@studious-lms/server 1.9.0 → 1.12.0

package/dist/trpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"trpc.js","sources":["trpc.ts"],"sourceRoot":"/","sourcesContent":["import { initTRPC, TRPCError } from '@trpc/server';\nimport { ZodError } from 'zod';\nimport { logger } from './utils/logger.js';\nimport { createLoggingMiddleware } from './middleware/logging.js';\nimport { createAuthMiddleware } from './middleware/auth.js';\nimport { Request, Response } from 'express';\nimport { z } from 'zod';\nimport { handlePrismaError, PrismaErrorInfo } from './utils/prismaErrorHandler.js';\nimport { findUserBySessionToken } from './models/auth.js';\n\ninterface CreateContextOptions {\n  req: Request;\n  res: Response;\n}\n\nexport type Context = {\n  req: Request;\n  res: Response;\n  user: { id: string } | null;\n  meta?: {\n    classId?: string;\n    institutionId?: string;\n  };\n};\n\nexport const createTRPCContext = async (opts: CreateContextOptions): Promise<Context> => {\n  const { req, res } = opts;\n\n  const userHeader = req.headers[\"x-user\"];\n  const tokenFromUserHeader = typeof userHeader === \"string\" ? userHeader : userHeader?.[0];\n  const authorizationHeader = req.headers.authorization;\n  const tokenFromAuthorization =\n    typeof authorizationHeader === \"string\" && authorizationHeader.startsWith(\"Bearer \")\n      ? authorizationHeader.slice(7)\n      : null;\n  const token = tokenFromUserHeader ?? tokenFromAuthorization;\n  const user = token ? await findUserBySessionToken(token) : null;\n\n  return {\n    req,\n    res,\n    user,\n    meta: {},\n  };\n};\n\nexport const t = initTRPC.context<Context>().create({\n  errorFormatter({ shape, error }) {\n    // Handle Prisma errors specifically\n    let prismaErrorInfo: PrismaErrorInfo | null = null;\n    if (error.cause) {\n      try {\n        prismaErrorInfo = handlePrismaError(error.cause);\n      } catch (e) {\n        // If Prisma error handling fails, continue with normal error handling\n      }\n    }\n\n    logger.error('tRPC Error', {\n      code: shape.code,\n      message: error.message,\n      cause: error.cause,\n      stack: error.stack,\n      prismaError: prismaErrorInfo,\n    });\n\n    return {\n      ...shape,\n      data: {\n        ...shape.data,\n        zodError:\n          error.cause instanceof ZodError ? error.cause.flatten() : null,\n        prismaError: prismaErrorInfo,\n      },\n    };\n  },\n});\n\n// Create middleware\nconst loggingMiddleware = createLoggingMiddleware(t);\nconst { isAuthed, isMemberInClass, isTeacherInClass } = createAuthMiddleware(t);\n\n// Base procedures\nexport const createTRPCRouter = t.router;\nexport const publicProcedure = t.procedure.use(loggingMiddleware);\n\n\n// Protected procedures\nexport const protectedProcedure = publicProcedure.use(isAuthed);\n\nexport const protectedClassMemberProcedure = protectedProcedure\n  .input(z.object({ classId: z.string() }).passthrough())\n  .use(isMemberInClass);\n\nexport const protectedTeacherProcedure = protectedProcedure\n  .input(z.object({ classId: z.string() }).passthrough())\n  .use(isTeacherInClass);\n\n\n// Create caller factory\nexport const createCallerFactory = t.createCallerFactory; "],"names":[],"mappings":";;AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAmB,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAiB1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA0B,EAAoB,EAAE;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACtD,MAAM,sBAAsB,GAC1B,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;QAClF,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAG,mBAAmB,IAAI,sBAAsB,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhE,OAAO;QACL,GAAG;QACH,GAAG;QACH,IAAI;QACJ,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAW,CAAC,MAAM,CAAC;IAClD,cAAc,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QAC7B,oCAAoC;QACpC,IAAI,eAAe,GAA2B,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE;YACzB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE;gBACJ,GAAG,KAAK,CAAC,IAAI;gBACb,QAAQ,EACN,KAAK,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;gBAChE,WAAW,EAAE,eAAe;aAC7B;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;AACrD,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAEhF,kBAAkB;AAClB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAGlE,uBAAuB;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB;KAC5D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KACtD,GAAG,CAAC,eAAe,CAAC,CAAC;AAExB,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB;KACxD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KACtD,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAGzB,wBAAwB;AACxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC","debug_id":"6b11f8e8-b33f-5cae-aab3-08d27c3e81e9"}
+{"version":3,"file":"trpc.js","sources":["trpc.ts"],"sourceRoot":"/","sourcesContent":["import { initTRPC, TRPCError } from '@trpc/server';\nimport { ZodError } from 'zod';\nimport { logger } from './utils/logger.js';\nimport { createLoggingMiddleware } from './middleware/logging.js';\nimport { createAuthMiddleware } from './middleware/auth.js';\nimport { Request, Response } from 'express';\nimport { z } from 'zod';\nimport { handlePrismaError, PrismaErrorInfo } from './utils/prismaErrorHandler.js';\nimport { findUserBySessionToken } from './models/auth.js';\nimport { assertAdminPanelUser } from './utils/adminPanelAccess.js';\n\ninterface CreateContextOptions {\n  req: Request;\n  res: Response;\n}\n\nexport type Context = {\n  req: Request;\n  res: Response;\n  user: { id: string } | null;\n  meta?: {\n    classId?: string;\n    institutionId?: string;\n  };\n};\n\nexport const createTRPCContext = async (opts: CreateContextOptions): Promise<Context> => {\n  const { req, res } = opts;\n\n  const userHeader = req.headers[\"x-user\"];\n  const tokenFromUserHeader = typeof userHeader === \"string\" ? userHeader : userHeader?.[0];\n  const authorizationHeader = req.headers.authorization;\n  const tokenFromAuthorization =\n    typeof authorizationHeader === \"string\" && authorizationHeader.startsWith(\"Bearer \")\n      ? authorizationHeader.slice(7)\n      : null;\n  const token = tokenFromUserHeader ?? tokenFromAuthorization;\n  const user = token ? await findUserBySessionToken(token) : null;\n\n  return {\n    req,\n    res,\n    user,\n    meta: {},\n  };\n};\n\nexport const t = initTRPC.context<Context>().create({\n  errorFormatter({ shape, error }) {\n    // Handle Prisma errors specifically\n    let prismaErrorInfo: PrismaErrorInfo | null = null;\n    if (error.cause) {\n      try {\n        prismaErrorInfo = handlePrismaError(error.cause);\n      } catch (e) {\n        // If Prisma error handling fails, continue with normal error handling\n      }\n    }\n\n    logger.error('tRPC Error', {\n      code: shape.code,\n      message: error.message,\n      cause: error.cause,\n      stack: error.stack,\n      prismaError: prismaErrorInfo,\n    });\n\n    return {\n      ...shape,\n      data: {\n        ...shape.data,\n        zodError:\n          error.cause instanceof ZodError ? error.cause.flatten() : null,\n        prismaError: prismaErrorInfo,\n      },\n    };\n  },\n});\n\n// Create middleware\nconst loggingMiddleware = createLoggingMiddleware(t);\nconst { isAuthed, isMemberInClass, isTeacherInClass } = createAuthMiddleware(t);\n\n// Base procedures\nexport const createTRPCRouter = t.router;\nexport const publicProcedure = t.procedure.use(loggingMiddleware);\n\n\n// Protected procedures\nexport const protectedProcedure = publicProcedure.use(isAuthed);\n\nconst adminPanelMiddleware = t.middleware(({ ctx, next }) => {\n  if (!ctx.user) {\n    throw new TRPCError({\n      code: 'UNAUTHORIZED',\n      message: 'Not authenticated',\n    });\n  }\n  assertAdminPanelUser(ctx.user.id);\n  return next({ ctx });\n});\n\n/** Authenticated + env allowlist (see `assertAdminPanelUser`). */\nexport const adminProcedure = protectedProcedure.use(adminPanelMiddleware);\n\nexport const protectedClassMemberProcedure = protectedProcedure\n  .input(z.object({ classId: z.string() }).passthrough())\n  .use(isMemberInClass);\n\nexport const protectedTeacherProcedure = protectedProcedure\n  .input(z.object({ classId: z.string() }).passthrough())\n  .use(isTeacherInClass);\n\n\n// Create caller factory\nexport const createCallerFactory = t.createCallerFactory; "],"names":[],"mappings":";;AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAmB,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAiBnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA0B,EAAoB,EAAE;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACtD,MAAM,sBAAsB,GAC1B,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;QAClF,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAG,mBAAmB,IAAI,sBAAsB,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhE,OAAO;QACL,GAAG;QACH,GAAG;QACH,IAAI;QACJ,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAW,CAAC,MAAM,CAAC;IAClD,cAAc,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QAC7B,oCAAoC;QACpC,IAAI,eAAe,GAA2B,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE;YACzB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE;gBACJ,GAAG,KAAK,CAAC,IAAI;gBACb,QAAQ,EACN,KAAK,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;gBAChE,WAAW,EAAE,eAAe;aAC7B;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;AACrD,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAEhF,kBAAkB;AAClB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAGlE,uBAAuB;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEhE,MAAM,oBAAoB,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;IAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB;KAC5D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KACtD,GAAG,CAAC,eAAe,CAAC,CAAC;AAExB,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB;KACxD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KACtD,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAGzB,wBAAwB;AACxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC","debug_id":"29e1f1ae-1333-5312-bcdb-8c944e9f0f07"}

package/dist/utils/adminPanelAccess.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin tRPC routes: in production `ADMIN_PANEL_USER_IDS` must be a non-empty
+ * comma/whitespace-separated list of user UUIDs. In non-production, an empty
+ * unset value allows any authenticated user (local ops); a non-empty list is
+ * still enforced.
+ */
+export declare function assertAdminPanelUser(userId: string): void;
+//# sourceMappingURL=adminPanelAccess.d.ts.map

package/dist/utils/adminPanelAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminPanelAccess.d.ts","sourceRoot":"/","sources":["utils/adminPanelAccess.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA0BzD"}

package/dist/utils/adminPanelAccess.js

@@ -0,0 +1,44 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c58bf633-ef92-5c8c-bfe2-f50882cb800c")}catch(e){}}();
+import { TRPCError } from '@trpc/server';
+import { env } from '../lib/config/env.js';
+function parseAdminUserIds(raw) {
+    if (!raw?.trim())
+        return new Set();
+    return new Set(raw
+        .split(/[\s,]+/)
+        .map((s) => s.trim())
+        .filter(Boolean));
+}
+/**
+ * Admin tRPC routes: in production `ADMIN_PANEL_USER_IDS` must be a non-empty
+ * comma/whitespace-separated list of user UUIDs. In non-production, an empty
+ * unset value allows any authenticated user (local ops); a non-empty list is
+ * still enforced.
+ */
+export function assertAdminPanelUser(userId) {
+    const allowed = parseAdminUserIds(env.ADMIN_PANEL_USER_IDS);
+    if (env.NODE_ENV === 'production') {
+        if (allowed.size === 0) {
+            throw new TRPCError({
+                code: 'FORBIDDEN',
+                message: 'Admin API disabled: set ADMIN_PANEL_USER_IDS to a non-empty list of user ids.',
+            });
+        }
+        if (!allowed.has(userId)) {
+            throw new TRPCError({
+                code: 'FORBIDDEN',
+                message: 'You are not allowed to use the admin API.',
+            });
+        }
+        return;
+    }
+    if (allowed.size > 0 && !allowed.has(userId)) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: 'You are not allowed to use the admin API.',
+        });
+    }
+}
+//# sourceMappingURL=adminPanelAccess.js.map
+//# debugId=c58bf633-ef92-5c8c-bfe2-f50882cb800c

package/dist/utils/adminPanelAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminPanelAccess.js","sources":["utils/adminPanelAccess.ts"],"sourceRoot":"/","sourcesContent":["import { TRPCError } from '@trpc/server';\nimport { env } from '../lib/config/env.js';\n\nfunction parseAdminUserIds(raw: string | undefined): Set<string> {\n  if (!raw?.trim()) return new Set();\n  return new Set(\n    raw\n      .split(/[\\s,]+/)\n      .map((s) => s.trim())\n      .filter(Boolean),\n  );\n}\n\n/**\n * Admin tRPC routes: in production `ADMIN_PANEL_USER_IDS` must be a non-empty\n * comma/whitespace-separated list of user UUIDs. In non-production, an empty\n * unset value allows any authenticated user (local ops); a non-empty list is\n * still enforced.\n */\nexport function assertAdminPanelUser(userId: string): void {\n  const allowed = parseAdminUserIds(env.ADMIN_PANEL_USER_IDS);\n\n  if (env.NODE_ENV === 'production') {\n    if (allowed.size === 0) {\n      throw new TRPCError({\n        code: 'FORBIDDEN',\n        message:\n          'Admin API disabled: set ADMIN_PANEL_USER_IDS to a non-empty list of user ids.',\n      });\n    }\n    if (!allowed.has(userId)) {\n      throw new TRPCError({\n        code: 'FORBIDDEN',\n        message: 'You are not allowed to use the admin API.',\n      });\n    }\n    return;\n  }\n\n  if (allowed.size > 0 && !allowed.has(userId)) {\n    throw new TRPCError({\n      code: 'FORBIDDEN',\n      message: 'You are not allowed to use the admin API.',\n    });\n  }\n}\n"],"names":[],"mappings":";;AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAE3C,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACnC,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5D,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,+EAA+E;aAClF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,2CAA2C;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC","debug_id":"c58bf633-ef92-5c8c-bfe2-f50882cb800c"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@studious-lms/server",
-  "version": "1.9.0",
+  "version": "1.12.0",
   "description": "Backend server for Studious application",
   "main": "dist/exportType.js",
   "types": "dist/exportType.d.ts",

package/prisma/migrations/20260510183000_add_discussions/migration.sql

@@ -0,0 +1,151 @@
+-- CreateEnum
+CREATE TYPE "DiscussionType" AS ENUM ('DISCUSSION', 'QUESTION', 'ANNOUNCEMENT');
+
+-- AlterTable
+ALTER TABLE "Class" ADD COLUMN "discussionsEnabled" BOOLEAN NOT NULL DEFAULT true;
+ALTER TABLE "Class" ADD COLUMN "studentsCanCreateDiscussions" BOOLEAN NOT NULL DEFAULT true;
+ALTER TABLE "Class" ADD COLUMN "studentsCanReply" BOOLEAN NOT NULL DEFAULT true;
+
+-- AlterTable
+ALTER TABLE "File" ADD COLUMN "discussionId" TEXT;
+ALTER TABLE "File" ADD COLUMN "discussionReplyId" TEXT;
+
+-- AlterTable
+ALTER TABLE "Reaction" ADD COLUMN "discussionId" TEXT;
+ALTER TABLE "Reaction" ADD COLUMN "discussionReplyId" TEXT;
+
+-- CreateTable
+CREATE TABLE "Discussion" (
+    "id" TEXT NOT NULL,
+    "classId" TEXT NOT NULL,
+    "authorId" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "body" TEXT NOT NULL,
+    "type" "DiscussionType" NOT NULL DEFAULT 'DISCUSSION',
+    "isPinned" BOOLEAN NOT NULL DEFAULT false,
+    "isLocked" BOOLEAN NOT NULL DEFAULT false,
+    "allowReplies" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "lastActivityAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Discussion_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "DiscussionReply" (
+    "id" TEXT NOT NULL,
+    "discussionId" TEXT NOT NULL,
+    "authorId" TEXT NOT NULL,
+    "parentId" TEXT,
+    "body" TEXT NOT NULL,
+    "isAcceptedAnswer" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "modifiedAt" TIMESTAMP(3),
+    "deletedAt" TIMESTAMP(3),
+
+    CONSTRAINT "DiscussionReply_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "DiscussionTag" (
+    "id" TEXT NOT NULL,
+    "classId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "color" TEXT NOT NULL DEFAULT '#3B82F6',
+
+    CONSTRAINT "DiscussionTag_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "DiscussionRead" (
+    "userId" TEXT NOT NULL,
+    "discussionId" TEXT NOT NULL,
+    "lastReadAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "DiscussionRead_pkey" PRIMARY KEY ("userId","discussionId")
+);
+
+-- CreateTable
+CREATE TABLE "_DiscussionToTag" (
+    "A" TEXT NOT NULL,
+    "B" TEXT NOT NULL
+);
+
+-- CreateIndex
+CREATE INDEX "Discussion_classId_isPinned_lastActivityAt_idx" ON "Discussion"("classId", "isPinned", "lastActivityAt");
+
+-- CreateIndex
+CREATE INDEX "Discussion_classId_createdAt_idx" ON "Discussion"("classId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "DiscussionReply_discussionId_createdAt_idx" ON "DiscussionReply"("discussionId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "DiscussionReply_parentId_idx" ON "DiscussionReply"("parentId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "DiscussionTag_classId_name_key" ON "DiscussionTag"("classId", "name");
+
+-- CreateIndex
+CREATE INDEX "DiscussionRead_userId_idx" ON "DiscussionRead"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "_DiscussionToTag_AB_unique" ON "_DiscussionToTag"("A", "B");
+
+-- CreateIndex
+CREATE INDEX "_DiscussionToTag_B_index" ON "_DiscussionToTag"("B");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Reaction_userId_discussionId_key" ON "Reaction"("userId", "discussionId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Reaction_userId_discussionReplyId_key" ON "Reaction"("userId", "discussionReplyId");
+
+-- CreateIndex
+CREATE INDEX "Reaction_discussionId_idx" ON "Reaction"("discussionId");
+
+-- CreateIndex
+CREATE INDEX "Reaction_discussionReplyId_idx" ON "Reaction"("discussionReplyId");
+
+-- AddForeignKey
+ALTER TABLE "File" ADD CONSTRAINT "File_discussionId_fkey" FOREIGN KEY ("discussionId") REFERENCES "Discussion"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "File" ADD CONSTRAINT "File_discussionReplyId_fkey" FOREIGN KEY ("discussionReplyId") REFERENCES "DiscussionReply"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Discussion" ADD CONSTRAINT "Discussion_classId_fkey" FOREIGN KEY ("classId") REFERENCES "Class"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Discussion" ADD CONSTRAINT "Discussion_authorId_fkey" FOREIGN KEY ("authorId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionReply" ADD CONSTRAINT "DiscussionReply_discussionId_fkey" FOREIGN KEY ("discussionId") REFERENCES "Discussion"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionReply" ADD CONSTRAINT "DiscussionReply_authorId_fkey" FOREIGN KEY ("authorId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionReply" ADD CONSTRAINT "DiscussionReply_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "DiscussionReply"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionTag" ADD CONSTRAINT "DiscussionTag_classId_fkey" FOREIGN KEY ("classId") REFERENCES "Class"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionRead" ADD CONSTRAINT "DiscussionRead_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DiscussionRead" ADD CONSTRAINT "DiscussionRead_discussionId_fkey" FOREIGN KEY ("discussionId") REFERENCES "Discussion"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Reaction" ADD CONSTRAINT "Reaction_discussionId_fkey" FOREIGN KEY ("discussionId") REFERENCES "Discussion"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Reaction" ADD CONSTRAINT "Reaction_discussionReplyId_fkey" FOREIGN KEY ("discussionReplyId") REFERENCES "DiscussionReply"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "_DiscussionToTag" ADD CONSTRAINT "_DiscussionToTag_A_fkey" FOREIGN KEY ("A") REFERENCES "Discussion"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "_DiscussionToTag" ADD CONSTRAINT "_DiscussionToTag_B_fkey" FOREIGN KEY ("B") REFERENCES "DiscussionTag"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/schema.prisma

@@ -84,6 +84,12 @@ enum ReactionType {
   HAPPY
 }
 
+enum DiscussionType {
+  DISCUSSION
+  QUESTION
+  ANNOUNCEMENT
+}
+
 enum SubmissionRecommendationState {
   NONE
   OPEN
@@ -227,6 +233,9 @@ model User {
   createdLabChats         LabChat[]            @relation("CreatedLabChats")
   comments                Comment[]
   reactions               Reaction[]
+  discussions             Discussion[]
+  discussionReplies       DiscussionReply[]
+  discussionReads         DiscussionRead[]
 }
 
 model SchoolMembership {
@@ -311,6 +320,12 @@ model Class {
   departmentId      String?
   tags              Tag[]             @relation("ClassTags")
   permissions       Permission[]      @relation("ClassPermissions")
+  discussions       Discussion[]
+  discussionTags    DiscussionTag[]
+
+  discussionsEnabled              Boolean @default(true)
+  studentsCanCreateDiscussions    Boolean @default(true)
+  studentsCanReply                Boolean @default(true)
 
   @@index([schoolId])
   @@index([departmentId])
@@ -422,6 +437,12 @@ model File {
   announcement   Announcement? @relation("AnnouncementAttachments", fields: [announcementId], references: [id], onDelete: Cascade)
   announcementId String?
 
+  discussion   Discussion? @relation("DiscussionFiles", fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId String?
+
+  discussionReply   DiscussionReply? @relation("DiscussionReplyFiles", fields: [discussionReplyId], references: [id], onDelete: Cascade)
+  discussionReplyId String?
+
   schools School[] @relation("SchoolLogo")
 
   schoolDevelopementProgram   SchoolDevelopementProgram? @relation("SchoolDevelopementProgramSupportingDocumentation", fields: [schoolDevelopementProgramId], references: [id], onDelete: Cascade)
@@ -507,6 +528,74 @@ model Comment {
   @@index([submissionId])
 }
 
+model Discussion {
+  id             String            @id @default(uuid())
+  class          Class             @relation(fields: [classId], references: [id], onDelete: Cascade)
+  classId        String
+  author         User              @relation(fields: [authorId], references: [id], onDelete: Cascade)
+  authorId       String
+  title          String
+  body           String
+  type           DiscussionType    @default(DISCUSSION)
+  isPinned       Boolean           @default(false)
+  isLocked       Boolean           @default(false)
+  allowReplies   Boolean           @default(true)
+  attachments    File[]            @relation("DiscussionFiles")
+  tags           DiscussionTag[]   @relation("DiscussionToTag")
+  replies        DiscussionReply[]
+  reactions      Reaction[]
+  reads          DiscussionRead[]
+  createdAt      DateTime          @default(now())
+  updatedAt      DateTime          @updatedAt
+  lastActivityAt DateTime          @default(now())
+
+  @@index([classId, isPinned, lastActivityAt])
+  @@index([classId, createdAt])
+}
+
+model DiscussionReply {
+  id               String            @id @default(uuid())
+  discussion       Discussion        @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId     String
+  author           User              @relation(fields: [authorId], references: [id], onDelete: Cascade)
+  authorId         String
+  parent           DiscussionReply?  @relation("ReplyTree", fields: [parentId], references: [id], onDelete: Cascade)
+  parentId         String?
+  children         DiscussionReply[] @relation("ReplyTree")
+  body             String
+  attachments      File[]            @relation("DiscussionReplyFiles")
+  reactions        Reaction[]
+  isAcceptedAnswer Boolean           @default(false)
+  createdAt        DateTime          @default(now())
+  modifiedAt       DateTime?         @updatedAt
+  deletedAt        DateTime?
+
+  @@index([discussionId, createdAt])
+  @@index([parentId])
+}
+
+model DiscussionTag {
+  id          String       @id @default(uuid())
+  class       Class        @relation(fields: [classId], references: [id], onDelete: Cascade)
+  classId     String
+  name        String
+  color       String       @default("#3B82F6")
+  discussions Discussion[] @relation("DiscussionToTag")
+
+  @@unique([classId, name])
+}
+
+model DiscussionRead {
+  user         User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  userId       String
+  discussion   Discussion @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId String
+  lastReadAt   DateTime   @default(now())
+
+  @@id([userId, discussionId])
+  @@index([userId])
+}
+
 model Reaction {
   id             String        @id @default(uuid())
   type           ReactionType
@@ -516,12 +605,20 @@ model Reaction {
   announcementId String?
   comment        Comment?      @relation(fields: [commentId], references: [id], onDelete: Cascade)
   commentId      String?
+  discussion        Discussion?      @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId      String?
+  discussionReply   DiscussionReply? @relation(fields: [discussionReplyId], references: [id], onDelete: Cascade)
+  discussionReplyId String?
   createdAt      DateTime      @default(now())
 
   @@unique([userId, announcementId])
   @@unique([userId, commentId])
+  @@unique([userId, discussionId])
+  @@unique([userId, discussionReplyId])
   @@index([announcementId])
   @@index([commentId])
+  @@index([discussionId])
+  @@index([discussionReplyId])
 }
 
 model Submission {

package/src/index.ts

@@ -58,7 +58,8 @@ app.use(cors({
   },
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-user'],
+  // Omit allowedHeaders so `cors` echoes `Access-Control-Request-Headers` on preflight.
+  // A fixed list breaks browsers that add headers (e.g. Sentry `baggage`, `sentry-trace`).
   preflightContinue: false,
   optionsSuccessStatus: 204,
 }));
@@ -221,6 +222,38 @@ app.post('/api/pusher/auth', async (req, res) => {
       }
     }
 
+    if (channel_name.startsWith('private-class-') && channel_name.endsWith('-discussions')) {
+      const classId = channel_name
+        .replace('private-class-', '')
+        .replace('-discussions', '');
+      const isMember = await prisma.class.findFirst({
+        where: {
+          id: classId,
+          discussionsEnabled: true,
+          OR: [
+            { students: { some: { id: user.id } } },
+            { teachers: { some: { id: user.id } } },
+            {
+              school: {
+                is: {
+                  memberships: {
+                    some: {
+                      userId: user.id,
+                      role: 'ADMIN',
+                      status: 'ACTIVE',
+                    },
+                  },
+                },
+              },
+            },
+          ],
+        },
+      });
+      if (!isMember) {
+        return res.status(403).json({ error: 'Not a member of this class discussion channel' });
+      }
+    }
+
     // Verify channel access for private-class-* channels
     // if (channel_name.startsWith('private-class-')) {
     //   const classId = channel_name.replace('private-class-', '');
@@ -586,7 +619,11 @@ app.options('/trpc/*', (req, res) => {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Credentials', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, x-user');
+    const requestedHeaders = req.headers['access-control-request-headers'];
+    if (requestedHeaders) {
+      res.setHeader('Access-Control-Allow-Headers', requestedHeaders);
+      res.setHeader('Vary', 'Origin, Access-Control-Request-Headers');
+    }
   }
   res.sendStatus(204);
 });

package/src/lib/config/cors.ts

@@ -9,6 +9,11 @@ const productionOrigins = [
   'https://www.studious.sh',
   'https://studious.sh',
   'https://dev.studious.sh',
+  // @todo: remove in actual prod
+'http://localhost:3000',
+  'http://localhost:3001',
+  'http://127.0.0.1:3000',
+  'http://127.0.0.1:3001',
 ];
 
 const nonProductionOrigins = [

package/src/lib/config/env.ts

@@ -63,6 +63,8 @@ const fullSchema = baseSchema.extend({
   INFERENCE_API_BASE_URL: z.string().url().optional(),
   OPENAI_API_KEY: z.string().optional(),
   LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('normal'),
+  /** Comma/whitespace-separated user UUIDs allowed to call `admin.*` tRPC (required in production). */
+  ADMIN_PANEL_USER_IDS: z.string().optional(),
 });
 
 // Test schema - only require what's needed for tests
@@ -91,6 +93,7 @@ const testSchema = baseSchema.extend({
   OPENAI_API_KEY: z.string().optional(),
   INFERENCE_API_BASE_URL: z.string().url().optional(),
   LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('quiet'),
+  ADMIN_PANEL_USER_IDS: z.string().optional(),
 });
 
 // Use test schema in test mode, full schema otherwise

package/src/lib/pusher.ts

@@ -12,6 +12,7 @@ const pusher = new Pusher({
 const chatChannel = (conversationId: string) => `private-conversation-${conversationId}`;
 const worksheetChannel = (worksheetResponseId: string) => `private-worksheet-${worksheetResponseId}`;
 const teacherChannel = (classId: string) => `private-teacher-${classId}`;
+const discussionChannel = (classId: string) => `private-class-${classId}-discussions`;
 /**
  * Per-worksheet job channel used for asynchronous worksheet creation
  * (e.g. PDF → worksheet conversion). Distinct prefix from the student
@@ -19,4 +20,4 @@ const teacherChannel = (classId: string) => `private-teacher-${classId}`;
  */
 const worksheetJobChannel = (worksheetId: string) => `private-worksheet-job-${worksheetId}`;
 
-export { pusher, chatChannel, worksheetChannel, teacherChannel, worksheetJobChannel };
+export { pusher, chatChannel, worksheetChannel, teacherChannel, discussionChannel, worksheetJobChannel };

package/src/models/class.ts

@@ -180,6 +180,9 @@ const classIncludeForGet = {
       },
     },
   },
+  discussionsEnabled: true,
+  studentsCanCreateDiscussions: true,
+  studentsCanReply: true,
 } as const;
 
 const assignmentSelect = {

package/src/models/worksheet.ts

@@ -456,6 +456,34 @@ export function findStudentQuestionProgressByIdForTeacherAndResponse(
   });
 }
 
+/**
+ * @returns Student question progress if requester is the answering student (class member) or a
+ *   class teacher / school admin for that worksheet.
+ */
+export function findStudentQuestionProgressByIdForStudentOrTeacher(
+  id: string,
+  userId: string
+) {
+  return prisma.studentQuestionProgress.findFirst({
+    where: {
+      id,
+      OR: [
+        {
+          studentId: userId,
+          question: { worksheet: worksheetClassMemberWhere(userId) },
+        },
+        {
+          question: { worksheet: worksheetTeacherWhere(userId) },
+        },
+      ],
+    },
+    include: {
+      question: true,
+      studentWorksheetResponse: true,
+    },
+  });
+}
+
 /** Update student's question progress. */
 export function updateStudentQuestionProgress(
   id: string,

package/src/routers/_app.ts

@@ -26,6 +26,8 @@ import { schoolRouter } from "./school.js";
 import { departmentRouter } from "./department.js";
 import { tagRouter } from "./tag.js";
 import { permissionsRouter } from "./permissions.js";
+import { discussionRouter } from "./discussion.js";
+import { adminRouter } from "./admin.js";
 
 export const appRouter = createTRPCRouter({
   class: classRouter,
@@ -53,6 +55,8 @@ export const appRouter = createTRPCRouter({
   department: departmentRouter,
   tag: tagRouter,
   permissions: permissionsRouter,
+  discussion: discussionRouter,
+  admin: adminRouter,
 });
 
 // Export type router type definition

package/src/routers/admin.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+import { RunJobStatus, RunJobType } from '@prisma/client';
+import { createTRPCRouter, adminProcedure } from '../trpc.js';
+import {
+  getRunJobForAdmin,
+  listRunJobsForAdmin,
+} from '../services/adminRunJob.js';
+import {
+  listDepartmentsForAdmin,
+  listEarlyAccessRequestsForAdmin,
+  listSchoolDevelopmentProgramsForAdmin,
+  listSchoolsForAdmin,
+} from '../services/adminInstitution.js';
+
+export const adminRouter = createTRPCRouter({
+  listRunJobs: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        status: z.nativeEnum(RunJobStatus).optional(),
+        type: z.nativeEnum(RunJobType).optional(),
+      }),
+    )
+    .query(({ input }) => listRunJobsForAdmin(input)),
+
+  getRunJob: adminProcedure
+    .input(z.object({ id: z.string().uuid() }))
+    .query(({ input }) => getRunJobForAdmin(input.id)),
+
+  listSchools: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        query: z.string().optional(),
+      }),
+    )
+    .query(({ input }) => listSchoolsForAdmin(input)),
+
+  listDepartments: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        schoolId: z.string().uuid().optional(),
+      }),
+    )
+    .query(({ input }) => listDepartmentsForAdmin(input)),
+
+  listSchoolDevelopmentPrograms: adminProcedure
+      .input(
+        z.object({
+          page: z.number().int().min(0).default(0),
+          pageSize: z.number().int().min(1).max(100).default(25),
+          status: z.string().optional(),
+          query: z.string().optional(),
+        }),
+      )
+      .query(({ input }) => listSchoolDevelopmentProgramsForAdmin(input)),
+
+  listEarlyAccessRequests: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+      }),
+    )
+    .query(({ input }) => listEarlyAccessRequestsForAdmin(input)),
+});

package/src/routers/class.ts

@@ -60,6 +60,9 @@ export const classRouter = createTRPCRouter({
         subject: z.string().optional(),
         color: z.string().optional(),
         departmentId: z.string().nullable().optional(),
+        discussionsEnabled: z.boolean().optional(),
+        studentsCanCreateDiscussions: z.boolean().optional(),
+        studentsCanReply: z.boolean().optional(),
       })
     )
     .mutation(({ input }) => {