS\") {\n    const classExists = await prisma.class.findFirst({\n      where: { id: scope.classId },\n      select: { id: true },\n    });\n    if (!classExists) {\n      throw new TRPCError({ code: \"NOT_FOUND\", message: \"Class not found\" });\n    }\n  }\n  const granted = await getScopeDefault(userId, scope);\n  if (!granted) {\n    throw new TRPCError({\n      code: \"FORBIDDEN\",\n      message:\n        scope.kind === \"CLASS\"\n          ? \"You don't have access to this class\"\n          : scope.kind === \"SCHOOL_STORAGE\"\n          ? \"You aren't a member of this institution\"\n          : \"You can only access your own personal storage\",\n    });\n  }\n  if (level === \"WRITE\" && granted !== \"WRITE\") {\n    throw new TRPCError({\n      code: \"FORBIDDEN\",\n      message:\n        scope.kind === \"CLASS\"\n          ? \"Only class teachers can modify class files\"\n          : \"Only teachers and admins can modify institution storage\",\n    });\n  }\n  // Scope-default-only path; access cannot be via a grant here.\n  return { scope, canWrite: granted === \"WRITE\", viaGrant: false };\n}\n\n/**\n * Folder-level access check. Delegates to the central resolver which consults\n * explicit grants in addition to the scope default. Returns the scope and a\n * canWrite flag indicating whether the user has WRITE here (used by the UI to\n * gate the \"New folder\" / \"Upload\" buttons during a READ-level browse).\n *\n * Pass `mutatesSelf: true` for actions that target the folder itself (rename,\n * delete, move-this-folder). Drive-style: explicit grants don't authorize\n * those — only scope-default WRITE does. Mutations of children should NOT\n * pass this flag.\n */\nexport async function requireFolderAccess(\n  userId: string,\n  folderId: string,\n  level: AccessLevel,\n  opts: { mutatesSelf?: boolean } = {}\n): Promise<AccessResult> {\n  const result = await requireFolderAccessResolved(userId, folderId, level, opts);\n  if (!result.scope) {\n    // resolveFolderScope returns null only for missing folders; the resolver\n    // would have already thrown NOT_FOUND in that case.\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  let canWrite = result.scopeDefault === \"WRITE\";\n  if (!canWrite && level !== \"WRITE\") {\n    // We came in with READ; check whether the user *also* has WRITE so the UI\n    // can show the right affordances. Cheaper to do this only when needed.\n    try {\n      await requireFolderAccessResolved(userId, folderId, \"WRITE\");\n      canWrite = true;\n    } catch {\n      canWrite = false;\n    }\n  } else if (level === \"WRITE\") {\n    canWrite = true;\n  }\n  return { scope: result.scope, canWrite, viaGrant: result.viaGrant };\n}\n\nfunction scopesEqual(a: CloudScope, b: CloudScope): boolean {\n  if (a.kind !== b.kind) return false;\n  switch (a.kind) {\n    case \"CLASS\":\n      return a.classId === (b as typeof a).classId;\n    case \"SCHOOL_STORAGE\":\n      return a.schoolId === (b as typeof a).schoolId;\n    case \"PERSONAL\":\n      return a.userId === (b as typeof a).userId;\n  }\n}\n\n/** Browse a folder. Pass `folderId` to drill into a specific folder, or a `scope` to land on its root. */\nexport async function browseFolder(\n  userId: string,\n  input: { folderId: string } | { scope: CloudScope }\n) {\n  let scope: CloudScope;\n  let folderId: string | undefined;\n  let canWrite: boolean;\n  let viaGrant: boolean;\n\n  if (\"folderId\" in input) {\n    folderId = input.folderId;\n    // `requireFolderAccess` consults explicit grants in addition to the scope\n    // default, so users can drill into folders shared with them via \"Shared\n    // with me\" without being scope members.\n    const access = await requireFolderAccess(userId, folderId, \"READ\");\n    scope = access.scope;\n    canWrite = access.canWrite;\n    viaGrant = access.viaGrant;\n  } else {\n    scope = input.scope;\n    const access = await requireScopeAccess(userId, scope, \"READ\");\n    canWrite = access.canWrite;\n    viaGrant = false;\n  }\n\n  const targetId = folderId ?? (await findOrCreateScopeRoot(scope)).id;\n\n  const [folder, breadcrumbs] = await Promise.all([\n    findFolderWithContents(targetId),\n    listFolderBreadcrumbs(targetId, userId),\n  ]);\n\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n\n  return {\n    folder,\n    breadcrumbs,\n    canWrite,\n    scope,\n    /**\n     * When the viewer's access comes through an explicit grant (not scope\n     * membership), the UI should label the root as \"Shared with me\" rather\n     * than the underlying scope's title. The grantee may not even be a\n     * member of that scope — showing \"My Files\" or \"Class Files\" would be\n     * misleading. Null when the viewer is a regular scope member.\n     */\n    displayRoot: viaGrant\n      ? { kind: \"SHARED_WITH_ME\" as const, name: \"Shared with me\" }\n      : null,\n  };\n}\n\n/**\n * Drive-style \"Shared with me\" — surfaces every top-most folder/file the user\n * has an explicit grant on (filtering out anything already covered by their\n * scope defaults). Shaped like a folder so the existing folder-browser UI can\n * render it without special cases.\n *\n * The pseudo-folder has a synthetic id (`shared-with-me`) and the foreign-key\n * columns set to null — the UI should never try to mutate it directly. The\n * union shape matches `browseFolder`'s return type so the same client query\n * can render either.\n */\nexport async function browseSharedWithMe(userId: string) {\n  const { folders } = await listSharedWithMe(userId);\n  return {\n    folder: {\n      id: \"shared-with-me\",\n      name: \"Shared with me\",\n      color: null,\n      classId: null,\n      schoolStorageId: null,\n      personalOwnerId: null,\n      scope: \"GENERIC\" as const,\n      parentFolderId: null,\n      parentFolder: null,\n      childFolders: folders.map((f) => ({\n        id: f.id,\n        name: f.name,\n        color: f.color,\n        _count: { files: 0, childFolders: 0 },\n      })),\n      // No file-level grants in v1 — files always live under a granted folder.\n      files: [] as {\n        id: string;\n        name: string;\n        type: string;\n        size: number | null;\n        path: string;\n        uploadedAt: Date | null;\n        user: { id: string; username: string } | null;\n      }[],\n    },\n    breadcrumbs: [{ id: \"shared-with-me\", name: \"Shared with me\" }],\n    canWrite: false,\n    scope: { kind: \"PERSONAL\" as const, userId } satisfies CloudScope,\n    /** Same `displayRoot` shape as `browseFolder` so the client union is uniform. */\n    displayRoot: {\n      kind: \"SHARED_WITH_ME\" as const,\n      name: \"Shared with me\",\n    },\n  };\n}\n\nexport async function getRootFolder(userId: string, scope: CloudScope) {\n  const result = await browseFolder(userId, { scope });\n  return result.folder;\n}\n\nexport async function getFolder(userId: string, folderId: string) {\n  const result = await browseFolder(userId, { folderId });\n  return result.folder;\n}\n\nexport async function getFolderBreadcrumbs(userId: string, folderId: string) {\n  await requireFolderAccess(userId, folderId, \"READ\");\n  return listFolderBreadcrumbs(folderId);\n}\n\nexport async function getFolderParents(userId: string, folderId: string) {\n  // Permission: user can read this folder.\n  await requireFolderAccess(userId, folderId, \"READ\");\n  const breadcrumbs = await listFolderBreadcrumbs(folderId);\n  // Existing API returned full folder records — re-fetch them.\n  return Promise.all(\n    breadcrumbs.map((b) => findFolderById(b.id))\n  );\n}\n\nexport async function createFolderRecord(\n  userId: string,\n  input: {\n    name: string;\n    parentFolderId?: string | null;\n    color?: string;\n    scope?: CloudScope;\n  }\n) {\n  let parentId: string;\n  if (input.parentFolderId) {\n    parentId = input.parentFolderId;\n    await requireFolderAccess(userId, parentId, \"WRITE\");\n  } else {\n    if (!input.scope) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message: \"scope is required when parentFolderId is omitted\",\n      });\n    }\n    await requireScopeAccess(userId, input.scope, \"WRITE\");\n    parentId = (await findOrCreateScopeRoot(input.scope)).id;\n  }\n  return createSubFolder({\n    name: input.name.trim(),\n    parentFolderId: parentId,\n    color: input.color,\n  });\n}\n\nexport async function updateFolderRecord(\n  userId: string,\n  input: { folderId: string; name?: string; color?: string }\n) {\n  const folder = await findFolderById(input.folderId);\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!folder.parentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot rename a root folder\",\n    });\n  }\n  // Rename targets the folder itself — Drive-style guard reserves this for\n  // scope-default WRITE (explicit grants don't authorize renaming the share).\n  await requireFolderAccess(userId, input.folderId, \"WRITE\", {\n    mutatesSelf: true,\n  });\n  return renameFolder(\n    input.folderId,\n    input.name?.trim() ?? folder.name,\n    input.color\n  );\n}\n\nexport async function deleteFolder(userId: string, folderId: string) {\n  const folder = await findFolderById(folderId);\n  if (!folder) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!folder.parentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot delete a root folder\",\n    });\n  }\n  // Delete targets the folder itself — same Drive-style guard as rename.\n  await requireFolderAccess(userId, folderId, \"WRITE\", { mutatesSelf: true });\n  await deleteFolderById(folderId);\n  return { success: true };\n}\n\nexport async function moveFolder(\n  userId: string,\n  input: { folderId: string; targetParentFolderId: string }\n) {\n  if (input.folderId === input.targetParentFolderId) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot move a folder into itself\",\n    });\n  }\n  const [sourceScope, targetScope] = await Promise.all([\n    resolveFolderScope(input.folderId),\n    resolveFolderScope(input.targetParentFolderId),\n  ]);\n  if (!sourceScope || !targetScope) {\n    throw new TRPCError({ code: \"NOT_FOUND\", message: \"Folder not found\" });\n  }\n  if (!scopesEqual(sourceScope, targetScope)) {\n    throw new TRPCError({\n      code: \"BAD_REQUEST\",\n      message: \"Cannot move folders between scopes\",\n    });\n  }\n  // Moving the folder targets it (and the new parent's contents). Source-side\n  // is mutates-self; target-side is regular WRITE on the new parent.\n  await requireFolderAccess(userId, input.folderId, \"WRITE\", {\n    mutatesSelf: true,\n  });\n  await requireFolderAccess(userId, input.targetParentFolderId, \"WRITE\");\n\n  // Don't let a folder land under one of its own descendants.\n  let cursor: string | null = input.targetParentFolderId;\n  while (cursor) {\n    if (cursor === input.folderId) {\n      throw new TRPCError({\n        code: \"BAD_REQUEST\",\n        message: \"Cannot move a folder into its own descendant\",\n      });\n    }\n    const node = await prisma.folder.findUnique({\n      where: { id: cursor },\n      select: { parentFolderId: true },\n    });\n    cursor = node?.parentFolderId ?? null;\n  }\n\n  await prisma.folder.update({\n    where: { id: input.folderId },\n    data: { parentFolderId: input.targetParentFolderId },\n  });\n  return { success: true };\n}\n\nexport async function getFolderUploadUrls(\n  userId: string,\n  input: { folderId: string; files: DirectFileData[] }\n) {\n  await requireFolderAccess(userId, input.folderId, \"WRITE\");\n  return createDirectUploadFiles(input.files, userId, input.folderId);\n}\n\nexport async function confirmFolderUpload(\n  _userId: string,\n  input: { fileId: string; uploadSuccess: boolean; errorMessage?: string }\n) {\n  // Permission was already checked at upload-url issuance — the file record\n  // exists with PENDING status, and the user holds the session id needed to\n  // PUT bytes. Confirming flips status, so we just trust the call.\n  await confirmDirectUpload(\n    input.fileId,\n    input.uploadSuccess,\n    input.errorMessage\n  );\n  return { success: true };\n}\n\n/** What scopes can this user pick from in cloud-storage UIs? */\nexport async function listUserScopes(userId: string) {\n  const memberships = await prisma.schoolMembership.findMany({\n    where: { userId, status: \"ACTIVE\" },\n    select: {\n      role: true,\n      school: {\n        select: { id: true, name: true, logoId: true },\n      },\n    },\n    orderBy: { createdAt: \"asc\" },\n  });\n\n  const classes = await prisma.class.findMany({\n    where: {\n      OR: [\n        { teachers: { some: { id: userId } } },\n        { students: { some: { id: userId } } },\n      ],\n    },\n    select: {\n      id: true,\n      name: true,\n      subject: true,\n      section: true,\n      color: true,\n      schoolId: true,\n    },\n    orderBy: { name: \"asc\" },\n  });\n\n  // Light counts for the \"Shared with me\" bucket so the UI can hide the entry\n  // when there's nothing to show. Cheap to compute — just counts top-most\n  // grants, not folder/file metadata.\n  const sharedWithMe = await listSharedWithMe(userId);\n\n  return {\n    personal: { kind: \"PERSONAL\" as const, userId },\n    schools: memberships.map((m) => ({\n      id: m.school.id,\n      name: m.school.name,\n      logoId: m.school.logoId,\n      role: m.role,\n    })),\n    classes,\n    sharedWithMe: {\n      kind: \"SHARED_WITH_ME\" as const,\n      folderCount: sharedWithMe.folders.length,\n      fileCount: sharedWithMe.files.length,\n    },\n  };\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAEL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EAEvB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,IAAI,2BAA2B,GACnD,MAAM,kBAAkB,CAAC;AAc1B;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,KAAiB,EACjB,KAAkB;IAElB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EACL,KAAK,CAAC,IAAI,KAAK,OAAO;gBACpB,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;oBACjC,CAAC,CAAC,yCAAyC;oBAC3C,CAAC,CAAC,+CAA+C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EACL,KAAK,CAAC,IAAI,KAAK,OAAO;gBACpB,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,yDAAyD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,8DAA8D;IAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,KAAK,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,QAAgB,EAChB,KAAkB,EAClB,OAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,GAAG,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACnC,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7D,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,CAAa,EAAE,CAAa;IAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,OAAO,KAAM,CAAc,CAAC,OAAO,CAAC;QAC/C,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,KAAM,CAAc,CAAC,QAAQ,CAAC;QACjD,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,MAAM,KAAM,CAAc,CAAC,MAAM,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmD;IAEnD,IAAI,KAAiB,CAAC;IACtB,IAAI,QAA4B,CAAC;IACjC,IAAI,QAAiB,CAAC;IACtB,IAAI,QAAiB,CAAC;IAEtB,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,0EAA0E;QAC1E,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,sBAAsB,CAAC,QAAQ,CAAC;QAChC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,MAAM;QACN,WAAW;QACX,QAAQ;QACR,KAAK;QACL;;;;;;WAMG;QACH,WAAW,EAAE,QAAQ;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE;YAC7D,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE;YACN,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,SAAkB;YACzB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aACtC,CAAC,CAAC;YACH,yEAAyE;YACzE,KAAK,EAAE,EAQJ;SACJ;QACD,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC/D,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAuB;QACjE,iFAAiF;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,gBAAyB;YAC/B,IAAI,EAAE,gBAAgB;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAiB;IACnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACzE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACrE,yCAAyC;IACzC,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,6DAA6D;IAC7D,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAKC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,QAAQ,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACvB,cAAc,EAAE,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAA0D;IAE1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE;QACzD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,YAAY,CACjB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EACjC,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAyD;IAEzD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,CAAC;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE;QACzD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAEvE,4DAA4D;IAC5D,IAAI,MAAM,GAAkB,KAAK,CAAC,oBAAoB,CAAC;IACvD,OAAO,MAAM,EAAE,CAAC;QACd,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,oBAAoB,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAoD;IAEpD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,KAAwE;IAExE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,mBAAmB,CACvB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,MAAM,EAAE;gBACN,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;aAC/C;SACF;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;KAC9B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE;YACL,EAAE,EAAE;gBACF,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACtC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;aACvC;SACF;QACD,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;SACf;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE;QAC/C,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;QACH,OAAO;QACP,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAyB;YAC/B,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM;YACxC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM;SACrC;KACF,CAAC;AACJ,CAAC","debug_id":"338c145a-d8eb-5931-9a42-2a9c7c9acc94"}

package/dist/services/labChat.d.ts

@@ -50,8 +50,8 @@ export declare function createLabChat(userId: string, input: {
     id: string;
     createdAt: Date;
     updatedAt: Date;
-    conversationId: string;
     classId: string;
+    conversationId: string;
     title: string;
     createdById: string;
 }>;
@@ -103,8 +103,8 @@ export declare function getLabChat(userId: string, labChatId: string): Promise<{
     id: string;
     createdAt: Date;
     updatedAt: Date;
-    conversationId: string;
     classId: string;
+    conversationId: string;
     title: string;
     createdById: string;
 }>;

package/dist/services/permissions.d.ts

@@ -0,0 +1,188 @@
+import { type CloudScope } from "../models/cloudStorage.js";
+export type AccessLevel = "READ" | "WRITE";
+/**
+ * The set of "audiences" a user belongs to that an explicit grant can match.
+ * Generated once per request via `expandUserPrincipals` and threaded through
+ * the resolver.
+ */
+export interface UserPrincipals {
+    userId: string;
+    tagIds: string[];
+    classTeacherIds: string[];
+    classStudentIds: string[];
+    /** Union of teacher + student class memberships (i.e. all CLASS principals). */
+    classIds: string[];
+    departmentIds: string[];
+    /** Active school memberships only. */
+    schoolIds: string[];
+}
+/**
+ * Build the audience set for a user. Cheap (5 queries, all id-only) but worth
+ * caching per request — most permission checks in a single tRPC call hit this.
+ */
+export declare function expandUserPrincipals(userId: string): Promise<UserPrincipals>;
+/** Walk up to the scope root, collecting folder ids visited along the way (inclusive). */
+declare function findAncestorIds(folderId: string): Promise<string[]>;
+export { findAncestorIds };
+/**
+ * Compute the scope default for a user — i.e. the access level the existing
+ * scope-derived rules grant, *before* any explicit ACL is consulted.
+ *
+ * Mirrors the logic that used to live in `requireScopeAccess` in folder.ts.
+ * Returns "WRITE" / "READ" / null.
+ */
+export declare function getScopeDefault(userId: string, scope: CloudScope): Promise<AccessLevel | null>;
+export interface AccessResult {
+    scope: CloudScope | null;
+    scopeDefault: AccessLevel | null;
+    /** Truthy if the resolver returned because of an explicit grant (folder or file). */
+    viaGrant: boolean;
+}
+/**
+ * Permission gate for folder-scoped operations. Throws TRPCError on denial,
+ * returns the scope (and which path granted access) on success.
+ *
+ * `opts.mutatesSelf` (Drive-style guard): when true, the action targets the
+ * folder *itself* — rename, delete, move-this-folder. Explicit grants do NOT
+ * authorize these; only scope-default WRITE does. This means a teacher sharing
+ * "Math Resources" with the parents tag can let parents read/edit children of
+ * the folder, but parents cannot rename or delete the share root. Mutations
+ * targeting *children* of the folder (uploads, sub-folders, child renames)
+ * pass `mutatesSelf: false` and flow through the normal grant + ancestor +
+ * scope-default path.
+ */
+export declare function requireFolderAccess(userId: string, folderId: string, level: AccessLevel, opts?: {
+    mutatesSelf?: boolean;
+}): Promise<AccessResult>;
+/**
+ * Permission gate for file-scoped operations. Dispatches on whichever context
+ * relation the file carries, so every kind of file (cloud-storage, chat
+ * attachment, assignment / submission / annotation / announcement / class-draft
+ * attachment, school logo) gets authorized through one entry point.
+ *
+ * Resolution order — first match wins:
+ *   1. **Owner** — `file.userId === user`. Always WRITE.
+ *   2. **Folder-bound** — delegate to `requireFolderAccess` (handles scope
+ *      defaults + explicit grants + ancestor inheritance).
+ *   3. **Conversation/message attachment** — any conversation member READs;
+ *      only the sender (= owner, handled in step 1) WRITEs.
+ *   4. **Assignment attachment** — class teacher/admin RW, class student R.
+ *   5. **Submission file** — submission's student RW (until grading workflow
+ *      locks it down), class teacher/admin R.
+ *   6. **Annotation file** — class teacher/admin RW, submission's student R.
+ *   7. **Announcement attachment** — class teacher/admin RW, class student R.
+ *   8. **Class-draft attachment** — class teacher/admin RW (drafts have no
+ *      students yet in practice).
+ *   9. **School logo** — any active school member R, school admin W.
+ *  10. **Otherwise** (incl. SDP supporting docs) — owner-only fallback already
+ *      covered by step 1; deny.
+ */
+export declare function requireFileAccess(userId: string, fileId: string, level: AccessLevel): Promise<AccessResult>;
+/**
+ * Top-most-grant computation: surface every folder the user has an explicit
+ * grant on whose nearest permissioned ancestor the user does *not* also hold a
+ * grant on, AND whose scope default does not already grant access. That second
+ * filter avoids "Shared with me" duplicating things you already see in your
+ * normal class/school/personal scopes.
+ *
+ * Files are not surfaced here — file-level grants are deferred to a future
+ * feature; in v1 files inherit from their folder.
+ */
+export declare function listSharedWithMe(userId: string): Promise<{
+    folders: {
+        id: string;
+        name: string;
+        color: string | null;
+    }[];
+    files: never[];
+}>;
+export type PermissionPrincipalInput = {
+    kind: "USER";
+    userId: string;
+} | {
+    kind: "TAG";
+    tagId: string;
+} | {
+    kind: "CLASS";
+    classId: string;
+} | {
+    kind: "CLASS_TEACHERS";
+    classId: string;
+} | {
+    kind: "CLASS_STUDENTS";
+    classId: string;
+} | {
+    kind: "DEPARTMENT";
+    departmentId: string;
+} | {
+    kind: "SCHOOL";
+    schoolId: string;
+};
+/**
+ * Create a new explicit grant on a folder. Validates:
+ *   - Granter has WRITE on the folder.
+ *   - The principal is in the same school as the folder's scope (no
+ *     cross-school leaks). Personal-scope folders cannot be granted to
+ *     non-USER principals — there's no "school" to check membership against.
+ */
+export declare function grantPermission(grantedById: string, input: {
+    folderId: string;
+    principal: PermissionPrincipalInput;
+    level: AccessLevel;
+}): Promise<{
+    level: import(".prisma/client").$Enums.PermissionLevel;
+    id: string;
+    createdAt: Date;
+    schoolId: string | null;
+    userId: string | null;
+    departmentId: string | null;
+    folderId: string;
+    principalType: import(".prisma/client").$Enums.PermissionPrincipalType;
+    tagId: string | null;
+    classId: string | null;
+    grantedById: string;
+}>;
+/** Revoke a grant. Allowed for the granter or anyone with WRITE on the folder. */
+export declare function revokePermission(userId: string, permissionId: string): Promise<{
+    success: boolean;
+}>;
+/** List all explicit grants on a folder. Caller must have WRITE on it. */
+export declare function listPermissions(userId: string, folderId: string): Promise<({
+    school: {
+        name: string;
+        id: string;
+    } | null;
+    user: {
+        id: string;
+        username: string;
+        email: string;
+    } | null;
+    class: {
+        name: string;
+        id: string;
+        section: string;
+    } | null;
+    department: {
+        name: string;
+        id: string;
+        color: string | null;
+    } | null;
+    tag: {
+        name: string;
+        id: string;
+        color: string;
+    } | null;
+} & {
+    level: import(".prisma/client").$Enums.PermissionLevel;
+    id: string;
+    createdAt: Date;
+    schoolId: string | null;
+    userId: string | null;
+    departmentId: string | null;
+    folderId: string;
+    principalType: import(".prisma/client").$Enums.PermissionPrincipalType;
+    tagId: string | null;
+    classId: string | null;
+    grantedById: string;
+})[]>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/services/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"/","sources":["services/permissions.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,sCAAsC;IACtC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAoCzB;AA0DD,0FAA0F;AAC1F,iBAAe,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBlE;AAED,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6C7B;AAwBD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACnC,OAAO,CAAC,YAAY,CAAC,CAoCvB;AA0CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,YAAY,CAAC,CAsHvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9D,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9D,KAAK,EAAE,KAAK,EAAE,CAAC;CAChB,CAAC,CAoCD;AAMD,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AA8GzC;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,wBAAwB,CAAC;IACpC,KAAK,EAAE,WAAW,CAAC;CACpB;;;;;;;;;;;;GA6DF;AAED,kFAAkF;AAClF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;GAa1E;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAarE"}