comparing 191fdc63d55bd449e8f4083bff981aeacdc9ba1a and main on dunkirk.sh/thistle

+10 -10

.env.example

···

       5
       5
        
       

     

       6
       6
        
       # LLM API Configuration (REQUIRED for VTT cleaning)

     

       7
       7
        
       # Configure your LLM service endpoint and credentials

     

       8
       8
       -
       LLM_API_KEY=your_api_key_here

     

       8
       8
       +
       LLM_API_KEY=paste_your_api_key_here

     

       9
       9
        
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       10
       -
       LLM_MODEL=anthropic/claude-3.5-sonnet

     

       10
       10
       +
       LLM_MODEL=moonshotai/kimi-k2-0905

     

       11
       11
        
       

     

       12
       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
       13
        
       # In development, these default to localhost values

     
···

       24
       24
        
       

     

       25
       25
        
       # Polar.sh Payment Configuration (REQUIRED)

     

       26
       26
        
       # Get your organization ID from https://polar.sh/settings

     

       27
       27
       -
       POLAR_ORGANIZATION_ID=your_org_id_here

     

       27
       27
       +
       POLAR_ORGANIZATION_ID=paste_your_org_id_here

     

       28
       28
        
       # Get your access token from https://polar.sh/settings (or sandbox.polar.sh for testing)

     

       29
       29
       -
       POLAR_ACCESS_TOKEN=polar_at_xxxxxxxxxxxxx

     

       29
       29
       +
       POLAR_ACCESS_TOKEN=paste_your_polar_token_here

     

       30
       30
        
       # Get product ID from your Polar dashboard (create a product first)

     

       31
       31
       -
       POLAR_PRODUCT_ID=prod_xxxxxxxxxxxxx

     

       31
       31
       +
       POLAR_PRODUCT_ID=paste_your_product_id_here

     

       32
       32
        
       # Redirect URL after successful checkout (use {CHECKOUT_ID} placeholder)

     

       33
       33
        
       POLAR_SUCCESS_URL=http://localhost:3000/checkout?checkout_id={CHECKOUT_ID}

     

       34
       34
        
       # Webhook secret for verifying Polar webhook signatures (get from Polar dashboard)

     

       35
       35
       -
       POLAR_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxx

     

       35
       35
       +
       POLAR_WEBHOOK_SECRET=paste_your_webhook_secret_here

     

       36
       36
        
       

     

       37
       37
        
       # Email Configuration (REQUIRED - MailChannels)

     

       38
       38
        
       # API key from MailChannels dashboard

     

       39
       39
       -
       MAILCHANNELS_API_KEY=your_mailchannels_api_key_here

     

       39
       39
       +
       MAILCHANNELS_API_KEY=paste_your_mailchannels_api_key_here

     

       40
       40
        
       # DKIM private key for email authentication (required for sending emails)

     

       41
       41
        
       # Generate: openssl genrsa -out dkim-private.pem 2048

     

       42
       42
        
       # Then add TXT record: mailchannels._domainkey.yourdomain.com

     

       43
       43
       -
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       44
       44
       -
       DKIM_DOMAIN=thistle.app

     

       45
       45
       -
       SMTP_FROM_EMAIL=noreply@thistle.app

     

       43
       43
       +
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nPASTE_YOUR_DKIM_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       44
       44
       +
       DKIM_DOMAIN=yourdomain.com

     

       45
       45
       +
       SMTP_FROM_EMAIL=noreply@yourdomain.com

     

       46
       46
        
       SMTP_FROM_NAME=Thistle

     

       47
       47
        
       

     

       48
       48
        
       # Environment (set to 'production' in production)

+107

CRUSH.md

···

       688
       688
        
       **Configuration:**

     

       689
       689
        
       Set `WHISPER_SERVICE_URL` in `.env` (default: `http://localhost:8000`)

     

       690
       690
        
       

     

       691
       691
       +
       ## Issue Tracking

     

       692
       692
       +
       

     

       693
       693
       +
       This project uses [Tangled](https://tangled.org) for issue tracking via the `tangled-cli` tool.

     

       694
       694
       +
       

     

       695
       695
       +
       **Installation:**

     

       696
       696
       +
       ```bash

     

       697
       697
       +
       cargo install --git https://tangled.org/vitorpy.com/tangled-cli

     

       698
       698
       +
       ```

     

       699
       699
       +
       

     

       700
       700
       +
       **Authentication:**

     

       701
       701
       +
       ```bash

     

       702
       702
       +
       tangled-cli auth login

     

       703
       703
       +
       ```

     

       704
       704
       +
       

     

       705
       705
       +
       **Creating issues:**

     

       706
       706
       +
       ```bash

     

       707
       707
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --body "Issue description"

     

       708
       708
       +
       

     

       709
       709
       +
       # With labels (if created in the repo):

     

       710
       710
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --label "bug" --label "priority:high" --body "Issue description"

     

       711
       711
       +
       ```

     

       712
       712
       +
       

     

       713
       713
       +
       **Listing issues:**

     

       714
       714
       +
       ```bash

     

       715
       715
       +
       # List all open issues

     

       716
       716
       +
       tangled-cli issue list --repo "thistle"

     

       717
       717
       +
       

     

       718
       718
       +
       # List with specific state

     

       719
       719
       +
       tangled-cli issue list --repo "thistle" --state open

     

       720
       720
       +
       tangled-cli issue list --repo "thistle" --state closed

     

       721
       721
       +
       

     

       722
       722
       +
       # List by label

     

       723
       723
       +
       tangled-cli issue list --repo "thistle" --label "priority: low"

     

       724
       724
       +
       tangled-cli issue list --repo "thistle" --label "bug"

     

       725
       725
       +
       

     

       726
       726
       +
       # List by author

     

       727
       727
       +
       tangled-cli issue list --repo "thistle" --author "username"

     

       728
       728
       +
       

     

       729
       729
       +
       # JSON output format

     

       730
       730
       +
       tangled-cli issue list --repo "thistle" --format json

     

       731
       731
       +
       ```

     

       732
       732
       +
       

     

       733
       733
       +
       **Showing issue details:**

     

       734
       734
       +
       ```bash

     

       735
       735
       +
       # Show specific issue by ID

     

       736
       736
       +
       tangled-cli issue show <issue-id>

     

       737
       737
       +
       

     

       738
       738
       +
       # Show with comments

     

       739
       739
       +
       tangled-cli issue show <issue-id> --comments

     

       740
       740
       +
       

     

       741
       741
       +
       # JSON format

     

       742
       742
       +
       tangled-cli issue show <issue-id> --json

     

       743
       743
       +
       ```

     

       744
       744
       +
       

     

       745
       745
       +
       **Commenting on issues:**

     

       746
       746
       +
       ```bash

     

       747
       747
       +
       tangled-cli issue comment <issue-id> --body "Your comment here"

     

       748
       748
       +
       ```

     

       749
       749
       +
       

     

       750
       750
       +
       **Editing issues:**

     

       751
       751
       +
       ```bash

     

       752
       752
       +
       # Update title

     

       753
       753
       +
       tangled-cli issue edit <issue-id> --title "New title"

     

       754
       754
       +
       

     

       755
       755
       +
       # Update body

     

       756
       756
       +
       tangled-cli issue edit <issue-id> --body "New description"

     

       757
       757
       +
       

     

       758
       758
       +
       # Close an issue

     

       759
       759
       +
       tangled-cli issue edit <issue-id> --state closed

     

       760
       760
       +
       

     

       761
       761
       +
       # Reopen an issue

     

       762
       762
       +
       tangled-cli issue edit <issue-id> --state open

     

       763
       763
       +
       ```

     

       764
       764
       +
       

     

       765
       765
       +
       **Repository commands:**

     

       766
       766
       +
       ```bash

     

       767
       767
       +
       # List your repositories

     

       768
       768
       +
       tangled-cli repo list

     

       769
       769
       +
       

     

       770
       770
       +
       # Show repository details

     

       771
       771
       +
       tangled-cli repo info thistle

     

       772
       772
       +
       

     

       773
       773
       +
       # Create a new repository

     

       774
       774
       +
       tangled-cli repo create --name "repo-name" --description "Description"

     

       775
       775
       +
       ```

     

       776
       776
       +
       

     

       777
       777
       +
       **Viewing issues by priority:**

     

       778
       778
       +
       

     

       779
       779
       +
       The thistle repo uses priority labels:

     

       780
       780
       +
       - `priority: high` - Critical issues that need immediate attention

     

       781
       781
       +
       - `priority: medium` - Important issues to address soon

     

       782
       782
       +
       - `priority: low` - Nice-to-have improvements

     

       783
       783
       +
       

     

       784
       784
       +
       ```bash

     

       785
       785
       +
       # View all low priority issues

     

       786
       786
       +
       tangled-cli issue list --repo "thistle" --label "priority: low" --state open

     

       787
       787
       +
       

     

       788
       788
       +
       # View all high priority issues

     

       789
       789
       +
       tangled-cli issue list --repo "thistle" --label "priority: high" --state open

     

       790
       790
       +
       ```

     

       791
       791
       +
       

     

       792
       792
       +
       **Note:** The repo name for this project is `thistle` (resolves to `dunkirk.sh/thistle` in Tangled). Labels are supported but need to be created in the repository first.

     

       793
       793
       +
       

     

       794
       794
       +
       **Known Issues:**

     

       795
       795
       +
       - The CLI may have decoding issues with some API responses (missing `createdAt` field). If `tangled-cli issue list` fails, you can access issues via the web interface at https://tangled.org/dunkirk.sh/thistle

     

       796
       796
       +
       - For complex filtering or browsing, the web UI may be more reliable than the CLI

     

       797
       797
       +
       

     

       691
       798
        
       ## Future Additions

     

       692
       799
        
       

     

       693
       800
        
       As the codebase grows, document:

+10

LICENSE.md

···

       1
       1
       +
       # The O'Saasy License

     

       2
       2
       +
       

     

       3
       3
       +
       Copyright © `2025` `Kieran Klukas`

     

       4
       4
       +
       

     

       5
       5
       +
       Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

     

       6
       6
       +
       

     

       7
       7
       +
       The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

     

       8
       8
       +
       No licensee or downstream recipient may use the Software (including any modified or derivative versions) to directly compete with the original Licensor by offering it to third parties as a hosted, managed, or Software-as-a-Service (SaaS) product or cloud service where the primary value of the service is the functionality of the Software itself.

     

       9
       9
       +
       

     

       10
       10
       +
       THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

+2 -1

README.md

···

       45
       45
        
       ```

     

       46
       46
        
       

     

       47
       47
        
       Or manually:

     

       48
       48
       +
       

     

       48
       49
        
       ```bash

     

       49
       50
        
       cd whisper-server

     

       50
       51
        
       pip install -r requirements.txt

     
···

       134
       135
        
       </p>

     

       135
       136
        
       

     

       136
       137
        
       <p align="center">

     

       137
       137
       -
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=MIT&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       138
       +
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=O'Saasy&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       139
        
       </p>

+2 -2

package.json

···

       6
       6
        
       	"scripts": {

     

       7
       7
        
       		"dev": "bun run src/index.ts --hot",

     

       8
       8
        
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       9
       -
       		"test": "bun test",

     

       10
       10
       -
       		"test:integration": "bun test src/index.test.ts",

     

       9
       9
       +
       		"test": "NODE_ENV=test bun test",

     

       10
       10
       +
       		"test:integration": "NODE_ENV=test bun test src/index.test.ts",

     

       11
       11
        
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       12
        
       	},

     

       13
       13
        
       	"devDependencies": {

+39

scripts/remove-from-classes.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       const email = process.argv[2];

     

       6
       6
       +
       

     

       7
       7
       +
       if (!email) {

     

       8
       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       10
       +
       	process.exit(1);

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       const user = db

     

       14
       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       16
       +
       	)

     

       17
       17
       +
       	.get(email);

     

       18
       18
       +
       

     

       19
       19
       +
       if (!user) {

     

       20
       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       21
       +
       	process.exit(1);

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // Get current enrollments

     

       25
       25
       +
       const enrollments = db

     

       26
       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       28
       +
       	)

     

       29
       29
       +
       	.all(user.id);

     

       30
       30
       +
       

     

       31
       31
       +
       if (enrollments.length === 0) {

     

       32
       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       33
       +
       	process.exit(0);

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Remove from all classes

     

       37
       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       38
       +
       

     

       39
       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+218 -16

src/components/admin-classes.ts

···

       40
       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       41
       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       42
       42
        
       	@state() showModal = false;

     

       43
       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       47
       +
       	@state() newSectionNumber = "";

     

       43
       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       49
       +
       	@state() sections: string[] = [];

     

       44
       50
        
       	@state() editingClass = {

     

       45
       51
        
       		courseCode: "",

     

       46
       52
        
       		courseName: "",

     
···

       510
       516
        
       			const classesData = await classesRes.json();

     

       511
       517
        
       			const waitlistData = await waitlistRes.json();

     

       512
       518
        
       

     

       513
       513
       -
       			this.classes = classesData.classes || [];

     

       519
       519
       +
       			// Flatten grouped classes into array

     

       520
       520
       +
       			const groupedClasses = classesData.classes || {};

     

       521
       521
       +
       			this.classes = Object.values(groupedClasses).flat();

     

       514
       522
        
       			this.waitlist = waitlistData.waitlist || [];

     

       515
       523
        
       		} catch {

     

       516
       524
        
       			this.error = "Failed to load data. Please try again.";

     
···

       662
       670
        
       		this.showModal = true;

     

       663
       671
        
       	}

     

       664
       672
        
       

     

       673
       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       674
       +
       		try {

     

       675
       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       677
       +
       			

     

       678
       678
       +
       			const data = await response.json();

     

       679
       679
       +
       			this.editingClassId = classId;

     

       680
       680
       +
       			this.editingClassInfo = data.class;

     

       681
       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       682
       +
       			this.newSectionNumber = "";

     

       683
       683
       +
       			this.showClassSettingsModal = true;

     

       684
       684
       +
       		} catch {

     

       685
       685
       +
       			this.error = "Failed to load class details";

     

       686
       686
       +
       		}

     

       687
       687
       +
       	}

     

       688
       688
       +
       

     

       689
       689
       +
       	private async handleAddSection() {

     

       690
       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       691
       +
       

     

       692
       692
       +
       		try {

     

       693
       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       694
       +
       				method: "POST",

     

       695
       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       697
       +
       			});

     

       698
       698
       +
       

     

       699
       699
       +
       			if (!response.ok) {

     

       700
       700
       +
       				const data = await response.json();

     

       701
       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       702
       +
       				return;

     

       703
       703
       +
       			}

     

       704
       704
       +
       

     

       705
       705
       +
       			const newSection = await response.json();

     

       706
       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       707
       +
       			this.newSectionNumber = "";

     

       708
       708
       +
       		} catch {

     

       709
       709
       +
       			this.error = "Failed to add section";

     

       710
       710
       +
       		}

     

       711
       711
       +
       	}

     

       712
       712
       +
       

     

       713
       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       714
       +
       		if (!this.editingClassId) return;

     

       715
       715
       +
       

     

       716
       716
       +
       		try {

     

       717
       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       718
       +
       				method: "DELETE",

     

       719
       719
       +
       			});

     

       720
       720
       +
       

     

       721
       721
       +
       			if (!response.ok) {

     

       722
       722
       +
       				const data = await response.json();

     

       723
       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       724
       +
       				return;

     

       725
       725
       +
       			}

     

       726
       726
       +
       

     

       727
       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       728
       +
       		} catch {

     

       729
       729
       +
       			this.error = "Failed to delete section";

     

       730
       730
       +
       		}

     

       731
       731
       +
       	}

     

       732
       732
       +
       

     

       733
       733
       +
       	private handleCloseSectionsModal() {

     

       734
       734
       +
       		this.showClassSettingsModal = false;

     

       735
       735
       +
       		this.editingClassId = null;

     

       736
       736
       +
       		this.editingClassInfo = null;

     

       737
       737
       +
       		this.editingClassSections = [];

     

       738
       738
       +
       		this.newSectionNumber = "";

     

       739
       739
       +
       		this.loadData();

     

       740
       740
       +
       	}

     

       741
       741
       +
       

     

       742
       742
       +
       

     

       665
       743
        
       	private getFilteredClasses() {

     

       666
       744
        
       		if (!this.searchTerm) return this.classes;

     

       667
       745
        
       

     
···

       712
       790
        
       			}

     

       713
       791
        
       

     

       714
       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       715
       794
        
           `;

     

       716
       795
        
       	}

     

       717
       796
        
       

     
···

       741
       820
        
                 <div class="classes-grid">

     

       742
       821
        
                   ${filteredClasses.map(

     

       743
       822
        
       							(cls) => html`

     

       744
       744
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       823
       823
       +
                     <div 

     

       824
       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       826
       +
                       style="cursor: pointer;"

     

       827
       827
       +
                     >

     

       745
       828
        
                       <div class="class-header">

     

       746
       829
        
                         <div class="class-info">

     

       747
       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       754
       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       755
       838
        
                           </div>

     

       756
       839
        
                         </div>

     

       757
       757
       -
                         <div class="actions">

     

       758
       758
       -
                           <button

     

       759
       759
       -
                             class="btn-archive"

     

       760
       760
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       761
       761
       -
                           >

     

       762
       762
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       763
       763
       -
                           </button>

     

       764
       764
       -
                           <button

     

       765
       765
       -
                             class="btn-delete"

     

       766
       766
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       767
       767
       -
                           >

     

       768
       768
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       769
       769
       -
                           </button>

     

       770
       770
       -
                         </div>

     

       771
       840
        
                       </div>

     

       772
       841
        
                     </div>

     

       773
       842
        
                   `,

     
···

       778
       847
        
           `;

     

       779
       848
        
       	}

     

       780
       849
        
       

     

       850
       850
       +
       	private renderClassSettingsModal() {

     

       851
       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       852
       +
       

     

       853
       853
       +
       		return html`

     

       854
       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       856
       +
                 <div class="modal-header">

     

       857
       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       859
       +
                 </div>

     

       860
       860
       +
       

     

       861
       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       863
       +
                     <button

     

       864
       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       865
       +
                     >

     

       866
       866
       +
                       Sections

     

       867
       867
       +
                     </button>

     

       868
       868
       +
                   </div>

     

       869
       869
       +
                 </div>

     

       870
       870
       +
       

     

       871
       871
       +
                 <!-- Sections Tab -->

     

       872
       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       874
       +
                   

     

       875
       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       876
       +
                     <input

     

       877
       877
       +
                       type="text"

     

       878
       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       879
       +
                       .value=${this.newSectionNumber}

     

       880
       880
       +
                       @input=${(e: Event) => {

     

       881
       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       882
       +
       								}}

     

       883
       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       884
       +
       									if (e.key === "Enter") {

     

       885
       885
       +
       										e.preventDefault();

     

       886
       886
       +
       										this.handleAddSection();

     

       887
       887
       +
       									}

     

       888
       888
       +
       								}}

     

       889
       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       890
       +
                     />

     

       891
       891
       +
                     <button

     

       892
       892
       +
                       @click=${this.handleAddSection}

     

       893
       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       895
       +
                     >

     

       896
       896
       +
                       Add Section

     

       897
       897
       +
                     </button>

     

       898
       898
       +
                   </div>

     

       899
       899
       +
       

     

       900
       900
       +
                   ${

     

       901
       901
       +
       							this.editingClassSections.length === 0

     

       902
       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       903
       +
       								: html`

     

       904
       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       905
       +
                         ${this.editingClassSections.map(

     

       906
       906
       +
       										(section) => html`

     

       907
       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       909
       +
                             <button

     

       910
       910
       +
                               @click=${(e: Event) => {

     

       911
       911
       +
       													e.stopPropagation();

     

       912
       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       913
       +
       												}}

     

       914
       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       915
       +
                             >

     

       916
       916
       +
                               Delete

     

       917
       917
       +
                             </button>

     

       918
       918
       +
                           </div>

     

       919
       919
       +
                         `,

     

       920
       920
       +
       									)}

     

       921
       921
       +
                       </div>

     

       922
       922
       +
                     `

     

       923
       923
       +
       						}

     

       924
       924
       +
                 </div>

     

       925
       925
       +
       

     

       926
       926
       +
                 <!-- Actions -->

     

       927
       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       929
       +
                     <button

     

       930
       930
       +
                       @click=${(e: Event) => {

     

       931
       931
       +
       									e.stopPropagation();

     

       932
       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       933
       +
       									this.handleCloseSectionsModal();

     

       934
       934
       +
       								}}

     

       935
       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       936
       +
                     >

     

       937
       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       938
       +
                     </button>

     

       939
       939
       +
                     <button

     

       940
       940
       +
                       @click=${(e: Event) => {

     

       941
       941
       +
       									e.stopPropagation();

     

       942
       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       943
       +
       								}}

     

       944
       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       945
       +
                     >

     

       946
       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       947
       +
                     </button>

     

       948
       948
       +
                   </div>

     

       949
       949
       +
                   <button

     

       950
       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       952
       +
                   >

     

       953
       953
       +
                     Done

     

       954
       954
       +
                   </button>

     

       955
       955
       +
                 </div>

     

       956
       956
       +
       

     

       957
       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       958
       +
               </div>

     

       959
       959
       +
             </div>

     

       960
       960
       +
           `;

     

       961
       961
       +
       	}

     

       962
       962
       +
       

     

       781
       963
        
       	private renderWaitlist() {

     

       782
       964
        
       		return html`

     

       783
       965
        
             ${

     
···

       863
       1045
        
       		this.meetingTimes = e.detail;

     

       864
       1046
        
       	}

     

       865
       1047
        
       

     

       1048
       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       1050
       +
       		this.sections = value

     

       1051
       1051
       +
       			.split(",")

     

       1052
       1052
       +
       			.map((s) => s.trim())

     

       1053
       1053
       +
       			.filter((s) => s);

     

       1054
       1054
       +
       	}

     

       1055
       1055
       +
       

     

       866
       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       867
       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       868
       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       872
       1062
        
       		this.showModal = false;

     

       873
       1063
        
       		this.approvingEntry = null;

     

       874
       1064
        
       		this.meetingTimes = [];

     

       1065
       1065
       +
       		this.sections = [];

     

       875
       1066
        
       		this.editingClass = {

     

       876
       1067
        
       			courseCode: "",

     

       877
       1068
        
       			courseName: "",

     
···

       901
       1092
        
       					semester: this.editingClass.semester,

     

       902
       1093
        
       					year: this.editingClass.year,

     

       903
       1094
        
       					meeting_times: labels,

     

       1095
       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       904
       1096
        
       				}),

     

       905
       1097
        
       			});

     

       906
       1098
        
       

     
···

       1016
       1208
        
                       .value=${this.meetingTimes}

     

       1017
       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       1018
       1210
        
                     ></meeting-time-picker>

     

       1211
       1211
       +
                   </div>

     

       1212
       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       1214
       +
                     <input

     

       1215
       1215
       +
                       type="text"

     

       1216
       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       1219
       +
                     />

     

       1220
       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       1019
       1221
        
                   </div>

     

       1020
       1222
        
                 </div>

     

       1021
       1223

+2 -1

src/components/admin-transcriptions.ts

···

       194
       194
        
       				throw new Error(data.error || "Failed to load transcriptions");

     

       195
       195
        
       			}

     

       196
       196
        
       

     

       197
       197
       -
       			this.transcriptions = await response.json();

     

       197
       197
       +
       			const result = await response.json();

     

       198
       198
       +
       			this.transcriptions = result.data || result;

     

       198
       199
        
       		} catch (err) {

     

       199
       200
        
       			this.error =

     

       200
       201
        
       				err instanceof Error

+2 -1

src/components/admin-users.ts

···

       324
       324
        
       				throw new Error(data.error || "Failed to load users");

     

       325
       325
        
       			}

     

       326
       326
        
       

     

       327
       327
       -
       			this.users = await response.json();

     

       327
       327
       +
       			const result = await response.json();

     

       328
       328
       +
       			this.users = result.data || result;

     

       328
       329
        
       		} catch (err) {

     

       329
       330
        
       			this.error =

     

       330
       331
        
       				err instanceof Error

+112 -6

src/components/class-view.ts

···

       2
       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
       3
        
       import "./upload-recording-modal.ts";

     

       4
       4
        
       import "./vtt-viewer.ts";

     

       5
       5
       +
       import "./pending-recordings-view.ts";

     

       5
       6
        
       

     

       6
       7
        
       interface Class {

     

       7
       8
        
       	id: string;

     
···

       24
       25
        
       	id: string;

     

       25
       26
        
       	user_id: number;

     

       26
       27
        
       	meeting_time_id: string | null;

     

       28
       28
       +
       	section_id: string | null;

     

       27
       29
        
       	filename: string;

     

       28
       30
        
       	original_filename: string;

     

       29
       31
        
       	status:

     
···

       42
       44
        
       	audioUrl?: string;

     

       43
       45
        
       }

     

       44
       46
        
       

     

       47
       47
       +
       interface ClassSection {

     

       48
       48
       +
       	id: string;

     

       49
       49
       +
       	section_number: string;

     

       50
       50
       +
       }

     

       51
       51
       +
       

     

       45
       52
        
       @customElement("class-view")

     

       46
       53
        
       export class ClassView extends LitElement {

     

       47
       54
        
       	@state() classId = "";

     

       48
       55
        
       	@state() classInfo: Class | null = null;

     

       49
       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       58
       +
       	@state() userSection: string | null = null;

     

       59
       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       50
       60
        
       	@state() transcriptions: Transcription[] = [];

     

       51
       61
        
       	@state() isLoading = true;

     

       52
       62
        
       	@state() error: string | null = null;

     
···

       363
       373
        
       			const data = await response.json();

     

       364
       374
        
       			this.classInfo = data.class;

     

       365
       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       376
       +
       			this.sections = data.sections || [];

     

       377
       377
       +
       			this.userSection = data.userSection || null;

     

       366
       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       379
       +
       

     

       380
       380
       +
       			// Default to user's section for filtering

     

       381
       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       383
       +
       			}

     

       367
       384
        
       

     

       368
       385
        
       			// Load VTT for completed transcriptions

     

       369
       386
        
       			await this.loadVTTForCompleted();

     
···

       450
       467
        
       	}

     

       451
       468
        
       

     

       452
       469
        
       	private get filteredTranscriptions() {

     

       453
       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       470
       470
       +
       		let filtered = this.transcriptions;

     

       471
       471
       +
       

     

       472
       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       474
       +
       		

     

       475
       475
       +
       		// Only filter by section if:

     

       476
       476
       +
       		// 1. There are sections in the class

     

       477
       477
       +
       		// 2. User has a section OR has selected one

     

       478
       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       479
       +
       			// For admins: show all transcriptions

     

       480
       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       481
       +
       			if (!this.isAdmin) {

     

       482
       482
       +
       				filtered = filtered.filter(

     

       483
       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       484
       +
       				);

     

       485
       485
       +
       			}

     

       486
       486
       +
       		}

     

       487
       487
       +
       

     

       488
       488
       +
       		// Filter by search query

     

       489
       489
       +
       		if (this.searchQuery) {

     

       490
       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       493
       +
       			);

     

       494
       494
       +
       		}

     

       454
       495
        
       

     

       455
       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       458
       -
       		);

     

       496
       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       498
       +
       

     

       499
       499
       +
       		return filtered;

     

       459
       500
        
       	}

     

       460
       501
        
       

     

       461
       502
        
       	private formatDate(timestamp: number): string {

     
···

       521
       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
       563
        
                   <h1>${this.classInfo.name}</h1>

     

       523
       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       565
       565
       +
                   <div class="semester">

     

       566
       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       567
       +
                     ${

     

       568
       568
       +
       								this.userSection

     

       569
       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       570
       +
       									: ""

     

       571
       571
       +
       							}

     

       572
       572
       +
                   </div>

     

       525
       573
        
                 </div>

     

       526
       574
        
               </div>

     

       527
       575
        
       

     
···

       549
       597
        
               `

     

       550
       598
        
       						: html`

     

       551
       599
        
               <div class="search-upload">

     

       600
       600
       +
                 ${

     

       601
       601
       +
       						this.sections.length > 1

     

       602
       602
       +
       							? html`

     

       603
       603
       +
                     <select

     

       604
       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       605
       +
                       @change=${(e: Event) => {

     

       606
       606
       +
       									this.selectedSectionFilter =

     

       607
       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       608
       +
       								}}

     

       609
       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       610
       +
                     >

     

       611
       611
       +
                       ${this.sections.map(

     

       612
       612
       +
       									(s) =>

     

       613
       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       614
       +
       								)}

     

       615
       615
       +
                     </select>

     

       616
       616
       +
                   `

     

       617
       617
       +
       							: ""

     

       618
       618
       +
       					}

     

       552
       619
        
                 <input

     

       553
       620
        
                   type="text"

     

       554
       621
        
                   class="search-box"

     
···

       567
       634
        
                 </button>

     

       568
       635
        
               </div>

     

       569
       636
        
       

     

       637
       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       638
       +
               ${

     

       639
       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       640
       +
       						// Apply section filtering to pending recordings

     

       641
       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       642
       +
       						

     

       643
       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       645
       +
       								return false;

     

       646
       646
       +
       							}

     

       647
       647
       +
       							

     

       648
       648
       +
       							// Filter by section if applicable

     

       649
       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       652
       +
       							}

     

       653
       653
       +
       							

     

       654
       654
       +
       							return true;

     

       655
       655
       +
       						}).length;

     

       656
       656
       +
       

     

       657
       657
       +
       						// Only show if there are pending recordings

     

       658
       658
       +
       						if (pendingCount === 0) return "";

     

       659
       659
       +
       

     

       660
       660
       +
       						return html`

     

       661
       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       662
       +
                     <pending-recordings-view

     

       663
       663
       +
                       .classId=${this.classId}

     

       664
       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       666
       +
                       .sectionId=${sectionFilter}

     

       667
       667
       +
                     ></pending-recordings-view>

     

       668
       668
       +
                   </div>

     

       669
       669
       +
                 `;

     

       670
       670
       +
       					})

     

       671
       671
       +
       				}

     

       672
       672
       +
       

     

       673
       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       570
       674
        
               ${

     

       571
       675
        
       					this.filteredTranscriptions.length === 0

     

       572
       676
        
       						? html`

     
···

       631
       735
        
               ?open=${this.uploadModalOpen}

     

       632
       736
        
               .classId=${this.classId}

     

       633
       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       738
       +
               .sections=${this.sections}

     

       739
       739
       +
               .userSection=${this.userSection}

     

       634
       740
        
               @close=${this.handleModalClose}

     

       635
       741
        
               @upload-success=${this.handleUploadSuccess}

     

       636
       742
        
             ></upload-recording-modal>

src/components/classes-overview.ts

···

       232
       232
        
       	}

     

       233
       233
        
       

     

       234
       234
        
       	private async handleClassJoined() {

     

       235
       235
       +
       		this.showRegistrationModal = false;

     

       235
       236
        
       		await this.loadClasses();

     

       236
       237
        
       	}

     

       237
       238

+436

src/components/pending-recordings-view.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       

     

       4
       4
       +
       interface PendingRecording {

     

       5
       5
       +
       	id: string;

     

       6
       6
       +
       	user_id: number;

     

       7
       7
       +
       	filename: string;

     

       8
       8
       +
       	original_filename: string;

     

       9
       9
       +
       	vote_count: number;

     

       10
       10
       +
       	created_at: number;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       interface RecordingsData {

     

       14
       14
       +
       	recordings: PendingRecording[];

     

       15
       15
       +
       	total_users: number;

     

       16
       16
       +
       	user_vote: string | null;

     

       17
       17
       +
       	vote_threshold: number;

     

       18
       18
       +
       	winning_recording_id: string | null;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       @customElement("pending-recordings-view")

     

       22
       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       23
       +
       	@property({ type: String }) classId = "";

     

       24
       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       27
       +
       

     

       28
       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       29
       +
       	@state() private userVote: string | null = null;

     

       30
       30
       +
       	@state() private voteThreshold = 0;

     

       31
       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       32
       +
       	@state() private error: string | null = null;

     

       33
       33
       +
       	@state() private timeRemaining = "";

     

       34
       34
       +
       

     

       35
       35
       +
       	private refreshInterval?: number;

     

       36
       36
       +
       	private loadingInProgress = false;

     

       37
       37
       +
       

     

       38
       38
       +
       	static override styles = css`

     

       39
       39
       +
           :host {

     

       40
       40
       +
             display: block;

     

       41
       41
       +
             padding: 1rem;

     

       42
       42
       +
           }

     

       43
       43
       +
       

     

       44
       44
       +
           .container {

     

       45
       45
       +
             max-width: 56rem;

     

       46
       46
       +
             margin: 0 auto;

     

       47
       47
       +
           }

     

       48
       48
       +
       

     

       49
       49
       +
           h2 {

     

       50
       50
       +
             color: var(--text);

     

       51
       51
       +
             margin-bottom: 0.5rem;

     

       52
       52
       +
           }

     

       53
       53
       +
       

     

       54
       54
       +
           .info {

     

       55
       55
       +
             color: var(--paynes-gray);

     

       56
       56
       +
             font-size: 0.875rem;

     

       57
       57
       +
             margin-bottom: 1.5rem;

     

       58
       58
       +
           }

     

       59
       59
       +
       

     

       60
       60
       +
           .stats {

     

       61
       61
       +
             display: flex;

     

       62
       62
       +
             gap: 2rem;

     

       63
       63
       +
             margin-bottom: 1.5rem;

     

       64
       64
       +
             padding: 1rem;

     

       65
       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       66
       +
             border-radius: 8px;

     

       67
       67
       +
           }

     

       68
       68
       +
       

     

       69
       69
       +
           .stat {

     

       70
       70
       +
             display: flex;

     

       71
       71
       +
             flex-direction: column;

     

       72
       72
       +
             gap: 0.25rem;

     

       73
       73
       +
           }

     

       74
       74
       +
       

     

       75
       75
       +
           .stat-label {

     

       76
       76
       +
             font-size: 0.75rem;

     

       77
       77
       +
             color: var(--paynes-gray);

     

       78
       78
       +
             text-transform: uppercase;

     

       79
       79
       +
             letter-spacing: 0.05em;

     

       80
       80
       +
           }

     

       81
       81
       +
       

     

       82
       82
       +
           .stat-value {

     

       83
       83
       +
             font-size: 1.5rem;

     

       84
       84
       +
             font-weight: 600;

     

       85
       85
       +
             color: var(--text);

     

       86
       86
       +
           }

     

       87
       87
       +
       

     

       88
       88
       +
           .recordings-list {

     

       89
       89
       +
             display: flex;

     

       90
       90
       +
             flex-direction: column;

     

       91
       91
       +
             gap: 1rem;

     

       92
       92
       +
           }

     

       93
       93
       +
       

     

       94
       94
       +
           .recording-card {

     

       95
       95
       +
             border: 2px solid var(--secondary);

     

       96
       96
       +
             border-radius: 8px;

     

       97
       97
       +
             padding: 1rem;

     

       98
       98
       +
             transition: all 0.2s;

     

       99
       99
       +
           }

     

       100
       100
       +
       

     

       101
       101
       +
           .recording-card.voted {

     

       102
       102
       +
             border-color: var(--accent);

     

       103
       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       104
       +
           }

     

       105
       105
       +
       

     

       106
       106
       +
           .recording-card.winning {

     

       107
       107
       +
             border-color: var(--accent);

     

       108
       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       109
       +
           }

     

       110
       110
       +
       

     

       111
       111
       +
           .recording-header {

     

       112
       112
       +
             display: flex;

     

       113
       113
       +
             justify-content: space-between;

     

       114
       114
       +
             align-items: center;

     

       115
       115
       +
             margin-bottom: 0.75rem;

     

       116
       116
       +
           }

     

       117
       117
       +
       

     

       118
       118
       +
           .recording-info {

     

       119
       119
       +
             flex: 1;

     

       120
       120
       +
           }

     

       121
       121
       +
       

     

       122
       122
       +
           .recording-name {

     

       123
       123
       +
             font-weight: 600;

     

       124
       124
       +
             color: var(--text);

     

       125
       125
       +
             margin-bottom: 0.25rem;

     

       126
       126
       +
           }

     

       127
       127
       +
       

     

       128
       128
       +
           .recording-meta {

     

       129
       129
       +
             font-size: 0.75rem;

     

       130
       130
       +
             color: var(--paynes-gray);

     

       131
       131
       +
           }

     

       132
       132
       +
       

     

       133
       133
       +
           .vote-section {

     

       134
       134
       +
             display: flex;

     

       135
       135
       +
             align-items: center;

     

       136
       136
       +
             gap: 1rem;

     

       137
       137
       +
           }

     

       138
       138
       +
       

     

       139
       139
       +
           .vote-count {

     

       140
       140
       +
             font-size: 1.25rem;

     

       141
       141
       +
             font-weight: 600;

     

       142
       142
       +
             color: var(--accent);

     

       143
       143
       +
             min-width: 3rem;

     

       144
       144
       +
             text-align: center;

     

       145
       145
       +
           }

     

       146
       146
       +
       

     

       147
       147
       +
           .vote-button {

     

       148
       148
       +
             padding: 0.5rem 1rem;

     

       149
       149
       +
             border-radius: 6px;

     

       150
       150
       +
             font-size: 0.875rem;

     

       151
       151
       +
             font-weight: 500;

     

       152
       152
       +
             cursor: pointer;

     

       153
       153
       +
             transition: all 0.2s;

     

       154
       154
       +
             border: 2px solid var(--secondary);

     

       155
       155
       +
             background: var(--background);

     

       156
       156
       +
             color: var(--text);

     

       157
       157
       +
           }

     

       158
       158
       +
       

     

       159
       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       160
       +
             border-color: var(--accent);

     

       161
       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       162
       +
           }

     

       163
       163
       +
       

     

       164
       164
       +
           .vote-button.voted {

     

       165
       165
       +
             border-color: var(--accent);

     

       166
       166
       +
             background: var(--accent);

     

       167
       167
       +
             color: var(--white);

     

       168
       168
       +
           }

     

       169
       169
       +
       

     

       170
       170
       +
           .vote-button:disabled {

     

       171
       171
       +
             opacity: 0.5;

     

       172
       172
       +
             cursor: not-allowed;

     

       173
       173
       +
           }

     

       174
       174
       +
       

     

       175
       175
       +
           .delete-button {

     

       176
       176
       +
             padding: 0.5rem;

     

       177
       177
       +
             border: none;

     

       178
       178
       +
             background: transparent;

     

       179
       179
       +
             color: var(--paynes-gray);

     

       180
       180
       +
             cursor: pointer;

     

       181
       181
       +
             border-radius: 4px;

     

       182
       182
       +
             transition: all 0.2s;

     

       183
       183
       +
           }

     

       184
       184
       +
       

     

       185
       185
       +
           .delete-button:hover {

     

       186
       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       187
       +
             color: red;

     

       188
       188
       +
           }

     

       189
       189
       +
       

     

       190
       190
       +
           .winning-badge {

     

       191
       191
       +
             background: var(--accent);

     

       192
       192
       +
             color: var(--white);

     

       193
       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       194
       +
             border-radius: 12px;

     

       195
       195
       +
             font-size: 0.75rem;

     

       196
       196
       +
             font-weight: 600;

     

       197
       197
       +
           }

     

       198
       198
       +
       

     

       199
       199
       +
           .error {

     

       200
       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       201
       +
             border: 1px solid red;

     

       202
       202
       +
             color: red;

     

       203
       203
       +
             padding: 0.75rem;

     

       204
       204
       +
             border-radius: 4px;

     

       205
       205
       +
             margin-bottom: 1rem;

     

       206
       206
       +
             font-size: 0.875rem;

     

       207
       207
       +
           }

     

       208
       208
       +
       

     

       209
       209
       +
           .empty-state {

     

       210
       210
       +
             text-align: center;

     

       211
       211
       +
             padding: 3rem 1rem;

     

       212
       212
       +
             color: var(--paynes-gray);

     

       213
       213
       +
           }

     

       214
       214
       +
       

     

       215
       215
       +
           .audio-player {

     

       216
       216
       +
             margin-top: 0.75rem;

     

       217
       217
       +
           }

     

       218
       218
       +
       

     

       219
       219
       +
           audio {

     

       220
       220
       +
             width: 100%;

     

       221
       221
       +
             height: 2.5rem;

     

       222
       222
       +
           }

     

       223
       223
       +
         `;

     

       224
       224
       +
       

     

       225
       225
       +
       	override connectedCallback() {

     

       226
       226
       +
       		super.connectedCallback();

     

       227
       227
       +
       		this.loadRecordings();

     

       228
       228
       +
       		// Refresh every 10 seconds

     

       229
       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	override disconnectedCallback() {

     

       233
       233
       +
       		super.disconnectedCallback();

     

       234
       234
       +
       		if (this.refreshInterval) {

     

       235
       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       236
       +
       		}

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	private async loadRecordings() {

     

       240
       240
       +
       		if (this.loadingInProgress) return;

     

       241
       241
       +
       

     

       242
       242
       +
       		this.loadingInProgress = true;

     

       243
       243
       +
       

     

       244
       244
       +
       		try {

     

       245
       245
       +
       			// Build URL with optional section_id parameter

     

       246
       246
       +
       			const url = new URL(

     

       247
       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       248
       +
       				window.location.origin,

     

       249
       249
       +
       			);

     

       250
       250
       +
       			if (this.sectionId !== null) {

     

       251
       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       252
       +
       			}

     

       253
       253
       +
       

     

       254
       254
       +
       			const response = await fetch(url.toString());

     

       255
       255
       +
       

     

       256
       256
       +
       			if (!response.ok) {

     

       257
       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       258
       +
       			}

     

       259
       259
       +
       

     

       260
       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       261
       +
       			this.recordings = data.recordings;

     

       262
       262
       +
       			this.userVote = data.user_vote;

     

       263
       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       265
       +
       

     

       266
       266
       +
       			// Calculate time remaining for first recording

     

       267
       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       269
       +
       				const now = Date.now() / 1000;

     

       270
       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       272
       +
       

     

       273
       273
       +
       				if (remaining > 0) {

     

       274
       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       277
       +
       				} else {

     

       278
       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       279
       +
       				}

     

       280
       280
       +
       			}

     

       281
       281
       +
       

     

       282
       282
       +
       			this.error = null;

     

       283
       283
       +
       		} catch (error) {

     

       284
       284
       +
       			this.error =

     

       285
       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       286
       +
       		} finally {

     

       287
       287
       +
       			this.loadingInProgress = false;

     

       288
       288
       +
       		}

     

       289
       289
       +
       	}

     

       290
       290
       +
       

     

       291
       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       292
       +
       		try {

     

       293
       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       294
       +
       				method: "POST",

     

       295
       295
       +
       			});

     

       296
       296
       +
       

     

       297
       297
       +
       			if (!response.ok) {

     

       298
       298
       +
       				throw new Error("Failed to vote");

     

       299
       299
       +
       			}

     

       300
       300
       +
       

     

       301
       301
       +
       			const data = await response.json();

     

       302
       302
       +
       

     

       303
       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       304
       +
       			if (data.winning_recording_id) {

     

       305
       305
       +
       				window.location.reload();

     

       306
       306
       +
       			} else {

     

       307
       307
       +
       				// Just reload recordings to show updated votes

     

       308
       308
       +
       				await this.loadRecordings();

     

       309
       309
       +
       			}

     

       310
       310
       +
       		} catch (error) {

     

       311
       311
       +
       			this.error =

     

       312
       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       313
       +
       		}

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       318
       +
       			return;

     

       319
       319
       +
       		}

     

       320
       320
       +
       

     

       321
       321
       +
       		try {

     

       322
       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       323
       +
       				method: "DELETE",

     

       324
       324
       +
       			});

     

       325
       325
       +
       

     

       326
       326
       +
       			if (!response.ok) {

     

       327
       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       328
       +
       			}

     

       329
       329
       +
       

     

       330
       330
       +
       			await this.loadRecordings();

     

       331
       331
       +
       		} catch (error) {

     

       332
       332
       +
       			this.error =

     

       333
       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       334
       +
       		}

     

       335
       335
       +
       	}

     

       336
       336
       +
       

     

       337
       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       338
       +
       		const now = Date.now() / 1000;

     

       339
       339
       +
       		const diff = now - timestamp;

     

       340
       340
       +
       

     

       341
       341
       +
       		if (diff < 60) return "just now";

     

       342
       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       345
       +
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	override render() {

     

       348
       348
       +
       		return html`

     

       349
       349
       +
             <div class="container">

     

       350
       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       351
       +
               <p class="info">

     

       352
       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       353
       +
               </p>

     

       354
       354
       +
       

     

       355
       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       356
       +
       

     

       357
       357
       +
               ${

     

       358
       358
       +
       					this.recordings.length > 0

     

       359
       359
       +
       						? html`

     

       360
       360
       +
                   <div class="stats">

     

       361
       361
       +
                     <div class="stat">

     

       362
       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       364
       +
                     </div>

     

       365
       365
       +
                     <div class="stat">

     

       366
       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       368
       +
                     </div>

     

       369
       369
       +
                     <div class="stat">

     

       370
       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       372
       +
                     </div>

     

       373
       373
       +
                   </div>

     

       374
       374
       +
       

     

       375
       375
       +
                   <div class="recordings-list">

     

       376
       376
       +
                     ${this.recordings.map(

     

       377
       377
       +
       								(recording) => html`

     

       378
       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       379
       +
                         <div class="recording-header">

     

       380
       380
       +
                           <div class="recording-info">

     

       381
       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       382
       +
                             <div class="recording-meta">

     

       383
       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       384
       +
                             </div>

     

       385
       385
       +
                           </div>

     

       386
       386
       +
       

     

       387
       387
       +
                           <div class="vote-section">

     

       388
       388
       +
                             ${

     

       389
       389
       +
       												this.winningRecordingId === recording.id

     

       390
       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       391
       +
       													: ""

     

       392
       392
       +
       											}

     

       393
       393
       +
                             

     

       394
       394
       +
                             <div class="vote-count">

     

       395
       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       396
       +
                             </div>

     

       397
       397
       +
       

     

       398
       398
       +
                             <button

     

       399
       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       402
       +
                             >

     

       403
       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       404
       +
                             </button>

     

       405
       405
       +
       

     

       406
       406
       +
                             <button

     

       407
       407
       +
                               class="delete-button"

     

       408
       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       409
       +
                               title="Delete recording"

     

       410
       410
       +
                             >

     

       411
       411
       +
                               🗑️

     

       412
       412
       +
                             </button>

     

       413
       413
       +
                           </div>

     

       414
       414
       +
                         </div>

     

       415
       415
       +
       

     

       416
       416
       +
                         <div class="audio-player">

     

       417
       417
       +
                           <audio controls preload="none">

     

       418
       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       419
       +
                           </audio>

     

       420
       420
       +
                         </div>

     

       421
       421
       +
                       </div>

     

       422
       422
       +
                     `,

     

       423
       423
       +
       							)}

     

       424
       424
       +
                   </div>

     

       425
       425
       +
                 `

     

       426
       426
       +
       						: html`

     

       427
       427
       +
                   <div class="empty-state">

     

       428
       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       430
       +
                   </div>

     

       431
       431
       +
                 `

     

       432
       432
       +
       				}

     

       433
       433
       +
             </div>

     

       434
       434
       +
           `;

     

       435
       435
       +
       	}

     

       436
       436
       +
       }

+2 -2

src/components/transcription.ts

···

       565
       565
        
       

     

       566
       566
        
       	async checkHealth() {

     

       567
       567
        
       		try {

     

       568
       568
       -
       			const response = await fetch("/api/transcriptions/health");

     

       568
       568
       +
       			const response = await fetch("/api/health");

     

       569
       569
        
       			if (response.ok) {

     

       570
       570
        
       				const data = await response.json();

     

       571
       571
       -
       				this.serviceAvailable = data.available;

     

       571
       571
       +
       				this.serviceAvailable = data.status === "healthy";

     

       572
       572
        
       			} else {

     

       573
       573
        
       				this.serviceAvailable = false;

     

       574
       574
        
       			}

+74 -1

src/db/schema.ts

···

       1
       1
        
       import { Database } from "bun:sqlite";

     

       2
       2
        
       

     

       3
       3
       -
       export const db = new Database("thistle.db");

     

       3
       3
       +
       // Use test database when NODE_ENV is test

     

       4
       4
       +
       const dbPath =

     

       5
       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
       6
       +
       export const db = new Database(dbPath);

     

       7
       7
       +
       

     

       8
       8
       +
       console.log(`[Database] Using database: ${dbPath}`);

     

       4
       9
        
       

     

       5
       10
        
       // Schema version tracking

     

       6
       11
        
       db.run(`

     
···

       219
       224
        
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       220
       225
        
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       221
       226
        
           `,

     

       227
       227
       +
       	},

     

       228
       228
       +
       	{

     

       229
       229
       +
       		version: 2,

     

       230
       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       231
       +
       		sql: `

     

       232
       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       234
       +
       

     

       235
       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       237
       +
       

     

       238
       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       241
       +
       				class_id TEXT NOT NULL,

     

       242
       242
       +
       				section_number TEXT NOT NULL,

     

       243
       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       246
       +
       			);

     

       247
       247
       +
       

     

       248
       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       249
       +
       

     

       250
       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       252
       +
       

     

       253
       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       254
       +
       		`,

     

       255
       255
       +
       	},

     

       256
       256
       +
       	{

     

       257
       257
       +
       		version: 3,

     

       258
       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       259
       259
       +
       		sql: `

     

       260
       260
       +
       			-- Add vote count to transcriptions

     

       261
       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       262
       +
       

     

       263
       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       265
       +
       

     

       266
       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       275
       +
       			);

     

       276
       276
       +
       

     

       277
       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       279
       +
       		`,

     

       280
       280
       +
       	},

     

       281
       281
       +
       	{

     

       282
       282
       +
       		version: 4,

     

       283
       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
       284
       +
       		sql: `

     

       285
       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       286
       +
       			-- Defaults to created_at for existing records

     

       287
       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       288
       +
       			

     

       289
       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       291
       +
       

     

       292
       292
       +
       			-- Create index for ordering by recording date

     

       293
       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       294
       +
       		`,

     

       222
       295
        
       	},

     

       223
       296
        
       ];

     

       224
       297

+3 -1

src/index.test.README.md

···

       55
       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
       57
        
       

     

       58
       58
       +
       ### Health Endpoint

     

       59
       59
       +
       - `GET /api/health` - Check service health (database, whisper, storage)

     

       60
       60
       +
       

     

       58
       61
        
       ### Transcription Endpoints

     

       59
       59
       -
       - `GET /api/transcriptions/health` - Check transcription service health

     

       60
       62
        
       - `GET /api/transcriptions` - List user transcriptions

     

       61
       63
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       62
       64
        
       - `GET /api/transcriptions/:id` - Get transcription details

+353 -747

src/index.test.ts

···

       6
       6
        
       	expect,

     

       7
       7
        
       	test,

     

       8
       8
        
       } from "bun:test";

     

       9
       9
       -
       import db from "./db/schema";

     

       9
       9
       +
       import type { Subprocess } from "bun";

     

       10
       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
       11
        
       

     

       12
       12
       -
       // Test server URL - uses port 3001 for testing to avoid conflicts

     

       12
       12
       +
       // Test server configuration

     

       13
       13
        
       const TEST_PORT = 3001;

     

       14
       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       15
       15
       +
       const TEST_DB_PATH = "./thistle.test.db";

     

       15
       16
        
       

     

       16
       16
       -
       // Check if server is available

     

       17
       17
       -
       let serverAvailable = false;

     

       17
       17
       +
       // Test server process

     

       18
       18
       +
       let serverProcess: Subprocess | null = null;

     

       18
       19
        
       

     

       19
       20
        
       beforeAll(async () => {

     

       21
       21
       +
       	// Clean up any existing test database

     

       20
       22
        
       	try {

     

       21
       21
       -
       		const response = await fetch(`${BASE_URL}/api/transcriptions/health`, {

     

       22
       22
       -
       			signal: AbortSignal.timeout(1000),

     

       23
       23
       -
       		});

     

       24
       24
       -
       		serverAvailable = response.ok || response.status === 404;

     

       23
       23
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       25
       24
        
       	} catch {

     

       26
       26
       -
       		console.warn(

     

       27
       27
       -
       			`\n⚠️  Test server not running on port ${TEST_PORT}. Start it with:\n   PORT=${TEST_PORT} bun run src/index.ts\n   Then run tests in another terminal.\n`,

     

       28
       28
       -
       		);

     

       29
       29
       -
       		serverAvailable = false;

     

       25
       25
       +
       		// Ignore if doesn't exist

     

       30
       26
        
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	// Start test server as subprocess

     

       29
       29
       +
       	serverProcess = Bun.spawn(["bun", "run", "src/index.ts"], {

     

       30
       30
       +
       		env: {

     

       31
       31
       +
       			...process.env,

     

       32
       32
       +
       			NODE_ENV: "test",

     

       33
       33
       +
       			PORT: TEST_PORT.toString(),

     

       34
       34
       +
       			SKIP_EMAILS: "true",

     

       35
       35
       +
       			SKIP_POLAR_SYNC: "true",

     

       36
       36
       +
       			// Dummy env vars to pass startup validation (won't be used due to SKIP_EMAILS/SKIP_POLAR_SYNC)

     

       37
       37
       +
       			MAILCHANNELS_API_KEY: "test-key",

     

       38
       38
       +
       			DKIM_PRIVATE_KEY: "test-key",

     

       39
       39
       +
       			LLM_API_KEY: "test-key",

     

       40
       40
       +
       			LLM_API_BASE_URL: "https://test.com",

     

       41
       41
       +
       			LLM_MODEL: "test-model",

     

       42
       42
       +
       			POLAR_ACCESS_TOKEN: "test-token",

     

       43
       43
       +
       			POLAR_ORGANIZATION_ID: "test-org",

     

       44
       44
       +
       			POLAR_PRODUCT_ID: "test-product",

     

       45
       45
       +
       			POLAR_SUCCESS_URL: "http://localhost:3001/success",

     

       46
       46
       +
       			POLAR_WEBHOOK_SECRET: "test-webhook-secret",

     

       47
       47
       +
       			ORIGIN: "http://localhost:3001",

     

       48
       48
       +
       		},

     

       49
       49
       +
       		stdout: "pipe",

     

       50
       50
       +
       		stderr: "pipe",

     

       51
       51
       +
       	});

     

       52
       52
       +
       

     

       53
       53
       +
       	// Log server output for debugging

     

       54
       54
       +
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       55
       +
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       56
       +
       	const decoder = new TextDecoder();

     

       57
       57
       +
       

     

       58
       58
       +
       	(async () => {

     

       59
       59
       +
       		try {

     

       60
       60
       +
       			while (true) {

     

       61
       61
       +
       				const { value, done } = await stdoutReader.read();

     

       62
       62
       +
       				if (done) break;

     

       63
       63
       +
       				const text = decoder.decode(value);

     

       64
       64
       +
       				console.log("[SERVER OUT]", text.trim());

     

       65
       65
       +
       			}

     

       66
       66
       +
       		} catch {}

     

       67
       67
       +
       	})();

     

       68
       68
       +
       

     

       69
       69
       +
       	(async () => {

     

       70
       70
       +
       		try {

     

       71
       71
       +
       			while (true) {

     

       72
       72
       +
       				const { value, done } = await stderrReader.read();

     

       73
       73
       +
       				if (done) break;

     

       74
       74
       +
       				const text = decoder.decode(value);

     

       75
       75
       +
       				console.error("[SERVER ERR]", text.trim());

     

       76
       76
       +
       			}

     

       77
       77
       +
       		} catch {}

     

       78
       78
       +
       	})();

     

       79
       79
       +
       

     

       80
       80
       +
       	// Wait for server to be ready

     

       81
       81
       +
       	let retries = 30;

     

       82
       82
       +
       	let ready = false;

     

       83
       83
       +
       	while (retries > 0 && !ready) {

     

       84
       84
       +
       		try {

     

       85
       85
       +
       			const response = await fetch(`${BASE_URL}/api/health`, {

     

       86
       86
       +
       				signal: AbortSignal.timeout(1000),

     

       87
       87
       +
       			});

     

       88
       88
       +
       			if (response.ok) {

     

       89
       89
       +
       				ready = true;

     

       90
       90
       +
       				break;

     

       91
       91
       +
       			}

     

       92
       92
       +
       		} catch {

     

       93
       93
       +
       			// Server not ready yet

     

       94
       94
       +
       		}

     

       95
       95
       +
       		await new Promise((resolve) => setTimeout(resolve, 500));

     

       96
       96
       +
       		retries--;

     

       97
       97
       +
       	}

     

       98
       98
       +
       

     

       99
       99
       +
       	if (!ready) {

     

       100
       100
       +
       		throw new Error("Test server failed to start within 15 seconds");

     

       101
       101
       +
       	}

     

       102
       102
       +
       

     

       103
       103
       +
       	console.log(`✓ Test server running on port ${TEST_PORT}`);

     

       104
       104
       +
       });

     

       105
       105
       +
       

     

       106
       106
       +
       afterAll(async () => {

     

       107
       107
       +
       	// Kill test server

     

       108
       108
       +
       	if (serverProcess) {

     

       109
       109
       +
       		serverProcess.kill();

     

       110
       110
       +
       		await new Promise((resolve) => setTimeout(resolve, 1000));

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Clean up test database

     

       114
       114
       +
       	try {

     

       115
       115
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       116
       116
       +
       	} catch {

     

       117
       117
       +
       		// Ignore if doesn't exist

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       121
       +
       });

     

       122
       122
       +
       

     

       123
       123
       +
       // Clear database between each test

     

       124
       124
       +
       beforeEach(async () => {

     

       125
       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       126
       +
       

     

       127
       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       138
       +
       	db.run("DELETE FROM classes");

     

       139
       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       141
       +
       

     

       142
       142
       +
       	db.close();

     

       31
       143
        
       });

     

       32
       144
        
       

     

       33
       145
        
       // Test user credentials

     
···

       81
       193
        
       	});

     

       82
       194
        
       }

     

       83
       195
        
       

     

       84
       84
       -
       // Cleanup helpers

     

       85
       85
       -
       function cleanupTestData() {

     

       86
       86
       -
       	// Delete test users and their related data (cascade will handle most of it)

     

       87
       87
       -
       	// Include 'newemail%' to catch users whose emails were updated during tests

     

       88
       88
       -
       	db.run(

     

       89
       89
       -
       		"DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       90
       90
       -
       	);

     

       91
       91
       -
       	db.run(

     

       92
       92
       -
       		"DELETE FROM passkeys WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       93
       93
       -
       	);

     

       94
       94
       -
       	db.run(

     

       95
       95
       -
       		"DELETE FROM transcriptions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       96
       96
       -
       	);

     

       97
       97
       -
       	db.run(

     

       98
       98
       -
       		"DELETE FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%'",

     

       99
       99
       -
       	);

     

       196
       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       197
       +
       async function registerAndLogin(user: {

     

       198
       198
       +
       	email: string;

     

       199
       199
       +
       	password: string;

     

       200
       200
       +
       	name?: string;

     

       201
       201
       +
       }): Promise<string> {

     

       202
       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       203
       +
       

     

       204
       204
       +
       	// Register the user

     

       205
       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       206
       +
       		method: "POST",

     

       207
       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       208
       +
       		body: JSON.stringify({

     

       209
       209
       +
       			email: user.email,

     

       210
       210
       +
       			password: hashedPassword,

     

       211
       211
       +
       			name: user.name || "Test User",

     

       212
       212
       +
       		}),

     

       213
       213
       +
       	});

     

       214
       214
       +
       

     

       215
       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       216
       +
       		const error = await registerResponse.json();

     

       217
       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       218
       +
       	}

     

       219
       219
       +
       

     

       220
       220
       +
       	const registerData = await registerResponse.json();

     

       221
       221
       +
       	const userId = registerData.user.id;

     

       222
       222
       +
       

     

       223
       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       226
       +
       	db.close();

     

       100
       227
        
       

     

       101
       101
       -
       	// Clear ALL rate limit data to prevent accumulation across tests

     

       102
       102
       -
       	// (IP-based rate limits don't contain test/admin in the key)

     

       103
       103
       -
       	db.run("DELETE FROM rate_limit_attempts");

     

       104
       104
       -
       }

     

       228
       228
       +
       	// Now login to get a session

     

       229
       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       230
       +
       		method: "POST",

     

       231
       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       232
       +
       		body: JSON.stringify({

     

       233
       233
       +
       			email: user.email,

     

       234
       234
       +
       			password: hashedPassword,

     

       235
       235
       +
       		}),

     

       236
       236
       +
       	});

     

       105
       237
        
       

     

       106
       106
       -
       beforeEach(() => {

     

       107
       107
       -
       	if (serverAvailable) {

     

       108
       108
       -
       		cleanupTestData();

     

       238
       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       239
       +
       		const error = await loginResponse.json();

     

       240
       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       109
       241
        
       	}

     

       110
       110
       -
       });

     

       111
       242
        
       

     

       112
       112
       -
       afterAll(() => {

     

       113
       113
       -
       	if (serverAvailable) {

     

       114
       114
       -
       		cleanupTestData();

     

       243
       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       // Helper to add active subscription to a user

     

       247
       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       249
       +
       	const user = db

     

       250
       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       251
       +
       		.get(userEmail) as { id: number };

     

       252
       252
       +
       	if (!user) {

     

       253
       253
       +
       		db.close();

     

       254
       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       115
       255
        
       	}

     

       116
       116
       -
       });

     

       117
       256
        
       

     

       118
       118
       -
       // Helper to skip tests if server is not available

     

       119
       119
       -
       function serverTest(name: string, fn: () => void | Promise<void>) {

     

       120
       120
       -
       	test(name, async () => {

     

       121
       121
       -
       		if (!serverAvailable) {

     

       122
       122
       -
       			console.log(`⏭️  Skipping: ${name} (server not running)`);

     

       123
       123
       -
       			return;

     

       124
       124
       -
       		}

     

       125
       125
       -
       		await fn();

     

       126
       126
       -
       	});

     

       257
       257
       +
       	db.run(

     

       258
       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       260
       +
       	);

     

       261
       261
       +
       	db.close();

     

       127
       262
        
       }

     

       128
       263
        
       

     

       264
       264
       +
       // All tests run against a fresh database, no cleanup needed

     

       265
       265
       +
       

     

       129
       266
        
       describe("API Endpoints - Authentication", () => {

     

       130
       267
        
       	describe("POST /api/auth/register", () => {

     

       131
       131
       -
       		serverTest("should register a new user successfully", async () => {

     

       268
       268
       +
       		test("should register a new user successfully", async () => {

     

       132
       269
        
       			const hashedPassword = await clientHashPassword(

     

       133
       270
        
       				TEST_USER.email,

     

       134
       271
        
       				TEST_USER.password,

     
···

       144
       281
        
       				}),

     

       145
       282
        
       			});

     

       146
       283
        
       

     

       147
       147
       -
       			expect(response.status).toBe(200);

     

       284
       284
       +
       			if (response.status !== 201) {

     

       285
       285
       +
       				const error = await response.json();

     

       286
       286
       +
       				console.error("Registration failed:", response.status, error);

     

       287
       287
       +
       			}

     

       288
       288
       +
       

     

       289
       289
       +
       			expect(response.status).toBe(201);

     

       290
       290
       +
       

     

       148
       291
        
       			const data = await response.json();

     

       149
       292
        
       			expect(data.user).toBeDefined();

     

       150
       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       151
       151
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       294
       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       152
       295
        
       		});

     

       153
       296
        
       

     

       154
       154
       -
       		serverTest("should reject registration with missing email", async () => {

     

       297
       297
       +
       		test("should reject registration with missing email", async () => {

     

       155
       298
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       156
       299
        
       				method: "POST",

     

       157
       300
        
       				headers: { "Content-Type": "application/json" },

     
···

       165
       308
        
       			expect(data.error).toBe("Email and password required");

     

       166
       309
        
       		});

     

       167
       310
        
       

     

       168
       168
       -
       		serverTest(

     

       169
       169
       -
       			"should reject registration with invalid password format",

     

       170
       170
       -
       			async () => {

     

       171
       171
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       172
       172
       -
       					method: "POST",

     

       173
       173
       -
       					headers: { "Content-Type": "application/json" },

     

       174
       174
       -
       					body: JSON.stringify({

     

       175
       175
       -
       						email: TEST_USER.email,

     

       176
       176
       -
       						password: "short",

     

       177
       177
       -
       					}),

     

       178
       178
       -
       				});

     

       179
       179
       -
       

     

       180
       180
       -
       				expect(response.status).toBe(400);

     

       181
       181
       -
       				const data = await response.json();

     

       182
       182
       -
       				expect(data.error).toBe("Invalid password format");

     

       183
       183
       -
       			},

     

       184
       184
       -
       		);

     

       185
       185
       -
       

     

       186
       186
       -
       		serverTest("should reject duplicate email registration", async () => {

     

       187
       187
       -
       			const hashedPassword = await clientHashPassword(

     

       188
       188
       -
       				TEST_USER.email,

     

       189
       189
       -
       				TEST_USER.password,

     

       190
       190
       -
       			);

     

       191
       191
       -
       

     

       192
       192
       -
       			// First registration

     

       193
       193
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       194
       194
       -
       				method: "POST",

     

       195
       195
       -
       				headers: { "Content-Type": "application/json" },

     

       196
       196
       -
       				body: JSON.stringify({

     

       197
       197
       -
       					email: TEST_USER.email,

     

       198
       198
       -
       					password: hashedPassword,

     

       199
       199
       -
       					name: TEST_USER.name,

     

       200
       200
       -
       				}),

     

       201
       201
       -
       			});

     

       202
       202
       -
       

     

       203
       203
       -
       			// Duplicate registration

     

       311
       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       204
       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       205
       313
        
       				method: "POST",

     

       206
       314
        
       				headers: { "Content-Type": "application/json" },

     

       207
       315
        
       				body: JSON.stringify({

     

       208
       316
        
       					email: TEST_USER.email,

     

       209
       209
       -
       					password: hashedPassword,

     

       210
       210
       -
       					name: TEST_USER.name,

     

       317
       317
       +
       					password: "short",

     

       211
       318
        
       				}),

     

       212
       319
        
       			});

     

       213
       320
        
       

     

       214
       321
        
       			expect(response.status).toBe(400);

     

       215
       322
        
       			const data = await response.json();

     

       216
       216
       -
       			expect(data.error).toBe("Email already registered");

     

       323
       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       217
       324
        
       		});

     

       218
       325
        
       

     

       219
       219
       -
       		serverTest("should enforce rate limiting on registration", async () => {

     

       220
       220
       -
       			const hashedPassword = await clientHashPassword(

     

       221
       221
       -
       				"test@example.com",

     

       222
       222
       -
       				"password",

     

       223
       223
       -
       			);

     

       224
       224
       -
       

     

       225
       225
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       226
       226
       -
       			let rateLimitHit = false;

     

       227
       227
       -
       			for (let i = 0; i < 10; i++) {

     

       228
       228
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       229
       229
       -
       					method: "POST",

     

       230
       230
       -
       					headers: { "Content-Type": "application/json" },

     

       231
       231
       -
       					body: JSON.stringify({

     

       232
       232
       -
       						email: `test${i}@example.com`,

     

       233
       233
       -
       						password: hashedPassword,

     

       234
       234
       -
       					}),

     

       235
       235
       -
       				});

     

       236
       236
       -
       

     

       237
       237
       -
       				if (response.status === 429) {

     

       238
       238
       -
       					rateLimitHit = true;

     

       239
       239
       -
       					break;

     

       240
       240
       -
       				}

     

       241
       241
       -
       			}

     

       242
       242
       -
       

     

       243
       243
       -
       			// Verify that rate limiting was triggered

     

       244
       244
       -
       			expect(rateLimitHit).toBe(true);

     

       245
       245
       -
       		});

     

       246
       246
       -
       	});

     

       247
       247
       -
       

     

       248
       248
       -
       	describe("POST /api/auth/login", () => {

     

       249
       249
       -
       		serverTest("should login successfully with valid credentials", async () => {

     

       250
       250
       -
       			// Register user first

     

       326
       326
       +
       		test("should reject duplicate email registration", async () => {

     

       251
       327
        
       			const hashedPassword = await clientHashPassword(

     

       252
       328
        
       				TEST_USER.email,

     

       253
       329
        
       				TEST_USER.password,

     

       254
       330
        
       			);

     

       331
       331
       +
       

     

       332
       332
       +
       			// First registration

     

       255
       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       256
       334
        
       				method: "POST",

     

       257
       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       262
       340
        
       				}),

     

       263
       341
        
       			});

     

       264
       342
        
       

     

       265
       265
       -
       			// Login

     

       266
       266
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       343
       343
       +
       			// Duplicate registration

     

       344
       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       267
       345
        
       				method: "POST",

     

       268
       346
        
       				headers: { "Content-Type": "application/json" },

     

       269
       347
        
       				body: JSON.stringify({

     

       270
       348
        
       					email: TEST_USER.email,

     

       271
       349
        
       					password: hashedPassword,

     

       350
       350
       +
       					name: TEST_USER.name,

     

       272
       351
        
       				}),

     

       273
       352
        
       			});

     

       274
       353
        
       

     

       275
       275
       -
       			expect(response.status).toBe(200);

     

       354
       354
       +
       			expect(response.status).toBe(409);

     

       276
       355
        
       			const data = await response.json();

     

       277
       277
       -
       			expect(data.user).toBeDefined();

     

       278
       278
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       279
       279
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       356
       356
       +
       			expect(data.error).toBe("Email already registered");

     

       280
       357
        
       		});

     

       281
       358
        
       

     

       282
       282
       -
       		serverTest("should reject login with invalid credentials", async () => {

     

       283
       283
       -
       			// Register user first

     

       359
       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       284
       360
        
       			const hashedPassword = await clientHashPassword(

     

       285
       285
       -
       				TEST_USER.email,

     

       286
       286
       -
       				TEST_USER.password,

     

       361
       361
       +
       				"ratelimit@example.com",

     

       362
       362
       +
       				"password",

     

       287
       363
        
       			);

     

       364
       364
       +
       

     

       365
       365
       +
       			// First registration succeeds

     

       288
       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       289
       367
        
       				method: "POST",

     

       290
       368
        
       				headers: { "Content-Type": "application/json" },

     

       291
       369
        
       				body: JSON.stringify({

     

       292
       292
       -
       					email: TEST_USER.email,

     

       370
       370
       +
       					email: "ratelimit@example.com",

     

       293
       371
        
       					password: hashedPassword,

     

       294
       372
        
       				}),

     

       295
       373
        
       			});

     

       296
       374
        
       

     

       297
       297
       -
       			// Login with wrong password

     

       298
       298
       -
       			const wrongPassword = await clientHashPassword(

     

       299
       299
       -
       				TEST_USER.email,

     

       300
       300
       -
       				"WrongPassword123!",

     

       301
       301
       -
       			);

     

       302
       302
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       303
       303
       -
       				method: "POST",

     

       304
       304
       -
       				headers: { "Content-Type": "application/json" },

     

       305
       305
       -
       				body: JSON.stringify({

     

       306
       306
       -
       					email: TEST_USER.email,

     

       307
       307
       -
       					password: wrongPassword,

     

       308
       308
       -
       				}),

     

       309
       309
       -
       			});

     

       310
       310
       -
       

     

       311
       311
       -
       			expect(response.status).toBe(401);

     

       312
       312
       -
       			const data = await response.json();

     

       313
       313
       -
       			expect(data.error).toBe("Invalid email or password");

     

       314
       314
       -
       		});

     

       315
       315
       -
       

     

       316
       316
       -
       		serverTest("should reject login with missing fields", async () => {

     

       317
       317
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       318
       318
       -
       				method: "POST",

     

       319
       319
       -
       				headers: { "Content-Type": "application/json" },

     

       320
       320
       -
       				body: JSON.stringify({

     

       321
       321
       -
       					email: TEST_USER.email,

     

       322
       322
       -
       				}),

     

       323
       323
       -
       			});

     

       324
       324
       -
       

     

       325
       325
       -
       			expect(response.status).toBe(400);

     

       326
       326
       -
       			const data = await response.json();

     

       327
       327
       -
       			expect(data.error).toBe("Email and password required");

     

       328
       328
       -
       		});

     

       329
       329
       -
       

     

       330
       330
       -
       		serverTest("should enforce rate limiting on login attempts", async () => {

     

       331
       331
       -
       			const hashedPassword = await clientHashPassword(

     

       332
       332
       -
       				TEST_USER.email,

     

       333
       333
       -
       				TEST_USER.password,

     

       334
       334
       -
       			);

     

       335
       335
       -
       

     

       336
       336
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       375
       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       337
       377
        
       			let rateLimitHit = false;

     

       338
       338
       -
       			for (let i = 0; i < 11; i++) {

     

       339
       339
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       378
       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       340
       380
        
       					method: "POST",

     

       341
       381
        
       					headers: { "Content-Type": "application/json" },

     

       342
       382
        
       					body: JSON.stringify({

     

       343
       343
       -
       						email: TEST_USER.email,

     

       383
       383
       +
       						email: "ratelimit@example.com",

     

       344
       384
        
       						password: hashedPassword,

     

       345
       385
        
       					}),

     

       346
       386
        
       				});

     
···

       356
       396
        
       		});

     

       357
       397
        
       	});

     

       358
       398
        
       

     

       359
       359
       -
       	describe("POST /api/auth/logout", () => {

     

       360
       360
       -
       		serverTest("should logout successfully", async () => {

     

       399
       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       361
       401
        
       			// Register and login

     

       362
       362
       -
       			const hashedPassword = await clientHashPassword(

     

       363
       363
       -
       				TEST_USER.email,

     

       364
       364
       -
       				TEST_USER.password,

     

       365
       365
       -
       			);

     

       366
       366
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
       367
       -
       				method: "POST",

     

       368
       368
       -
       				headers: { "Content-Type": "application/json" },

     

       369
       369
       -
       				body: JSON.stringify({

     

       370
       370
       -
       					email: TEST_USER.email,

     

       371
       371
       -
       					password: hashedPassword,

     

       372
       372
       -
       				}),

     

       373
       373
       -
       			});

     

       374
       374
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       375
       375
       -
       

     

       376
       376
       -
       			// Logout

     

       377
       377
       -
       			const response = await authRequest(

     

       378
       378
       -
       				`${BASE_URL}/api/auth/logout`,

     

       379
       379
       -
       				sessionCookie,

     

       380
       380
       -
       				{

     

       381
       381
       -
       					method: "POST",

     

       382
       382
       -
       				},

     

       383
       383
       -
       			);

     

       384
       384
       -
       

     

       385
       385
       -
       			expect(response.status).toBe(200);

     

       386
       386
       -
       			const data = await response.json();

     

       387
       387
       -
       			expect(data.success).toBe(true);

     

       388
       388
       -
       

     

       389
       389
       -
       			// Verify cookie is cleared

     

       390
       390
       -
       			const setCookie = response.headers.get("set-cookie");

     

       391
       391
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       392
       392
       -
       		});

     

       393
       393
       -
       

     

       394
       394
       -
       		serverTest("should logout even without valid session", async () => {

     

       395
       395
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       396
       396
       -
       				method: "POST",

     

       397
       397
       -
       			});

     

       398
       398
       -
       

     

       399
       399
       -
       			expect(response.status).toBe(200);

     

       400
       400
       -
       			const data = await response.json();

     

       401
       401
       -
       			expect(data.success).toBe(true);

     

       402
       402
       -
       		});

     

       403
       403
       -
       	});

     

       404
       404
       -
       

     

       405
       405
       -
       	describe("GET /api/auth/me", () => {

     

       406
       406
       -
       		serverTest(

     

       407
       407
       -
       			"should return current user info when authenticated",

     

       408
       408
       -
       			async () => {

     

       409
       409
       -
       				// Register user

     

       410
       410
       -
       				const hashedPassword = await clientHashPassword(

     

       411
       411
       -
       					TEST_USER.email,

     

       412
       412
       -
       					TEST_USER.password,

     

       413
       413
       -
       				);

     

       414
       414
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       415
       415
       -
       					method: "POST",

     

       416
       416
       -
       					headers: { "Content-Type": "application/json" },

     

       417
       417
       -
       					body: JSON.stringify({

     

       418
       418
       -
       						email: TEST_USER.email,

     

       419
       419
       -
       						password: hashedPassword,

     

       420
       420
       -
       						name: TEST_USER.name,

     

       421
       421
       -
       					}),

     

       422
       422
       -
       				});

     

       423
       423
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       -
       

     

       425
       425
       -
       				// Get current user

     

       426
       426
       -
       				const response = await authRequest(

     

       427
       427
       -
       					`${BASE_URL}/api/auth/me`,

     

       428
       428
       -
       					sessionCookie,

     

       429
       429
       -
       				);

     

       430
       430
       -
       

     

       431
       431
       -
       				expect(response.status).toBe(200);

     

       432
       432
       -
       				const data = await response.json();

     

       433
       433
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       434
       434
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       435
       435
       -
       				expect(data.role).toBeDefined();

     

       436
       436
       -
       			},

     

       437
       437
       -
       		);

     

       438
       438
       -
       

     

       439
       439
       -
       		serverTest("should return 401 when not authenticated", async () => {

     

       440
       440
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       441
       441
       -
       

     

       442
       442
       -
       			expect(response.status).toBe(401);

     

       443
       443
       -
       			const data = await response.json();

     

       444
       444
       -
       			expect(data.error).toBe("Not authenticated");

     

       445
       445
       -
       		});

     

       446
       446
       -
       

     

       447
       447
       -
       		serverTest("should return 401 with invalid session", async () => {

     

       448
       448
       -
       			const response = await authRequest(

     

       449
       449
       -
       				`${BASE_URL}/api/auth/me`,

     

       450
       450
       -
       				"invalid-session",

     

       451
       451
       -
       			);

     

       452
       452
       -
       

     

       453
       453
       -
       			expect(response.status).toBe(401);

     

       454
       454
       -
       			const data = await response.json();

     

       455
       455
       -
       			expect(data.error).toBe("Invalid session");

     

       456
       456
       -
       		});

     

       457
       457
       -
       	});

     

       458
       458
       -
       });

     

       459
       459
       -
       

     

       460
       460
       -
       describe("API Endpoints - Session Management", () => {

     

       461
       461
       -
       	describe("GET /api/sessions", () => {

     

       462
       462
       -
       		serverTest("should return user sessions", async () => {

     

       463
       463
       -
       			// Register user

     

       464
       464
       -
       			const hashedPassword = await clientHashPassword(

     

       465
       465
       -
       				TEST_USER.email,

     

       466
       466
       -
       				TEST_USER.password,

     

       467
       467
       -
       			);

     

       468
       468
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       469
       469
       -
       				method: "POST",

     

       470
       470
       -
       				headers: { "Content-Type": "application/json" },

     

       471
       471
       -
       				body: JSON.stringify({

     

       472
       472
       -
       					email: TEST_USER.email,

     

       473
       473
       -
       					password: hashedPassword,

     

       474
       474
       -
       				}),

     

       475
       475
       -
       			});

     

       476
       476
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       477
       477
       -
       

     

       478
       478
       -
       			// Get sessions

     

       479
       479
       -
       			const response = await authRequest(

     

       480
       480
       -
       				`${BASE_URL}/api/sessions`,

     

       481
       481
       -
       				sessionCookie,

     

       482
       482
       -
       			);

     

       483
       483
       -
       

     

       484
       484
       -
       			expect(response.status).toBe(200);

     

       485
       485
       -
       			const data = await response.json();

     

       486
       486
       -
       			expect(data.sessions).toBeDefined();

     

       487
       487
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       488
       488
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       489
       489
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       490
       490
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       491
       491
       -
       		});

     

       492
       492
       -
       

     

       493
       493
       -
       		serverTest("should require authentication", async () => {

     

       494
       494
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       495
       495
       -
       

     

       496
       496
       -
       			expect(response.status).toBe(401);

     

       497
       497
       -
       		});

     

       498
       498
       -
       	});

     

       499
       499
       -
       

     

       500
       500
       -
       	describe("DELETE /api/sessions", () => {

     

       501
       501
       -
       		serverTest("should delete specific session", async () => {

     

       502
       502
       -
       			// Register user and create multiple sessions

     

       503
       503
       -
       			const hashedPassword = await clientHashPassword(

     

       504
       504
       -
       				TEST_USER.email,

     

       505
       505
       -
       				TEST_USER.password,

     

       506
       506
       -
       			);

     

       507
       507
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       508
       508
       -
       				method: "POST",

     

       509
       509
       -
       				headers: { "Content-Type": "application/json" },

     

       510
       510
       -
       				body: JSON.stringify({

     

       511
       511
       -
       					email: TEST_USER.email,

     

       512
       512
       -
       					password: hashedPassword,

     

       513
       513
       -
       				}),

     

       514
       514
       -
       			});

     

       515
       515
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       516
       516
       -
       

     

       517
       517
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       518
       518
       -
       				method: "POST",

     

       519
       519
       -
       				headers: { "Content-Type": "application/json" },

     

       520
       520
       -
       				body: JSON.stringify({

     

       521
       521
       -
       					email: TEST_USER.email,

     

       522
       522
       -
       					password: hashedPassword,

     

       523
       523
       -
       				}),

     

       524
       524
       -
       			});

     

       525
       525
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       526
       526
       -
       

     

       527
       527
       -
       			// Get sessions list

     

       528
       528
       -
       			const sessionsResponse = await authRequest(

     

       529
       529
       -
       				`${BASE_URL}/api/sessions`,

     

       530
       530
       -
       				session1Cookie,

     

       531
       531
       -
       			);

     

       532
       532
       -
       			const sessionsData = await sessionsResponse.json();

     

       533
       533
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       534
       534
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       535
       535
       -
       			)?.id;

     

       536
       536
       -
       

     

       537
       537
       -
       			// Delete session 2

     

       538
       538
       -
       			const response = await authRequest(

     

       539
       539
       -
       				`${BASE_URL}/api/sessions`,

     

       540
       540
       -
       				session1Cookie,

     

       541
       541
       -
       				{

     

       542
       542
       -
       					method: "DELETE",

     

       543
       543
       -
       					headers: { "Content-Type": "application/json" },

     

       544
       544
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       545
       545
       -
       				},

     

       546
       546
       -
       			);

     

       547
       547
       -
       

     

       548
       548
       -
       			expect(response.status).toBe(200);

     

       549
       549
       -
       			const data = await response.json();

     

       550
       550
       -
       			expect(data.success).toBe(true);

     

       551
       551
       -
       

     

       552
       552
       -
       			// Verify session 2 is deleted

     

       553
       553
       -
       			const verifyResponse = await authRequest(

     

       554
       554
       -
       				`${BASE_URL}/api/auth/me`,

     

       555
       555
       -
       				session2Cookie,

     

       556
       556
       -
       			);

     

       557
       557
       -
       			expect(verifyResponse.status).toBe(401);

     

       558
       558
       -
       		});

     

       559
       559
       -
       

     

       560
       560
       -
       		serverTest("should not delete another user's session", async () => {

     

       561
       561
       -
       			// Register two users

     

       562
       562
       -
       			const hashedPassword1 = await clientHashPassword(

     

       563
       563
       -
       				TEST_USER.email,

     

       564
       564
       -
       				TEST_USER.password,

     

       565
       565
       -
       			);

     

       566
       566
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       567
       567
       -
       				method: "POST",

     

       568
       568
       -
       				headers: { "Content-Type": "application/json" },

     

       569
       569
       -
       				body: JSON.stringify({

     

       570
       570
       -
       					email: TEST_USER.email,

     

       571
       571
       -
       					password: hashedPassword1,

     

       572
       572
       -
       				}),

     

       573
       573
       -
       			});

     

       574
       574
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       575
       575
       -
       

     

       576
       576
       -
       			const hashedPassword2 = await clientHashPassword(

     

       577
       577
       -
       				TEST_USER_2.email,

     

       578
       578
       -
       				TEST_USER_2.password,

     

       579
       579
       -
       			);

     

       580
       580
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       581
       581
       -
       				method: "POST",

     

       582
       582
       -
       				headers: { "Content-Type": "application/json" },

     

       583
       583
       -
       				body: JSON.stringify({

     

       584
       584
       -
       					email: TEST_USER_2.email,

     

       585
       585
       -
       					password: hashedPassword2,

     

       586
       586
       -
       				}),

     

       587
       587
       -
       			});

     

       588
       588
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       589
       589
       -
       

     

       590
       590
       -
       			// Try to delete user2's session using user1's credentials

     

       591
       591
       -
       			const response = await authRequest(

     

       592
       592
       -
       				`${BASE_URL}/api/sessions`,

     

       593
       593
       -
       				user1Cookie,

     

       594
       594
       -
       				{

     

       595
       595
       -
       					method: "DELETE",

     

       596
       596
       -
       					headers: { "Content-Type": "application/json" },

     

       597
       597
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       598
       598
       -
       				},

     

       599
       599
       -
       			);

     

       600
       600
       -
       

     

       601
       601
       -
       			expect(response.status).toBe(404);

     

       602
       602
       -
       		});

     

       603
       603
       -
       

     

       604
       604
       -
       		serverTest("should not delete current session", async () => {

     

       605
       605
       -
       			// Register user

     

       606
       606
       -
       			const hashedPassword = await clientHashPassword(

     

       607
       607
       -
       				TEST_USER.email,

     

       608
       608
       -
       				TEST_USER.password,

     

       609
       609
       -
       			);

     

       610
       610
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       611
       611
       -
       				method: "POST",

     

       612
       612
       -
       				headers: { "Content-Type": "application/json" },

     

       613
       613
       -
       				body: JSON.stringify({

     

       614
       614
       -
       					email: TEST_USER.email,

     

       615
       615
       -
       					password: hashedPassword,

     

       616
       616
       -
       				}),

     

       617
       617
       -
       			});

     

       618
       618
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       402
       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       619
       403
        
       

     

       620
       404
        
       			// Try to delete own current session

     

       621
       405
        
       			const response = await authRequest(

     
···

       637
       421
        
       

     

       638
       422
        
       describe("API Endpoints - User Management", () => {

     

       639
       423
        
       	describe("DELETE /api/user", () => {

     

       640
       640
       -
       		serverTest("should delete user account", async () => {

     

       641
       641
       -
       			// Register user

     

       642
       642
       -
       			const hashedPassword = await clientHashPassword(

     

       643
       643
       -
       				TEST_USER.email,

     

       644
       644
       -
       				TEST_USER.password,

     

       645
       645
       -
       			);

     

       646
       646
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       647
       647
       -
       				method: "POST",

     

       648
       648
       -
       				headers: { "Content-Type": "application/json" },

     

       649
       649
       -
       				body: JSON.stringify({

     

       650
       650
       -
       					email: TEST_USER.email,

     

       651
       651
       -
       					password: hashedPassword,

     

       652
       652
       -
       				}),

     

       653
       653
       -
       			});

     

       654
       654
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       +
       		test("should delete user account", async () => {

     

       425
       425
       +
       			// Register and login

     

       426
       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       655
       427
        
       

     

       656
       428
        
       			// Delete account

     

       657
       429
        
       			const response = await authRequest(

     
···

       662
       434
        
       				},

     

       663
       435
        
       			);

     

       664
       436
        
       

     

       665
       665
       -
       			expect(response.status).toBe(200);

     

       666
       666
       -
       			const data = await response.json();

     

       667
       667
       -
       			expect(data.success).toBe(true);

     

       437
       437
       +
       			expect(response.status).toBe(204);

     

       668
       438
        
       

     

       669
       439
        
       			// Verify user is deleted

     

       670
       440
        
       			const verifyResponse = await authRequest(

     
···

       674
       444
        
       			expect(verifyResponse.status).toBe(401);

     

       675
       445
        
       		});

     

       676
       446
        
       

     

       677
       677
       -
       		serverTest("should require authentication", async () => {

     

       447
       447
       +
       		test("should require authentication", async () => {

     

       678
       448
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       679
       449
        
       				method: "DELETE",

     

       680
       450
        
       			});

     
···

       684
       454
        
       	});

     

       685
       455
        
       

     

       686
       456
        
       	describe("PUT /api/user/email", () => {

     

       687
       687
       -
       		serverTest("should update user email", async () => {

     

       688
       688
       -
       			// Register user

     

       689
       689
       -
       			const hashedPassword = await clientHashPassword(

     

       690
       690
       -
       				TEST_USER.email,

     

       691
       691
       -
       				TEST_USER.password,

     

       692
       692
       -
       			);

     

       693
       693
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       694
       694
       -
       				method: "POST",

     

       695
       695
       -
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       -
       				body: JSON.stringify({

     

       697
       697
       -
       					email: TEST_USER.email,

     

       698
       698
       -
       					password: hashedPassword,

     

       699
       699
       -
       				}),

     

       700
       700
       -
       			});

     

       701
       701
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       457
       457
       +
       		test("should update user email", async () => {

     

       458
       458
       +
       			// Register and login

     

       459
       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       702
       460
        
       

     

       703
       703
       -
       			// Update email

     

       461
       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       704
       462
        
       			const newEmail = "newemail@example.com";

     

       705
       463
        
       			const response = await authRequest(

     

       706
       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       716
       474
        
       			const data = await response.json();

     

       717
       475
        
       			expect(data.success).toBe(true);

     

       718
       476
        
       

     

       477
       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       479
       +
       			const tokenData = db

     

       480
       480
       +
       				.query(

     

       481
       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       482
       +
       				)

     

       483
       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       485
       +
       				tokenData.new_email,

     

       486
       486
       +
       				tokenData.user_id,

     

       487
       487
       +
       			]);

     

       488
       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       489
       +
       				tokenData.user_id,

     

       490
       490
       +
       			]);

     

       491
       491
       +
       			db.close();

     

       492
       492
       +
       

     

       719
       493
        
       			// Verify email updated

     

       720
       494
        
       			const meResponse = await authRequest(

     

       721
       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       725
       499
        
       			expect(meData.email).toBe(newEmail);

     

       726
       500
        
       		});

     

       727
       501
        
       

     

       728
       728
       -
       		serverTest("should reject duplicate email", async () => {

     

       502
       502
       +
       		test("should reject duplicate email", async () => {

     

       729
       503
        
       			// Register two users

     

       730
       730
       -
       			const hashedPassword1 = await clientHashPassword(

     

       731
       731
       -
       				TEST_USER.email,

     

       732
       732
       -
       				TEST_USER.password,

     

       733
       733
       -
       			);

     

       734
       734
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       735
       735
       -
       				method: "POST",

     

       736
       736
       -
       				headers: { "Content-Type": "application/json" },

     

       737
       737
       -
       				body: JSON.stringify({

     

       738
       738
       -
       					email: TEST_USER.email,

     

       739
       739
       -
       					password: hashedPassword1,

     

       740
       740
       -
       				}),

     

       741
       741
       -
       			});

     

       742
       742
       -
       

     

       743
       743
       -
       			const hashedPassword2 = await clientHashPassword(

     

       744
       744
       -
       				TEST_USER_2.email,

     

       745
       745
       -
       				TEST_USER_2.password,

     

       746
       746
       -
       			);

     

       747
       747
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       748
       748
       -
       				method: "POST",

     

       749
       749
       -
       				headers: { "Content-Type": "application/json" },

     

       750
       750
       -
       				body: JSON.stringify({

     

       751
       751
       -
       					email: TEST_USER_2.email,

     

       752
       752
       -
       					password: hashedPassword2,

     

       753
       753
       -
       				}),

     

       754
       754
       -
       			});

     

       755
       755
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       504
       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       756
       506
        
       

     

       757
       507
        
       			// Try to update user2's email to user1's email

     

       758
       508
        
       			const response = await authRequest(

     
···

       765
       515
        
       				},

     

       766
       516
        
       			);

     

       767
       517
        
       

     

       768
       768
       -
       			expect(response.status).toBe(400);

     

       518
       518
       +
       			expect(response.status).toBe(409);

     

       769
       519
        
       			const data = await response.json();

     

       770
       520
        
       			expect(data.error).toBe("Email already in use");

     

       771
       521
        
       		});

     

       772
       522
        
       	});

     

       773
       523
        
       

     

       774
       524
        
       	describe("PUT /api/user/password", () => {

     

       775
       775
       -
       		serverTest("should update user password", async () => {

     

       776
       776
       -
       			// Register user

     

       777
       777
       -
       			const hashedPassword = await clientHashPassword(

     

       778
       778
       -
       				TEST_USER.email,

     

       779
       779
       -
       				TEST_USER.password,

     

       780
       780
       -
       			);

     

       781
       781
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       782
       782
       -
       				method: "POST",

     

       783
       783
       -
       				headers: { "Content-Type": "application/json" },

     

       784
       784
       -
       				body: JSON.stringify({

     

       785
       785
       -
       					email: TEST_USER.email,

     

       786
       786
       -
       					password: hashedPassword,

     

       787
       787
       -
       				}),

     

       788
       788
       -
       			});

     

       789
       789
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       525
       525
       +
       		test("should update user password", async () => {

     

       526
       526
       +
       			// Register and login

     

       527
       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       790
       528
        
       

     

       791
       529
        
       			// Update password

     

       792
       530
        
       			const newPassword = await clientHashPassword(

     
···

       819
       557
        
       			expect(loginResponse.status).toBe(200);

     

       820
       558
        
       		});

     

       821
       559
        
       

     

       822
       822
       -
       		serverTest("should reject invalid password format", async () => {

     

       823
       823
       -
       			// Register user

     

       824
       824
       -
       			const hashedPassword = await clientHashPassword(

     

       825
       825
       -
       				TEST_USER.email,

     

       826
       826
       -
       				TEST_USER.password,

     

       827
       827
       -
       			);

     

       828
       828
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       829
       829
       -
       				method: "POST",

     

       830
       830
       -
       				headers: { "Content-Type": "application/json" },

     

       831
       831
       -
       				body: JSON.stringify({

     

       832
       832
       -
       					email: TEST_USER.email,

     

       833
       833
       -
       					password: hashedPassword,

     

       834
       834
       -
       				}),

     

       835
       835
       -
       			});

     

       836
       836
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       560
       560
       +
       		test("should reject invalid password format", async () => {

     

       561
       561
       +
       			// Register and login

     

       562
       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       837
       563
        
       

     

       838
       564
        
       			// Try to update with invalid format

     

       839
       565
        
       			const response = await authRequest(

     
···

       853
       579
        
       	});

     

       854
       580
        
       

     

       855
       581
        
       	describe("PUT /api/user/name", () => {

     

       856
       856
       -
       		serverTest("should update user name", async () => {

     

       857
       857
       -
       			// Register user

     

       858
       858
       -
       			const hashedPassword = await clientHashPassword(

     

       859
       859
       -
       				TEST_USER.email,

     

       860
       860
       -
       				TEST_USER.password,

     

       861
       861
       -
       			);

     

       862
       862
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       863
       863
       -
       				method: "POST",

     

       864
       864
       -
       				headers: { "Content-Type": "application/json" },

     

       865
       865
       -
       				body: JSON.stringify({

     

       866
       866
       -
       					email: TEST_USER.email,

     

       867
       867
       -
       					password: hashedPassword,

     

       868
       868
       -
       					name: TEST_USER.name,

     

       869
       869
       -
       				}),

     

       870
       870
       -
       			});

     

       871
       871
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       582
       582
       +
       		test("should update user name", async () => {

     

       583
       583
       +
       			// Register and login

     

       584
       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       872
       585
        
       

     

       873
       586
        
       			// Update name

     

       874
       587
        
       			const newName = "Updated Name";

     
···

       883
       596
        
       			);

     

       884
       597
        
       

     

       885
       598
        
       			expect(response.status).toBe(200);

     

       886
       886
       -
       			const data = await response.json();

     

       887
       887
       -
       			expect(data.success).toBe(true);

     

       888
       599
        
       

     

       889
       600
        
       			// Verify name updated

     

       890
       601
        
       			const meResponse = await authRequest(

     
···

       895
       606
        
       			expect(meData.name).toBe(newName);

     

       896
       607
        
       		});

     

       897
       608
        
       

     

       898
       898
       -
       		serverTest("should reject missing name", async () => {

     

       899
       899
       -
       			// Register user

     

       900
       900
       -
       			const hashedPassword = await clientHashPassword(

     

       901
       901
       -
       				TEST_USER.email,

     

       902
       902
       -
       				TEST_USER.password,

     

       903
       903
       -
       			);

     

       904
       904
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       905
       905
       -
       				method: "POST",

     

       906
       906
       -
       				headers: { "Content-Type": "application/json" },

     

       907
       907
       -
       				body: JSON.stringify({

     

       908
       908
       -
       					email: TEST_USER.email,

     

       909
       909
       -
       					password: hashedPassword,

     

       910
       910
       -
       				}),

     

       911
       911
       -
       			});

     

       912
       912
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       609
       609
       +
       		test("should reject missing name", async () => {

     

       610
       610
       +
       			// Register and login

     

       611
       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       913
       612
        
       

     

       914
       613
        
       			const response = await authRequest(

     

       915
       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       926
       625
        
       	});

     

       927
       626
        
       

     

       928
       627
        
       	describe("PUT /api/user/avatar", () => {

     

       929
       929
       -
       		serverTest("should update user avatar", async () => {

     

       930
       930
       -
       			// Register user

     

       931
       931
       -
       			const hashedPassword = await clientHashPassword(

     

       932
       932
       -
       				TEST_USER.email,

     

       933
       933
       -
       				TEST_USER.password,

     

       934
       934
       -
       			);

     

       935
       935
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       936
       936
       -
       				method: "POST",

     

       937
       937
       -
       				headers: { "Content-Type": "application/json" },

     

       938
       938
       -
       				body: JSON.stringify({

     

       939
       939
       -
       					email: TEST_USER.email,

     

       940
       940
       -
       					password: hashedPassword,

     

       941
       941
       -
       				}),

     

       942
       942
       -
       			});

     

       943
       943
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       628
       628
       +
       		test("should update user avatar", async () => {

     

       629
       629
       +
       			// Register and login

     

       630
       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       944
       631
        
       

     

       945
       632
        
       			// Update avatar

     

       946
       633
        
       			const newAvatar = "👨‍💻";

     
···

       969
       656
        
       	});

     

       970
       657
        
       });

     

       971
       658
        
       

     

       972
       972
       -
       describe("API Endpoints - Transcriptions", () => {

     

       973
       973
       -
       	describe("GET /api/transcriptions/health", () => {

     

       974
       974
       -
       		serverTest(

     

       975
       975
       -
       			"should return transcription service health status",

     

       976
       976
       -
       			async () => {

     

       977
       977
       -
       				const response = await fetch(`${BASE_URL}/api/transcriptions/health`);

     

       659
       659
       +
       describe("API Endpoints - Health", () => {

     

       660
       660
       +
       	describe("GET /api/health", () => {

     

       661
       661
       +
       		test("should return service health status with details", async () => {

     

       662
       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       978
       663
        
       

     

       979
       979
       -
       				expect(response.status).toBe(200);

     

       980
       980
       -
       				const data = await response.json();

     

       981
       981
       -
       				expect(data).toHaveProperty("available");

     

       982
       982
       -
       				expect(typeof data.available).toBe("boolean");

     

       983
       983
       -
       			},

     

       984
       984
       -
       		);

     

       664
       664
       +
       			expect(response.status).toBe(200);

     

       665
       665
       +
       			const data = await response.json();

     

       666
       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       672
       +
       		});

     

       985
       673
        
       	});

     

       674
       674
       +
       });

     

       986
       675
        
       

     

       676
       676
       +
       describe("API Endpoints - Transcriptions", () => {

     

       987
       677
        
       	describe("GET /api/transcriptions", () => {

     

       988
       988
       -
       		serverTest("should return user transcriptions", async () => {

     

       989
       989
       -
       			// Register user

     

       990
       990
       -
       			const hashedPassword = await clientHashPassword(

     

       991
       991
       -
       				TEST_USER.email,

     

       992
       992
       -
       				TEST_USER.password,

     

       993
       993
       -
       			);

     

       994
       994
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       995
       995
       -
       				method: "POST",

     

       996
       996
       -
       				headers: { "Content-Type": "application/json" },

     

       997
       997
       -
       				body: JSON.stringify({

     

       998
       998
       -
       					email: TEST_USER.email,

     

       999
       999
       -
       					password: hashedPassword,

     

       1000
       1000
       -
       				}),

     

       1001
       1001
       -
       			});

     

       1002
       1002
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       678
       678
       +
       		test("should return user transcriptions", async () => {

     

       679
       679
       +
       			// Register and login

     

       680
       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       681
       +
       

     

       682
       682
       +
       			// Add subscription

     

       683
       683
       +
       			addSubscription(TEST_USER.email);

     

       1003
       684
        
       

     

       1004
       685
        
       			// Get transcriptions

     

       1005
       686
        
       			const response = await authRequest(

     
···

       1013
       694
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       1014
       695
        
       		});

     

       1015
       696
        
       

     

       1016
       1016
       -
       		serverTest("should require authentication", async () => {

     

       697
       697
       +
       		test("should require authentication", async () => {

     

       1017
       698
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       1018
       699
        
       

     

       1019
       700
        
       			expect(response.status).toBe(401);

     
···

       1021
       702
        
       	});

     

       1022
       703
        
       

     

       1023
       704
        
       	describe("POST /api/transcriptions", () => {

     

       1024
       1024
       -
       		serverTest("should upload audio file and start transcription", async () => {

     

       1025
       1025
       -
       			// Register user

     

       1026
       1026
       -
       			const hashedPassword = await clientHashPassword(

     

       1027
       1027
       -
       				TEST_USER.email,

     

       1028
       1028
       -
       				TEST_USER.password,

     

       1029
       1029
       -
       			);

     

       1030
       1030
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1031
       1031
       -
       				method: "POST",

     

       1032
       1032
       -
       				headers: { "Content-Type": "application/json" },

     

       1033
       1033
       -
       				body: JSON.stringify({

     

       1034
       1034
       -
       					email: TEST_USER.email,

     

       1035
       1035
       -
       					password: hashedPassword,

     

       1036
       1036
       -
       				}),

     

       1037
       1037
       -
       			});

     

       1038
       1038
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       705
       705
       +
       		test("should upload audio file and start transcription", async () => {

     

       706
       706
       +
       			// Register and login

     

       707
       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       708
       +
       

     

       709
       709
       +
       			// Add subscription

     

       710
       710
       +
       			addSubscription(TEST_USER.email);

     

       1039
       711
        
       

     

       1040
       712
        
       			// Create a test audio file

     

       1041
       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1053
       725
        
       				},

     

       1054
       726
        
       			);

     

       1055
       727
        
       

     

       1056
       1056
       -
       			expect(response.status).toBe(200);

     

       728
       728
       +
       			expect(response.status).toBe(201);

     

       1057
       729
        
       			const data = await response.json();

     

       1058
       730
        
       			expect(data.id).toBeDefined();

     

       1059
       731
        
       			expect(data.message).toContain("Upload successful");

     

       1060
       732
        
       		});

     

       1061
       733
        
       

     

       1062
       1062
       -
       		serverTest("should reject non-audio files", async () => {

     

       1063
       1063
       -
       			// Register user

     

       1064
       1064
       -
       			const hashedPassword = await clientHashPassword(

     

       1065
       1065
       -
       				TEST_USER.email,

     

       1066
       1066
       -
       				TEST_USER.password,

     

       1067
       1067
       -
       			);

     

       1068
       1068
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1069
       1069
       -
       				method: "POST",

     

       1070
       1070
       -
       				headers: { "Content-Type": "application/json" },

     

       1071
       1071
       -
       				body: JSON.stringify({

     

       1072
       1072
       -
       					email: TEST_USER.email,

     

       1073
       1073
       -
       					password: hashedPassword,

     

       1074
       1074
       -
       				}),

     

       1075
       1075
       -
       			});

     

       1076
       1076
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       734
       734
       +
       		test("should reject non-audio files", async () => {

     

       735
       735
       +
       			// Register and login

     

       736
       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       737
       +
       

     

       738
       738
       +
       			// Add subscription

     

       739
       739
       +
       			addSubscription(TEST_USER.email);

     

       1077
       740
        
       

     

       1078
       741
        
       			// Try to upload non-audio file

     

       1079
       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1092
       755
        
       			expect(response.status).toBe(400);

     

       1093
       756
        
       		});

     

       1094
       757
        
       

     

       1095
       1095
       -
       		serverTest("should reject files exceeding size limit", async () => {

     

       1096
       1096
       -
       			// Register user

     

       1097
       1097
       -
       			const hashedPassword = await clientHashPassword(

     

       1098
       1098
       -
       				TEST_USER.email,

     

       1099
       1099
       -
       				TEST_USER.password,

     

       1100
       1100
       -
       			);

     

       1101
       1101
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1102
       1102
       -
       				method: "POST",

     

       1103
       1103
       -
       				headers: { "Content-Type": "application/json" },

     

       1104
       1104
       -
       				body: JSON.stringify({

     

       1105
       1105
       -
       					email: TEST_USER.email,

     

       1106
       1106
       -
       					password: hashedPassword,

     

       1107
       1107
       -
       				}),

     

       1108
       1108
       -
       			});

     

       1109
       1109
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       758
       758
       +
       		test("should reject files exceeding size limit", async () => {

     

       759
       759
       +
       			// Register and login

     

       760
       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       761
       +
       

     

       762
       762
       +
       			// Add subscription

     

       763
       763
       +
       			addSubscription(TEST_USER.email);

     

       1110
       764
        
       

     

       1111
       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       1112
       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1129
       783
        
       			expect(data.error).toContain("File size must be less than");

     

       1130
       784
        
       		});

     

       1131
       785
        
       

     

       1132
       1132
       -
       		serverTest("should require authentication", async () => {

     

       786
       786
       +
       		test("should require authentication", async () => {

     

       1133
       787
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       1134
       788
        
       			const formData = new FormData();

     

       1135
       789
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       1150
       804
        
       	let userId: number;

     

       1151
       805
        
       

     

       1152
       806
        
       	beforeEach(async () => {

     

       1153
       1153
       -
       		if (!serverAvailable) return;

     

       1154
       1154
       -
       

     

       1155
       807
        
       		// Create admin user

     

       1156
       1156
       -
       		const adminHash = await clientHashPassword(

     

       1157
       1157
       -
       			TEST_ADMIN.email,

     

       1158
       1158
       -
       			TEST_ADMIN.password,

     

       1159
       1159
       -
       		);

     

       1160
       1160
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1161
       1161
       -
       			method: "POST",

     

       1162
       1162
       -
       			headers: { "Content-Type": "application/json" },

     

       1163
       1163
       -
       			body: JSON.stringify({

     

       1164
       1164
       -
       				email: TEST_ADMIN.email,

     

       1165
       1165
       -
       				password: adminHash,

     

       1166
       1166
       -
       				name: TEST_ADMIN.name,

     

       1167
       1167
       -
       			}),

     

       1168
       1168
       -
       		});

     

       1169
       1169
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       808
       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       1170
       809
        
       

     

       1171
       810
        
       		// Manually set admin role in database

     

       811
       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       1172
       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1173
       813
        
       			TEST_ADMIN.email,

     

       1174
       814
        
       		]);

     

       1175
       815
        
       

     

       1176
       816
        
       		// Create regular user

     

       1177
       1177
       -
       		const userHash = await clientHashPassword(

     

       1178
       1178
       -
       			TEST_USER.email,

     

       1179
       1179
       -
       			TEST_USER.password,

     

       1180
       1180
       -
       		);

     

       1181
       1181
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1182
       1182
       -
       			method: "POST",

     

       1183
       1183
       -
       			headers: { "Content-Type": "application/json" },

     

       1184
       1184
       -
       			body: JSON.stringify({

     

       1185
       1185
       -
       				email: TEST_USER.email,

     

       1186
       1186
       -
       				password: userHash,

     

       1187
       1187
       -
       				name: TEST_USER.name,

     

       1188
       1188
       -
       			}),

     

       1189
       1189
       -
       		});

     

       1190
       1190
       -
       		userCookie = extractSessionCookie(userResponse);

     

       817
       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       1191
       818
        
       

     

       1192
       819
        
       		// Get user ID

     

       1193
       820
        
       		const userIdResult = db

     

       1194
       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1195
       822
        
       			.get(TEST_USER.email);

     

       1196
       823
        
       		userId = userIdResult?.id;

     

       824
       824
       +
       

     

       825
       825
       +
       		db.close();

     

       1197
       826
        
       	});

     

       1198
       827
        
       

     

       1199
       828
        
       	describe("GET /api/admin/users", () => {

     

       1200
       1200
       -
       		serverTest("should return all users for admin", async () => {

     

       829
       829
       +
       		test("should return all users for admin", async () => {

     

       1201
       830
        
       			const response = await authRequest(

     

       1202
       831
        
       				`${BASE_URL}/api/admin/users`,

     

       1203
       832
        
       				adminCookie,

     
···

       1209
       838
        
       			expect(data.length).toBeGreaterThan(0);

     

       1210
       839
        
       		});

     

       1211
       840
        
       

     

       1212
       1212
       -
       		serverTest("should reject non-admin users", async () => {

     

       841
       841
       +
       		test("should reject non-admin users", async () => {

     

       1213
       842
        
       			const response = await authRequest(

     

       1214
       843
        
       				`${BASE_URL}/api/admin/users`,

     

       1215
       844
        
       				userCookie,

     
···

       1218
       847
        
       			expect(response.status).toBe(403);

     

       1219
       848
        
       		});

     

       1220
       849
        
       

     

       1221
       1221
       -
       		serverTest("should require authentication", async () => {

     

       850
       850
       +
       		test("should require authentication", async () => {

     

       1222
       851
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       1223
       852
        
       

     

       1224
       853
        
       			expect(response.status).toBe(401);

     
···

       1226
       855
        
       	});

     

       1227
       856
        
       

     

       1228
       857
        
       	describe("GET /api/admin/transcriptions", () => {

     

       1229
       1229
       -
       		serverTest("should return all transcriptions for admin", async () => {

     

       858
       858
       +
       		test("should return all transcriptions for admin", async () => {

     

       1230
       859
        
       			const response = await authRequest(

     

       1231
       860
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1232
       861
        
       				adminCookie,

     
···

       1237
       866
        
       			expect(Array.isArray(data)).toBe(true);

     

       1238
       867
        
       		});

     

       1239
       868
        
       

     

       1240
       1240
       -
       		serverTest("should reject non-admin users", async () => {

     

       869
       869
       +
       		test("should reject non-admin users", async () => {

     

       1241
       870
        
       			const response = await authRequest(

     

       1242
       871
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1243
       872
        
       				userCookie,

     
···

       1248
       877
        
       	});

     

       1249
       878
        
       

     

       1250
       879
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       1251
       1251
       -
       		serverTest("should delete user as admin", async () => {

     

       880
       880
       +
       		test("should delete user as admin", async () => {

     

       1252
       881
        
       			const response = await authRequest(

     

       1253
       882
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1254
       883
        
       				adminCookie,

     
···

       1257
       886
        
       				},

     

       1258
       887
        
       			);

     

       1259
       888
        
       

     

       1260
       1260
       -
       			expect(response.status).toBe(200);

     

       1261
       1261
       -
       			const data = await response.json();

     

       1262
       1262
       -
       			expect(data.success).toBe(true);

     

       889
       889
       +
       			expect(response.status).toBe(204);

     

       1263
       890
        
       

     

       1264
       891
        
       			// Verify user is deleted

     

       1265
       892
        
       			const verifyResponse = await authRequest(

     
···

       1269
       896
        
       			expect(verifyResponse.status).toBe(401);

     

       1270
       897
        
       		});

     

       1271
       898
        
       

     

       1272
       1272
       -
       		serverTest("should reject non-admin users", async () => {

     

       899
       899
       +
       		test("should reject non-admin users", async () => {

     

       1273
       900
        
       			const response = await authRequest(

     

       1274
       901
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1275
       902
        
       				userCookie,

     
···

       1283
       910
        
       	});

     

       1284
       911
        
       

     

       1285
       912
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       1286
       1286
       -
       		serverTest("should update user role as admin", async () => {

     

       913
       913
       +
       		test("should update user role as admin", async () => {

     

       1287
       914
        
       			const response = await authRequest(

     

       1288
       915
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1289
       916
        
       				adminCookie,

     
···

       1295
       922
        
       			);

     

       1296
       923
        
       

     

       1297
       924
        
       			expect(response.status).toBe(200);

     

       1298
       1298
       -
       			const data = await response.json();

     

       1299
       1299
       -
       			expect(data.success).toBe(true);

     

       1300
       925
        
       

     

       1301
       926
        
       			// Verify role updated

     

       1302
       927
        
       			const meResponse = await authRequest(

     
···

       1307
       932
        
       			expect(meData.role).toBe("admin");

     

       1308
       933
        
       		});

     

       1309
       934
        
       

     

       1310
       1310
       -
       		serverTest("should reject invalid roles", async () => {

     

       935
       935
       +
       		test("should reject invalid roles", async () => {

     

       1311
       936
        
       			const response = await authRequest(

     

       1312
       937
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1313
       938
        
       				adminCookie,

     
···

       1323
       948
        
       	});

     

       1324
       949
        
       

     

       1325
       950
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       1326
       1326
       -
       		serverTest("should return user details for admin", async () => {

     

       951
       951
       +
       		test("should return user details for admin", async () => {

     

       1327
       952
        
       			const response = await authRequest(

     

       1328
       953
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1329
       954
        
       				adminCookie,

     
···

       1337
       962
        
       			expect(data).toHaveProperty("sessions");

     

       1338
       963
        
       		});

     

       1339
       964
        
       

     

       1340
       1340
       -
       		serverTest("should reject non-admin users", async () => {

     

       965
       965
       +
       		test("should reject non-admin users", async () => {

     

       1341
       966
        
       			const response = await authRequest(

     

       1342
       967
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1343
       968
        
       				userCookie,

     
···

       1348
       973
        
       	});

     

       1349
       974
        
       

     

       1350
       975
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       1351
       1351
       -
       		serverTest("should update user name as admin", async () => {

     

       976
       976
       +
       		test("should update user name as admin", async () => {

     

       1352
       977
        
       			const newName = "Admin Updated Name";

     

       1353
       978
        
       			const response = await authRequest(

     

       1354
       979
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       1365
       990
        
       			expect(data.success).toBe(true);

     

       1366
       991
        
       		});

     

       1367
       992
        
       

     

       1368
       1368
       -
       		serverTest("should reject empty names", async () => {

     

       993
       993
       +
       		test("should reject empty names", async () => {

     

       1369
       994
        
       			const response = await authRequest(

     

       1370
       995
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       1371
       996
        
       				adminCookie,

     
···

       1381
       1006
        
       	});

     

       1382
       1007
        
       

     

       1383
       1008
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1384
       1384
       -
       		serverTest("should update user email as admin", async () => {

     

       1009
       1009
       +
       		test("should update user email as admin", async () => {

     

       1385
       1010
        
       			const newEmail = "newemail@admin.com";

     

       1386
       1011
        
       			const response = await authRequest(

     

       1387
       1012
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1398
       1023
        
       			expect(data.success).toBe(true);

     

       1399
       1024
        
       		});

     

       1400
       1025
        
       

     

       1401
       1401
       -
       		serverTest("should reject duplicate emails", async () => {

     

       1026
       1026
       +
       		test("should reject duplicate emails", async () => {

     

       1402
       1027
        
       			const response = await authRequest(

     

       1403
       1028
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1404
       1029
        
       				adminCookie,

     
···

       1409
       1034
        
       				},

     

       1410
       1035
        
       			);

     

       1411
       1036
        
       

     

       1412
       1412
       -
       			expect(response.status).toBe(400);

     

       1037
       1037
       +
       			expect(response.status).toBe(409);

     

       1413
       1038
        
       			const data = await response.json();

     

       1414
       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1415
       1040
        
       		});

     

       1416
       1041
        
       	});

     

       1417
       1042
        
       

     

       1418
       1043
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1419
       1419
       -
       		serverTest("should return user sessions as admin", async () => {

     

       1044
       1044
       +
       		test("should return user sessions as admin", async () => {

     

       1420
       1045
        
       			const response = await authRequest(

     

       1421
       1046
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1422
       1047
        
       				adminCookie,

     
···

       1429
       1054
        
       	});

     

       1430
       1055
        
       

     

       1431
       1056
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1432
       1432
       -
       		serverTest("should delete all user sessions as admin", async () => {

     

       1057
       1057
       +
       		test("should delete all user sessions as admin", async () => {

     

       1433
       1058
        
       			const response = await authRequest(

     

       1434
       1059
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1435
       1060
        
       				adminCookie,

     
···

       1438
       1063
        
       				},

     

       1439
       1064
        
       			);

     

       1440
       1065
        
       

     

       1441
       1441
       -
       			expect(response.status).toBe(200);

     

       1442
       1442
       -
       			const data = await response.json();

     

       1443
       1443
       -
       			expect(data.success).toBe(true);

     

       1066
       1066
       +
       			expect(response.status).toBe(204);

     

       1444
       1067
        
       

     

       1445
       1068
        
       			// Verify sessions are deleted

     

       1446
       1069
        
       			const verifyResponse = await authRequest(

     
···

       1456
       1079
        
       	let sessionCookie: string;

     

       1457
       1080
        
       

     

       1458
       1081
        
       	beforeEach(async () => {

     

       1459
       1459
       -
       		if (!serverAvailable) return;

     

       1460
       1460
       -
       

     

       1461
       1461
       -
       		// Register user

     

       1462
       1462
       -
       		const hashedPassword = await clientHashPassword(

     

       1463
       1463
       -
       			TEST_USER.email,

     

       1464
       1464
       -
       			TEST_USER.password,

     

       1465
       1465
       -
       		);

     

       1466
       1466
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1467
       1467
       -
       			method: "POST",

     

       1468
       1468
       -
       			headers: { "Content-Type": "application/json" },

     

       1469
       1469
       -
       			body: JSON.stringify({

     

       1470
       1470
       -
       				email: TEST_USER.email,

     

       1471
       1471
       -
       				password: hashedPassword,

     

       1472
       1472
       -
       			}),

     

       1473
       1473
       -
       		});

     

       1474
       1474
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1082
       1082
       +
       		// Register and login

     

       1083
       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       1475
       1084
        
       	});

     

       1476
       1085
        
       

     

       1477
       1086
        
       	describe("GET /api/passkeys", () => {

     

       1478
       1478
       -
       		serverTest("should return user passkeys", async () => {

     

       1087
       1087
       +
       		test("should return user passkeys", async () => {

     

       1479
       1088
        
       			const response = await authRequest(

     

       1480
       1089
        
       				`${BASE_URL}/api/passkeys`,

     

       1481
       1090
        
       				sessionCookie,

     
···

       1487
       1096
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1488
       1097
        
       		});

     

       1489
       1098
        
       

     

       1490
       1490
       -
       		serverTest("should require authentication", async () => {

     

       1099
       1099
       +
       		test("should require authentication", async () => {

     

       1491
       1100
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1492
       1101
        
       

     

       1493
       1102
        
       			expect(response.status).toBe(401);

     
···

       1495
       1104
        
       	});

     

       1496
       1105
        
       

     

       1497
       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1498
       1498
       -
       		serverTest(

     

       1499
       1499
       -
       			"should return registration options for authenticated user",

     

       1500
       1500
       -
       			async () => {

     

       1501
       1501
       -
       				const response = await authRequest(

     

       1502
       1502
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1503
       1503
       -
       					sessionCookie,

     

       1504
       1504
       -
       					{

     

       1505
       1505
       -
       						method: "POST",

     

       1506
       1506
       -
       					},

     

       1507
       1507
       -
       				);

     

       1107
       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       1108
       +
       			const response = await authRequest(

     

       1109
       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       1110
       +
       				sessionCookie,

     

       1111
       1111
       +
       				{

     

       1112
       1112
       +
       					method: "POST",

     

       1113
       1113
       +
       				},

     

       1114
       1114
       +
       			);

     

       1508
       1115
        
       

     

       1509
       1509
       -
       				expect(response.status).toBe(200);

     

       1510
       1510
       -
       				const data = await response.json();

     

       1511
       1511
       -
       				expect(data).toHaveProperty("challenge");

     

       1512
       1512
       -
       				expect(data).toHaveProperty("rp");

     

       1513
       1513
       -
       				expect(data).toHaveProperty("user");

     

       1514
       1514
       -
       			},

     

       1515
       1515
       -
       		);

     

       1116
       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       1117
       +
       			const data = await response.json();

     

       1118
       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       1121
       +
       		});

     

       1516
       1122
        
       

     

       1517
       1517
       -
       		serverTest("should require authentication", async () => {

     

       1123
       1123
       +
       		test("should require authentication", async () => {

     

       1518
       1124
        
       			const response = await fetch(

     

       1519
       1125
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1520
       1126
        
       				{

     
···

       1527
       1133
        
       	});

     

       1528
       1134
        
       

     

       1529
       1135
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1530
       1530
       -
       		serverTest("should return authentication options for email", async () => {

     

       1136
       1136
       +
       		test("should return authentication options for email", async () => {

     

       1531
       1137
        
       			const response = await fetch(

     

       1532
       1138
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1533
       1139
        
       				{

     
···

       1542
       1148
        
       			expect(data).toHaveProperty("challenge");

     

       1543
       1149
        
       		});

     

       1544
       1150
        
       

     

       1545
       1545
       -
       		serverTest("should handle non-existent email", async () => {

     

       1151
       1151
       +
       		test("should handle non-existent email", async () => {

     

       1546
       1152
        
       			const response = await fetch(

     

       1547
       1153
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1548
       1154
        
       				{

+1251 -413

src/index.ts

···

       48
       48
        
       	getClassById,

     

       49
       49
        
       	getClassesForUser,

     

       50
       50
        
       	getClassMembers,

     

       51
       51
       +
       	getClassSections,

     

       52
       52
       +
       	getMeetingById,

     

       51
       53
        
       	getMeetingTimesForClass,

     

       52
       54
        
       	getTranscriptionsForClass,

     

       55
       55
       +
       	getUserSection,

     

       53
       56
        
       	isUserEnrolledInClass,

     

       54
       57
        
       	joinClass,

     

       55
       58
        
       	removeUserFromClass,

     

       56
       59
        
       	searchClassesByCourseCode,

     

       57
       60
        
       	toggleClassArchive,

     

       58
       61
        
       	updateMeetingTime,

     

       62
       62
       +
       	createClassSection,

     

       59
       63
        
       } from "./lib/classes";

     

       60
       64
        
       import { sendEmail } from "./lib/email";

     

       61
       65
        
       import {

     
···

       88
       92
        
       	WhisperServiceManager,

     

       89
       93
        
       } from "./lib/transcription";

     

       90
       94
        
       import {

     

       95
       95
       +
       	findMatchingMeetingTime,

     

       96
       96
       +
       	getDayName,

     

       97
       97
       +
       } from "./lib/audio-metadata";

     

       98
       98
       +
       import {

     

       99
       99
       +
       	checkAutoSubmit,

     

       100
       100
       +
       	deletePendingRecording,

     

       101
       101
       +
       	getEnrolledUserCount,

     

       102
       102
       +
       	getPendingRecordings,

     

       103
       103
       +
       	getUserVoteForMeeting,

     

       104
       104
       +
       	markAsAutoSubmitted,

     

       105
       105
       +
       	removeVote,

     

       106
       106
       +
       	voteForRecording,

     

       107
       107
       +
       } from "./lib/voting";

     

       108
       108
       +
       import {

     

       91
       109
        
       	validateClassId,

     

       92
       110
        
       	validateCourseCode,

     

       93
       111
        
       	validateCourseName,

     
···

       135
       153
        
       		console.warn(

     

       136
       154
        
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       137
       155
        
       		);

     

       138
       138
       -
       		console.warn(

     

       139
       139
       -
       			"[Startup] Set ORIGIN in production for correct email links",

     

       140
       140
       -
       		);

     

       156
       156
       +
       		console.warn("[Startup] Set ORIGIN in production for correct email links");

     

       141
       157
        
       	}

     

       142
       158
        
       

     

       143
       159
        
       	console.log("[Startup] Environment variable validation passed");

     
···

       164
       180
        
       	transcriptionEvents,

     

       165
       181
        
       );

     

       166
       182
        
       

     

       167
       167
       -
       // Clean up expired sessions every hour

     

       168
       168
       -
       setInterval(cleanupExpiredSessions, 60 * 60 * 1000);

     

       183
       183
       +
       // Clean up expired sessions every 15 minutes

     

       184
       184
       +
       const sessionCleanupInterval = setInterval(

     

       185
       185
       +
       	cleanupExpiredSessions,

     

       186
       186
       +
       	15 * 60 * 1000,

     

       187
       187
       +
       );

     

       169
       188
        
       

     

       170
       189
        
       // Helper function to sync user subscriptions from Polar

     

       171
       190
        
       async function syncUserSubscriptionsFromPolar(

     

       172
       191
        
       	userId: number,

     

       173
       192
        
       	email: string,

     

       174
       193
        
       ): Promise<void> {

     

       194
       194
       +
       	// Skip Polar sync in test mode

     

       195
       195
       +
       	if (

     

       196
       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       198
       +
       	) {

     

       199
       199
       +
       		return;

     

       200
       200
       +
       	}

     

       201
       201
       +
       

     

       175
       202
        
       	try {

     

       176
       203
        
       		const { polar } = await import("./lib/polar");

     

       177
       204
        
       

     
···

       277
       304
        
       }

     

       278
       305
        
       

     

       279
       306
        
       // Periodic sync every 5 minutes as backup (SSE handles real-time updates)

     

       280
       280
       -
       setInterval(

     

       307
       307
       +
       const syncInterval = setInterval(

     

       281
       308
        
       	async () => {

     

       282
       309
        
       		try {

     

       283
       310
        
       			await whisperService.syncWithWhisper();

     
···

       291
       318
        
       	5 * 60 * 1000,

     

       292
       319
        
       );

     

       293
       320
        
       

     

       294
       294
       -
       // Clean up stale files daily

     

       295
       295
       -
       setInterval(() => whisperService.cleanupStaleFiles(), 24 * 60 * 60 * 1000);

     

       321
       321
       +
       // Clean up stale files hourly

     

       322
       322
       +
       const fileCleanupInterval = setInterval(

     

       323
       323
       +
       	() => whisperService.cleanupStaleFiles(),

     

       324
       324
       +
       	60 * 60 * 1000, // 1 hour

     

       325
       325
       +
       );

     

       296
       326
        
       

     

       297
       327
        
       const server = Bun.serve({

     

       298
       298
       -
       	port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000,

     

       328
       328
       +
       	port:

     

       329
       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       330
       +
       			? 3001

     

       331
       331
       +
       			: process.env.PORT

     

       332
       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       333
       +
       				: 3000,

     

       299
       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       300
       335
        
       	routes: {

     

       301
       336
        
       		"/": indexHTML,

     
···

       388
       423
        
       							email_verification_required: true,

     

       389
       424
        
       							verification_code_sent_at: sentAt,

     

       390
       425
        
       						},

     

       391
       391
       -
       						{ status: 200 },

     

       426
       426
       +
       						{ status: 201 },

     

       392
       427
        
       					);

     

       393
       428
        
       				} catch (err: unknown) {

     

       394
       429
        
       					const error = err as { message?: string };

     

       395
       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       396
       431
        
       						return Response.json(

     

       397
       432
        
       							{ error: "Email already registered" },

     

       398
       398
       -
       							{ status: 400 },

     

       433
       433
       +
       							{ status: 409 },

     

       399
       434
        
       						);

     

       400
       435
        
       					}

     

       401
       436
        
       					console.error("[Auth] Registration error:", err);

     
···

       587
       622
        
       

     

       588
       623
        
       					return Response.json(

     

       589
       624
        
       						{

     

       625
       625
       +
       							success: true,

     

       590
       626
        
       							message: "Email verified successfully",

     

       591
       627
        
       							email_verified: true,

     

       592
       628
        
       							user: { id: user.id, email: user.email },

     
···

       634
       670
        
       						}),

     

       635
       671
        
       					});

     

       636
       672
        
       

     

       637
       637
       -
       					return Response.json({ message: "Verification email sent" });

     

       673
       673
       +
       					return Response.json({

     

       674
       674
       +
       						success: true,

     

       675
       675
       +
       						message: "Verification email sent",

     

       676
       676
       +
       					});

     

       638
       677
        
       				} catch (error) {

     

       639
       678
        
       					return handleError(error);

     

       640
       679
        
       				}

     
···

       665
       704
        
       					if (!user) {

     

       666
       705
        
       						// Don't reveal if user exists

     

       667
       706
        
       						return Response.json({

     

       707
       707
       +
       							success: true,

     

       668
       708
        
       							message:

     

       669
       709
        
       								"If an account exists with that email, a verification code has been sent",

     

       670
       710
        
       						});

     
···

       692
       732
        
       					});

     

       693
       733
        
       

     

       694
       734
        
       					return Response.json({

     

       735
       735
       +
       						success: true,

     

       695
       736
        
       						message: "Verification code sent",

     

       696
       737
        
       						verification_code_sent_at: sentAt,

     

       697
       738
        
       					});

     
···

       736
       777
        
       					}

     

       737
       778
        
       

     

       738
       779
        
       					return Response.json({

     

       780
       780
       +
       						success: true,

     

       739
       781
        
       						message:

     

       740
       782
        
       							"If an account exists with that email, a password reset link has been sent",

     

       741
       783
        
       					});

     
···

       819
       861
        
       					await updateUserPassword(userId, password);

     

       820
       862
        
       					consumePasswordResetToken(token);

     

       821
       863
        
       

     

       822
       822
       -
       					return Response.json({ message: "Password reset successfully" });

     

       864
       864
       +
       					return Response.json({

     

       865
       865
       +
       						success: true,

     

       866
       866
       +
       						message: "Password reset successfully",

     

       867
       867
       +
       					});

     

       823
       868
        
       				} catch (error) {

     

       824
       869
        
       					console.error("[Email] Reset password error:", error);

     

       825
       870
        
       					return Response.json(

     
···

       848
       893
        
       		},

     

       849
       894
        
       		"/api/auth/me": {

     

       850
       895
        
       			GET: (req) => {

     

       851
       851
       -
       				const sessionId = getSessionFromRequest(req);

     

       852
       852
       -
       				if (!sessionId) {

     

       853
       853
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       854
       854
       -
       				}

     

       855
       855
       -
       				const user = getUserBySession(sessionId);

     

       856
       856
       -
       				if (!user) {

     

       857
       857
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       858
       858
       -
       				}

     

       896
       896
       +
       				try {

     

       897
       897
       +
       					const user = requireAuth(req);

     

       859
       898
        
       

     

       860
       860
       -
       				// Check subscription status

     

       861
       861
       -
       				const subscription = db

     

       862
       862
       -
       					.query<{ status: string }, [number]>(

     

       863
       863
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       864
       864
       -
       					)

     

       865
       865
       -
       					.get(user.id);

     

       899
       899
       +
       					// Check subscription status

     

       900
       900
       +
       					const subscription = db

     

       901
       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       903
       +
       						)

     

       904
       904
       +
       						.get(user.id);

     

       866
       905
        
       

     

       867
       867
       -
       				// Get notification preferences

     

       868
       868
       -
       				const prefs = db

     

       869
       869
       -
       					.query<{ email_notifications_enabled: number }, [number]>(

     

       870
       870
       -
       						"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       871
       871
       -
       					)

     

       872
       872
       -
       					.get(user.id);

     

       906
       906
       +
       					// Get notification preferences

     

       907
       907
       +
       					const prefs = db

     

       908
       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       910
       +
       						)

     

       911
       911
       +
       						.get(user.id);

     

       873
       912
        
       

     

       874
       874
       -
       				return Response.json({

     

       875
       875
       -
       					email: user.email,

     

       876
       876
       -
       					name: user.name,

     

       877
       877
       -
       					avatar: user.avatar,

     

       878
       878
       -
       					created_at: user.created_at,

     

       879
       879
       -
       					role: user.role,

     

       880
       880
       -
       					has_subscription: !!subscription,

     

       881
       881
       -
       					email_verified: isEmailVerified(user.id),

     

       882
       882
       -
       					email_notifications_enabled: prefs?.email_notifications_enabled === 1,

     

       883
       883
       -
       				});

     

       913
       913
       +
       					return Response.json({

     

       914
       914
       +
       						email: user.email,

     

       915
       915
       +
       						name: user.name,

     

       916
       916
       +
       						avatar: user.avatar,

     

       917
       917
       +
       						created_at: user.created_at,

     

       918
       918
       +
       						role: user.role,

     

       919
       919
       +
       						has_subscription: !!subscription,

     

       920
       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       921
       +
       						email_notifications_enabled:

     

       922
       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       923
       +
       					});

     

       924
       924
       +
       				} catch (err) {

     

       925
       925
       +
       					return handleError(err);

     

       926
       926
       +
       				}

     

       884
       927
        
       			},

     

       885
       928
        
       		},

     

       886
       929
        
       		"/api/passkeys/register/options": {

     

       887
       930
        
       			POST: async (req) => {

     

       888
       931
        
       				try {

     

       889
       932
        
       					const user = requireAuth(req);

     

       933
       933
       +
       

     

       934
       934
       +
       					const rateLimitError = enforceRateLimit(

     

       935
       935
       +
       						req,

     

       936
       936
       +
       						"passkey-register-options",

     

       937
       937
       +
       						{

     

       938
       938
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       939
       939
       +
       						},

     

       940
       940
       +
       					);

     

       941
       941
       +
       					if (rateLimitError) return rateLimitError;

     

       942
       942
       +
       

     

       890
       943
        
       					const options = await createRegistrationOptions(user);

     

       891
       944
        
       					return Response.json(options);

     

       892
       945
        
       				} catch (err) {

     
···

       898
       951
        
       			POST: async (req) => {

     

       899
       952
        
       				try {

     

       900
       953
        
       					const _user = requireAuth(req);

     

       954
       954
       +
       

     

       955
       955
       +
       					const rateLimitError = enforceRateLimit(

     

       956
       956
       +
       						req,

     

       957
       957
       +
       						"passkey-register-verify",

     

       958
       958
       +
       						{

     

       959
       959
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       960
       960
       +
       						},

     

       961
       961
       +
       					);

     

       962
       962
       +
       					if (rateLimitError) return rateLimitError;

     

       963
       963
       +
       

     

       901
       964
        
       					const body = await req.json();

     

       902
       965
        
       					const { response: credentialResponse, challenge, name } = body;

     

       903
       966
        
       

     
···

       923
       986
        
       		"/api/passkeys/authenticate/options": {

     

       924
       987
        
       			POST: async (req) => {

     

       925
       988
        
       				try {

     

       989
       989
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-options", {

     

       990
       990
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       991
       991
       +
       					});

     

       992
       992
       +
       					if (rateLimitError) return rateLimitError;

     

       993
       993
       +
       

     

       926
       994
        
       					const body = await req.json();

     

       927
       995
        
       					const { email } = body;

     

       928
       996
        
       

     
···

       936
       1004
        
       		"/api/passkeys/authenticate/verify": {

     

       937
       1005
        
       			POST: async (req) => {

     

       938
       1006
        
       				try {

     

       1007
       1007
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-verify", {

     

       1008
       1008
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1009
       1009
       +
       					});

     

       1010
       1010
       +
       					if (rateLimitError) return rateLimitError;

     

       1011
       1011
       +
       

     

       939
       1012
        
       					const body = await req.json();

     

       940
       1013
        
       					const { response: credentialResponse, challenge } = body;

     

       941
       1014
        
       

     
···

       1001
       1074
        
       			PUT: async (req) => {

     

       1002
       1075
        
       				try {

     

       1003
       1076
        
       					const user = requireAuth(req);

     

       1077
       1077
       +
       

     

       1078
       1078
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-update", {

     

       1079
       1079
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1080
       1080
       +
       					});

     

       1081
       1081
       +
       					if (rateLimitError) return rateLimitError;

     

       1082
       1082
       +
       

     

       1004
       1083
        
       					const body = await req.json();

     

       1005
       1084
        
       					const { name } = body;

     

       1006
       1085
        
       					const passkeyId = req.params.id;

     
···

       1010
       1089
        
       					}

     

       1011
       1090
        
       

     

       1012
       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       1013
       1013
       -
       					return Response.json({ success: true });

     

       1092
       1092
       +
       					return new Response(null, { status: 204 });

     

       1014
       1093
        
       				} catch (err) {

     

       1015
       1094
        
       					return handleError(err);

     

       1016
       1095
        
       				}

     
···

       1018
       1097
        
       			DELETE: async (req) => {

     

       1019
       1098
        
       				try {

     

       1020
       1099
        
       					const user = requireAuth(req);

     

       1100
       1100
       +
       

     

       1101
       1101
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-delete", {

     

       1102
       1102
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1103
       1103
       +
       					});

     

       1104
       1104
       +
       					if (rateLimitError) return rateLimitError;

     

       1105
       1105
       +
       

     

       1021
       1106
        
       					const passkeyId = req.params.id;

     

       1022
       1107
        
       					deletePasskey(passkeyId, user.id);

     

       1023
       1023
       -
       					return Response.json({ success: true });

     

       1108
       1108
       +
       					return new Response(null, { status: 204 });

     

       1024
       1109
        
       				} catch (err) {

     

       1025
       1110
        
       					return handleError(err);

     

       1026
       1111
        
       				}

     
···

       1028
       1113
        
       		},

     

       1029
       1114
        
       		"/api/sessions": {

     

       1030
       1115
        
       			GET: (req) => {

     

       1031
       1031
       -
       				const sessionId = getSessionFromRequest(req);

     

       1032
       1032
       -
       				if (!sessionId) {

     

       1033
       1033
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1034
       1034
       -
       				}

     

       1035
       1035
       -
       				const user = getUserBySession(sessionId);

     

       1036
       1036
       -
       				if (!user) {

     

       1037
       1037
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1116
       1116
       +
       				try {

     

       1117
       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       1118
       +
       					if (!sessionId) {

     

       1119
       1119
       +
       						return Response.json(

     

       1120
       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       1121
       +
       							{ status: 401 },

     

       1122
       1122
       +
       						);

     

       1123
       1123
       +
       					}

     

       1124
       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       1125
       +
       					if (!user) {

     

       1126
       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       1127
       +
       					}

     

       1128
       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       1129
       +
       					return Response.json({

     

       1130
       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       1131
       +
       							id: s.id,

     

       1132
       1132
       +
       							ip_address: s.ip_address,

     

       1133
       1133
       +
       							user_agent: s.user_agent,

     

       1134
       1134
       +
       							created_at: s.created_at,

     

       1135
       1135
       +
       							expires_at: s.expires_at,

     

       1136
       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       1137
       +
       						})),

     

       1138
       1138
       +
       					});

     

       1139
       1139
       +
       				} catch (err) {

     

       1140
       1140
       +
       					return handleError(err);

     

       1038
       1141
        
       				}

     

       1039
       1039
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       1040
       1040
       -
       				return Response.json({

     

       1041
       1041
       -
       					sessions: sessions.map((s) => ({

     

       1042
       1042
       -
       						id: s.id,

     

       1043
       1043
       -
       						ip_address: s.ip_address,

     

       1044
       1044
       -
       						user_agent: s.user_agent,

     

       1045
       1045
       -
       						created_at: s.created_at,

     

       1046
       1046
       -
       						expires_at: s.expires_at,

     

       1047
       1047
       -
       						is_current: s.id === sessionId,

     

       1048
       1048
       -
       					})),

     

       1049
       1049
       -
       				});

     

       1050
       1142
        
       			},

     

       1051
       1143
        
       			DELETE: async (req) => {

     

       1052
       1052
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       1053
       1053
       -
       				if (!currentSessionId) {

     

       1054
       1054
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1055
       1055
       -
       				}

     

       1056
       1056
       -
       				const user = getUserBySession(currentSessionId);

     

       1057
       1057
       -
       				if (!user) {

     

       1058
       1058
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1059
       1059
       -
       				}

     

       1060
       1060
       -
       				const body = await req.json();

     

       1061
       1061
       -
       				const targetSessionId = body.sessionId;

     

       1062
       1062
       -
       				if (!targetSessionId) {

     

       1063
       1063
       -
       					return Response.json(

     

       1064
       1064
       -
       						{ error: "Session ID required" },

     

       1065
       1065
       -
       						{ status: 400 },

     

       1066
       1066
       -
       					);

     

       1067
       1067
       -
       				}

     

       1068
       1068
       -
       				// Prevent deleting current session

     

       1069
       1069
       -
       				if (targetSessionId === currentSessionId) {

     

       1070
       1070
       -
       					return Response.json(

     

       1071
       1071
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       1072
       1072
       -
       						{ status: 400 },

     

       1073
       1073
       -
       					);

     

       1074
       1074
       -
       				}

     

       1075
       1075
       -
       				// Verify the session belongs to the user

     

       1076
       1076
       -
       				const targetSession = getSession(targetSessionId);

     

       1077
       1077
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       1078
       1078
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       1144
       1144
       +
       				try {

     

       1145
       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       1146
       +
       					if (!currentSessionId) {

     

       1147
       1147
       +
       						return Response.json(

     

       1148
       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       1149
       +
       							{ status: 401 },

     

       1150
       1150
       +
       						);

     

       1151
       1151
       +
       					}

     

       1152
       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       1153
       +
       					if (!user) {

     

       1154
       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       1155
       +
       					}

     

       1156
       1156
       +
       

     

       1157
       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       1159
       +
       					});

     

       1160
       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1161
       1161
       +
       

     

       1162
       1162
       +
       					const body = await req.json();

     

       1163
       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       1164
       +
       					if (!targetSessionId) {

     

       1165
       1165
       +
       						return Response.json(

     

       1166
       1166
       +
       							{ error: "Session ID required" },

     

       1167
       1167
       +
       							{ status: 400 },

     

       1168
       1168
       +
       						);

     

       1169
       1169
       +
       					}

     

       1170
       1170
       +
       					// Prevent deleting current session

     

       1171
       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       1172
       +
       						return Response.json(

     

       1173
       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       1174
       +
       							{ status: 400 },

     

       1175
       1175
       +
       						);

     

       1176
       1176
       +
       					}

     

       1177
       1177
       +
       					// Verify the session belongs to the user

     

       1178
       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       1181
       +
       					}

     

       1182
       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       1184
       +
       				} catch (err) {

     

       1185
       1185
       +
       					return handleError(err);

     

       1079
       1186
        
       				}

     

       1080
       1080
       -
       				deleteSession(targetSessionId);

     

       1081
       1081
       -
       				return Response.json({ success: true });

     

       1082
       1187
        
       			},

     

       1083
       1188
        
       		},

     

       1084
       1189
        
       		"/api/user": {

     

       1085
       1190
        
       			DELETE: async (req) => {

     

       1086
       1086
       -
       				const sessionId = getSessionFromRequest(req);

     

       1087
       1087
       -
       				if (!sessionId) {

     

       1088
       1088
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1089
       1089
       -
       				}

     

       1090
       1090
       -
       				const user = getUserBySession(sessionId);

     

       1091
       1091
       -
       				if (!user) {

     

       1092
       1092
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1093
       1093
       -
       				}

     

       1191
       1191
       +
       				try {

     

       1192
       1192
       +
       					const user = requireAuth(req);

     

       1094
       1193
        
       

     

       1095
       1095
       -
       				// Rate limiting

     

       1096
       1096
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1097
       1097
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       1098
       1098
       -
       				});

     

       1099
       1099
       -
       				if (rateLimitError) return rateLimitError;

     

       1194
       1194
       +
       					// Rate limiting

     

       1195
       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       1197
       +
       					});

     

       1198
       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       1100
       1199
        
       

     

       1101
       1101
       -
       				await deleteUser(user.id);

     

       1102
       1102
       -
       				return Response.json(

     

       1103
       1103
       -
       					{ success: true },

     

       1104
       1104
       -
       					{

     

       1200
       1200
       +
       					await deleteUser(user.id);

     

       1201
       1201
       +
       					return new Response(null, {

     

       1202
       1202
       +
       						status: 204,

     

       1105
       1203
        
       						headers: {

     

       1106
       1204
        
       							"Set-Cookie":

     

       1107
       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       1108
       1206
        
       						},

     

       1109
       1109
       -
       					},

     

       1110
       1110
       -
       				);

     

       1207
       1207
       +
       					});

     

       1208
       1208
       +
       				} catch (err) {

     

       1209
       1209
       +
       					return handleError(err);

     

       1210
       1210
       +
       				}

     

       1111
       1211
        
       			},

     

       1112
       1212
        
       		},

     

       1113
       1213
        
       		"/api/user/email": {

     

       1114
       1214
        
       			PUT: async (req) => {

     

       1115
       1115
       -
       				const sessionId = getSessionFromRequest(req);

     

       1116
       1116
       -
       				if (!sessionId) {

     

       1117
       1117
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1118
       1118
       -
       				}

     

       1119
       1119
       -
       				const user = getUserBySession(sessionId);

     

       1120
       1120
       -
       				if (!user) {

     

       1121
       1121
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1122
       1122
       -
       				}

     

       1215
       1215
       +
       				try {

     

       1216
       1216
       +
       					const user = requireAuth(req);

     

       1123
       1217
        
       

     

       1124
       1124
       -
       				// Rate limiting

     

       1125
       1125
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1126
       1126
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1127
       1127
       -
       				});

     

       1128
       1128
       -
       				if (rateLimitError) return rateLimitError;

     

       1218
       1218
       +
       					// Rate limiting

     

       1219
       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       1221
       +
       					});

     

       1222
       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       1129
       1223
        
       

     

       1130
       1130
       -
       				const body = await req.json();

     

       1131
       1131
       -
       				const { email } = body;

     

       1132
       1132
       -
       				if (!email) {

     

       1133
       1133
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1134
       1134
       -
       				}

     

       1224
       1224
       +
       					const body = await req.json();

     

       1225
       1225
       +
       					const { email } = body;

     

       1226
       1226
       +
       					if (!email) {

     

       1227
       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       1228
       +
       					}

     

       1135
       1229
        
       

     

       1136
       1136
       -
       				// Check if email is already in use

     

       1137
       1137
       -
       				const existingUser = getUserByEmail(email);

     

       1138
       1138
       -
       				if (existingUser) {

     

       1139
       1139
       -
       					return Response.json(

     

       1140
       1140
       -
       						{ error: "Email already in use" },

     

       1141
       1141
       -
       						{ status: 400 },

     

       1142
       1142
       -
       					);

     

       1143
       1143
       -
       				}

     

       1230
       1230
       +
       					// Check if email is already in use

     

       1231
       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       1232
       +
       					if (existingUser) {

     

       1233
       1233
       +
       						return Response.json(

     

       1234
       1234
       +
       							{ error: "Email already in use" },

     

       1235
       1235
       +
       							{ status: 409 },

     

       1236
       1236
       +
       						);

     

       1237
       1237
       +
       					}

     

       1144
       1238
        
       

     

       1145
       1145
       -
       				try {

     

       1146
       1146
       -
       					// Create email change token

     

       1147
       1147
       -
       					const token = createEmailChangeToken(user.id, email);

     

       1239
       1239
       +
       					try {

     

       1240
       1240
       +
       						// Create email change token

     

       1241
       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1148
       1242
        
       

     

       1149
       1149
       -
       					// Send verification email to the CURRENT address

     

       1150
       1150
       -
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1151
       1151
       -
       					const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1243
       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1152
       1246
        
       

     

       1153
       1153
       -
       					await sendEmail({

     

       1154
       1154
       -
       						to: user.email,

     

       1155
       1155
       -
       						subject: "Verify your email change",

     

       1156
       1156
       -
       						html: emailChangeTemplate({

     

       1157
       1157
       -
       							name: user.name,

     

       1158
       1158
       -
       							currentEmail: user.email,

     

       1159
       1159
       -
       							newEmail: email,

     

       1160
       1160
       -
       							verifyLink: verifyUrl,

     

       1161
       1161
       -
       						}),

     

       1162
       1162
       -
       					});

     

       1247
       1247
       +
       						await sendEmail({

     

       1248
       1248
       +
       							to: user.email,

     

       1249
       1249
       +
       							subject: "Verify your email change",

     

       1250
       1250
       +
       							html: emailChangeTemplate({

     

       1251
       1251
       +
       								name: user.name,

     

       1252
       1252
       +
       								currentEmail: user.email,

     

       1253
       1253
       +
       								newEmail: email,

     

       1254
       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       1255
       +
       							}),

     

       1256
       1256
       +
       						});

     

       1163
       1257
        
       

     

       1164
       1164
       -
       					return Response.json({

     

       1165
       1165
       -
       						success: true,

     

       1166
       1166
       -
       						message: `Verification email sent to ${user.email}`,

     

       1167
       1167
       -
       						pendingEmail: email,

     

       1168
       1168
       -
       					});

     

       1169
       1169
       -
       				} catch (error) {

     

       1170
       1170
       -
       					console.error(

     

       1171
       1171
       -
       						"[Email] Failed to send email change verification:",

     

       1172
       1172
       -
       						error,

     

       1173
       1173
       -
       					);

     

       1174
       1174
       -
       					return Response.json(

     

       1175
       1175
       -
       						{ error: "Failed to send verification email" },

     

       1176
       1176
       -
       						{ status: 500 },

     

       1177
       1177
       -
       					);

     

       1258
       1258
       +
       						return Response.json({

     

       1259
       1259
       +
       							success: true,

     

       1260
       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       1261
       +
       							pendingEmail: email,

     

       1262
       1262
       +
       						});

     

       1263
       1263
       +
       					} catch (error) {

     

       1264
       1264
       +
       						console.error(

     

       1265
       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       1266
       +
       							error,

     

       1267
       1267
       +
       						);

     

       1268
       1268
       +
       						return Response.json(

     

       1269
       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       1270
       +
       							{ status: 500 },

     

       1271
       1271
       +
       						);

     

       1272
       1272
       +
       					}

     

       1273
       1273
       +
       				} catch (err) {

     

       1274
       1274
       +
       					return handleError(err);

     

       1178
       1275
        
       				}

     

       1179
       1276
        
       			},

     

       1180
       1277
        
       		},

     
···

       1222
       1319
        
       		},

     

       1223
       1320
        
       		"/api/user/password": {

     

       1224
       1321
        
       			PUT: async (req) => {

     

       1225
       1225
       -
       				const sessionId = getSessionFromRequest(req);

     

       1226
       1226
       -
       				if (!sessionId) {

     

       1227
       1227
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1228
       1228
       -
       				}

     

       1229
       1229
       -
       				const user = getUserBySession(sessionId);

     

       1230
       1230
       -
       				if (!user) {

     

       1231
       1231
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1232
       1232
       -
       				}

     

       1322
       1322
       +
       				try {

     

       1323
       1323
       +
       					const user = requireAuth(req);

     

       1233
       1324
        
       

     

       1234
       1234
       -
       				// Rate limiting

     

       1235
       1235
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1236
       1236
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1237
       1237
       -
       				});

     

       1238
       1238
       -
       				if (rateLimitError) return rateLimitError;

     

       1325
       1325
       +
       					// Rate limiting

     

       1326
       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       1328
       +
       					});

     

       1329
       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       1239
       1330
        
       

     

       1240
       1240
       -
       				const body = await req.json();

     

       1241
       1241
       -
       				const { password } = body;

     

       1242
       1242
       -
       				if (!password) {

     

       1243
       1243
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       1244
       1244
       -
       				}

     

       1245
       1245
       -
       				// Validate password format (client-side hashed PBKDF2)

     

       1246
       1246
       -
       				const passwordValidation = validatePasswordHash(password);

     

       1247
       1247
       -
       				if (!passwordValidation.valid) {

     

       1248
       1248
       -
       					return Response.json(

     

       1249
       1249
       -
       						{ error: passwordValidation.error },

     

       1250
       1250
       -
       						{ status: 400 },

     

       1251
       1251
       -
       					);

     

       1252
       1252
       -
       				}

     

       1253
       1253
       -
       				try {

     

       1254
       1254
       -
       					await updateUserPassword(user.id, password);

     

       1255
       1255
       -
       					return Response.json({ success: true });

     

       1256
       1256
       -
       				} catch {

     

       1257
       1257
       -
       					return Response.json(

     

       1258
       1258
       -
       						{ error: "Failed to update password" },

     

       1259
       1259
       -
       						{ status: 500 },

     

       1260
       1260
       -
       					);

     

       1331
       1331
       +
       					const body = await req.json();

     

       1332
       1332
       +
       					const { password } = body;

     

       1333
       1333
       +
       					if (!password) {

     

       1334
       1334
       +
       						return Response.json(

     

       1335
       1335
       +
       							{ error: "Password required" },

     

       1336
       1336
       +
       							{ status: 400 },

     

       1337
       1337
       +
       						);

     

       1338
       1338
       +
       					}

     

       1339
       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       1342
       +
       						return Response.json(

     

       1343
       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       1344
       +
       							{ status: 400 },

     

       1345
       1345
       +
       						);

     

       1346
       1346
       +
       					}

     

       1347
       1347
       +
       					try {

     

       1348
       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       1349
       +
       						return Response.json({ success: true });

     

       1350
       1350
       +
       					} catch {

     

       1351
       1351
       +
       						return Response.json(

     

       1352
       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       1353
       +
       							{ status: 500 },

     

       1354
       1354
       +
       						);

     

       1355
       1355
       +
       					}

     

       1356
       1356
       +
       				} catch (err) {

     

       1357
       1357
       +
       					return handleError(err);

     

       1261
       1358
        
       				}

     

       1262
       1359
        
       			},

     

       1263
       1360
        
       		},

     

       1264
       1361
        
       		"/api/user/name": {

     

       1265
       1362
        
       			PUT: async (req) => {

     

       1266
       1266
       -
       				const sessionId = getSessionFromRequest(req);

     

       1267
       1267
       -
       				if (!sessionId) {

     

       1268
       1268
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1269
       1269
       -
       				}

     

       1270
       1270
       -
       				const user = getUserBySession(sessionId);

     

       1271
       1271
       -
       				if (!user) {

     

       1272
       1272
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1273
       1273
       -
       				}

     

       1274
       1274
       -
       				const body = await req.json();

     

       1275
       1275
       -
       				const { name } = body;

     

       1276
       1276
       -
       				if (!name) {

     

       1277
       1277
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       1278
       1278
       -
       				}

     

       1279
       1363
        
       				try {

     

       1280
       1280
       -
       					updateUserName(user.id, name);

     

       1281
       1281
       -
       					return Response.json({ success: true });

     

       1282
       1282
       -
       				} catch {

     

       1283
       1283
       -
       					return Response.json(

     

       1284
       1284
       -
       						{ error: "Failed to update name" },

     

       1285
       1285
       -
       						{ status: 500 },

     

       1286
       1286
       -
       					);

     

       1364
       1364
       +
       					const user = requireAuth(req);

     

       1365
       1365
       +
       

     

       1366
       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       1368
       +
       					});

     

       1369
       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1370
       1370
       +
       

     

       1371
       1371
       +
       					const body = await req.json();

     

       1372
       1372
       +
       					const { name } = body;

     

       1373
       1373
       +
       					if (!name) {

     

       1374
       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       1375
       +
       					}

     

       1376
       1376
       +
       					try {

     

       1377
       1377
       +
       						updateUserName(user.id, name);

     

       1378
       1378
       +
       						return Response.json({ success: true });

     

       1379
       1379
       +
       					} catch {

     

       1380
       1380
       +
       						return Response.json(

     

       1381
       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       1382
       +
       							{ status: 500 },

     

       1383
       1383
       +
       						);

     

       1384
       1384
       +
       					}

     

       1385
       1385
       +
       				} catch (err) {

     

       1386
       1386
       +
       					return handleError(err);

     

       1287
       1387
        
       				}

     

       1288
       1388
        
       			},

     

       1289
       1389
        
       		},

     

       1290
       1390
        
       		"/api/user/avatar": {

     

       1291
       1391
        
       			PUT: async (req) => {

     

       1292
       1292
       -
       				const sessionId = getSessionFromRequest(req);

     

       1293
       1293
       -
       				if (!sessionId) {

     

       1294
       1294
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1295
       1295
       -
       				}

     

       1296
       1296
       -
       				const user = getUserBySession(sessionId);

     

       1297
       1297
       -
       				if (!user) {

     

       1298
       1298
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1299
       1299
       -
       				}

     

       1300
       1300
       -
       				const body = await req.json();

     

       1301
       1301
       -
       				const { avatar } = body;

     

       1302
       1302
       -
       				if (!avatar) {

     

       1303
       1303
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1304
       1304
       -
       				}

     

       1305
       1392
        
       				try {

     

       1306
       1306
       -
       					updateUserAvatar(user.id, avatar);

     

       1307
       1307
       -
       					return Response.json({ success: true });

     

       1308
       1308
       -
       				} catch {

     

       1309
       1309
       -
       					return Response.json(

     

       1310
       1310
       -
       						{ error: "Failed to update avatar" },

     

       1311
       1311
       -
       						{ status: 500 },

     

       1312
       1312
       -
       					);

     

       1393
       1393
       +
       					const user = requireAuth(req);

     

       1394
       1394
       +
       

     

       1395
       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       1397
       +
       					});

     

       1398
       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1399
       1399
       +
       

     

       1400
       1400
       +
       					const body = await req.json();

     

       1401
       1401
       +
       					const { avatar } = body;

     

       1402
       1402
       +
       					if (!avatar) {

     

       1403
       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       1404
       +
       					}

     

       1405
       1405
       +
       					try {

     

       1406
       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       1407
       +
       						return Response.json({ success: true });

     

       1408
       1408
       +
       					} catch {

     

       1409
       1409
       +
       						return Response.json(

     

       1410
       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       1411
       +
       							{ status: 500 },

     

       1412
       1412
       +
       						);

     

       1413
       1413
       +
       					}

     

       1414
       1414
       +
       				} catch (err) {

     

       1415
       1415
       +
       					return handleError(err);

     

       1313
       1416
        
       				}

     

       1314
       1417
        
       			},

     

       1315
       1418
        
       		},

     

       1316
       1419
        
       		"/api/user/notifications": {

     

       1317
       1420
        
       			PUT: async (req) => {

     

       1318
       1318
       -
       				const sessionId = getSessionFromRequest(req);

     

       1319
       1319
       -
       				if (!sessionId) {

     

       1320
       1320
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1321
       1321
       -
       				}

     

       1322
       1322
       -
       				const user = getUserBySession(sessionId);

     

       1323
       1323
       -
       				if (!user) {

     

       1324
       1324
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1325
       1325
       -
       				}

     

       1326
       1326
       -
       				const body = await req.json();

     

       1327
       1327
       -
       				const { email_notifications_enabled } = body;

     

       1328
       1328
       -
       				if (typeof email_notifications_enabled !== "boolean") {

     

       1329
       1329
       -
       					return Response.json(

     

       1330
       1330
       -
       						{ error: "email_notifications_enabled must be a boolean" },

     

       1331
       1331
       -
       						{ status: 400 },

     

       1332
       1332
       -
       					);

     

       1333
       1333
       -
       				}

     

       1334
       1421
        
       				try {

     

       1335
       1335
       -
       					db.run(

     

       1336
       1336
       -
       						"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1337
       1337
       -
       						[email_notifications_enabled ? 1 : 0, user.id],

     

       1338
       1338
       -
       					);

     

       1339
       1339
       -
       					return Response.json({ success: true });

     

       1340
       1340
       -
       				} catch {

     

       1341
       1341
       -
       					return Response.json(

     

       1342
       1342
       -
       						{ error: "Failed to update notification settings" },

     

       1343
       1343
       -
       						{ status: 500 },

     

       1344
       1344
       -
       					);

     

       1422
       1422
       +
       					const user = requireAuth(req);

     

       1423
       1423
       +
       

     

       1424
       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       1426
       +
       					});

     

       1427
       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       1428
       1428
       +
       

     

       1429
       1429
       +
       					const body = await req.json();

     

       1430
       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       1432
       1432
       +
       						return Response.json(

     

       1433
       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       1434
       +
       							{ status: 400 },

     

       1435
       1435
       +
       						);

     

       1436
       1436
       +
       					}

     

       1437
       1437
       +
       					try {

     

       1438
       1438
       +
       						db.run(

     

       1439
       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       1441
       +
       						);

     

       1442
       1442
       +
       						return Response.json({ success: true });

     

       1443
       1443
       +
       					} catch {

     

       1444
       1444
       +
       						return Response.json(

     

       1445
       1445
       +
       							{ error: "Failed to update notification settings" },

     

       1446
       1446
       +
       							{ status: 500 },

     

       1447
       1447
       +
       						);

     

       1448
       1448
       +
       					}

     

       1449
       1449
       +
       				} catch (err) {

     

       1450
       1450
       +
       					return handleError(err);

     

       1345
       1451
        
       				}

     

       1346
       1452
        
       			},

     

       1347
       1453
        
       		},

     

       1348
       1454
        
       		"/api/billing/checkout": {

     

       1349
       1455
        
       			POST: async (req) => {

     

       1350
       1350
       -
       				const sessionId = getSessionFromRequest(req);

     

       1351
       1351
       -
       				if (!sessionId) {

     

       1352
       1352
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1353
       1353
       -
       				}

     

       1354
       1354
       -
       				const user = getUserBySession(sessionId);

     

       1355
       1355
       -
       				if (!user) {

     

       1356
       1356
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1357
       1357
       -
       				}

     

       1358
       1358
       -
       

     

       1359
       1456
        
       				try {

     

       1457
       1457
       +
       					const user = requireAuth(req);

     

       1458
       1458
       +
       

     

       1360
       1459
        
       					const { polar } = await import("./lib/polar");

     

       1361
       1460
        
       

     

       1362
       1461
        
       					// Validated at startup

     
···

       1375
       1474
        
       					});

     

       1376
       1475
        
       

     

       1377
       1476
        
       					return Response.json({ url: checkout.url });

     

       1378
       1378
       -
       				} catch (error) {

     

       1379
       1379
       -
       					console.error("Failed to create checkout:", error);

     

       1380
       1380
       -
       					return Response.json(

     

       1381
       1381
       -
       						{ error: "Failed to create checkout session" },

     

       1382
       1382
       -
       						{ status: 500 },

     

       1383
       1383
       -
       					);

     

       1477
       1477
       +
       				} catch (err) {

     

       1478
       1478
       +
       					return handleError(err);

     

       1384
       1479
        
       				}

     

       1385
       1480
        
       			},

     

       1386
       1481
        
       		},

     

       1387
       1482
        
       		"/api/billing/subscription": {

     

       1388
       1483
        
       			GET: async (req) => {

     

       1389
       1389
       -
       				const sessionId = getSessionFromRequest(req);

     

       1390
       1390
       -
       				if (!sessionId) {

     

       1391
       1391
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1392
       1392
       -
       				}

     

       1393
       1393
       -
       				const user = getUserBySession(sessionId);

     

       1394
       1394
       -
       				if (!user) {

     

       1395
       1395
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1396
       1396
       -
       				}

     

       1484
       1484
       +
       				try {

     

       1485
       1485
       +
       					const user = requireAuth(req);

     

       1397
       1486
        
       

     

       1398
       1398
       -
       				try {

     

       1399
       1487
        
       					// Get subscription from database

     

       1400
       1488
        
       					const subscription = db

     

       1401
       1489
        
       						.query<

     
···

       1418
       1506
        
       					}

     

       1419
       1507
        
       

     

       1420
       1508
        
       					return Response.json({ subscription });

     

       1421
       1421
       -
       				} catch (error) {

     

       1422
       1422
       -
       					console.error("Failed to fetch subscription:", error);

     

       1423
       1423
       -
       					return Response.json(

     

       1424
       1424
       -
       						{ error: "Failed to fetch subscription" },

     

       1425
       1425
       -
       						{ status: 500 },

     

       1426
       1426
       -
       					);

     

       1509
       1509
       +
       				} catch (err) {

     

       1510
       1510
       +
       					return handleError(err);

     

       1427
       1511
        
       				}

     

       1428
       1512
        
       			},

     

       1429
       1513
        
       		},

     

       1430
       1514
        
       		"/api/billing/portal": {

     

       1431
       1515
        
       			POST: async (req) => {

     

       1432
       1432
       -
       				const sessionId = getSessionFromRequest(req);

     

       1433
       1433
       -
       				if (!sessionId) {

     

       1434
       1434
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1435
       1435
       -
       				}

     

       1436
       1436
       -
       				const user = getUserBySession(sessionId);

     

       1437
       1437
       -
       				if (!user) {

     

       1438
       1438
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1439
       1439
       -
       				}

     

       1516
       1516
       +
       				try {

     

       1517
       1517
       +
       					const user = requireAuth(req);

     

       1440
       1518
        
       

     

       1441
       1441
       -
       				try {

     

       1442
       1519
        
       					const { polar } = await import("./lib/polar");

     

       1443
       1520
        
       

     

       1444
       1521
        
       					// Get subscription to find customer ID

     
···

       1466
       1543
        
       					});

     

       1467
       1544
        
       

     

       1468
       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1469
       1469
       -
       				} catch (error) {

     

       1470
       1470
       -
       					console.error("Failed to create portal session:", error);

     

       1471
       1471
       -
       					return Response.json(

     

       1472
       1472
       -
       						{ error: "Failed to create portal session" },

     

       1473
       1473
       -
       						{ status: 500 },

     

       1474
       1474
       -
       					);

     

       1546
       1546
       +
       				} catch (err) {

     

       1547
       1547
       +
       					return handleError(err);

     

       1475
       1548
        
       				}

     

       1476
       1549
        
       			},

     

       1477
       1550
        
       		},

     

       1478
       1551
        
       		"/api/webhooks/polar": {

     

       1479
       1552
        
       			POST: async (req) => {

     

       1480
       1480
       -
       				try {

     

       1481
       1481
       -
       					const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1553
       1553
       +
       				const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1482
       1554
        
       

     

       1483
       1483
       -
       					// Get raw body as string

     

       1484
       1484
       -
       					const rawBody = await req.text();

     

       1485
       1485
       -
       					const headers = Object.fromEntries(req.headers.entries());

     

       1555
       1555
       +
       				// Get raw body as string

     

       1556
       1556
       +
       				const rawBody = await req.text();

     

       1557
       1557
       +
       				const headers = Object.fromEntries(req.headers.entries());

     

       1486
       1558
        
       

     

       1487
       1487
       -
       					// Validate webhook signature (validated at startup)

     

       1488
       1488
       -
       					const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1489
       1489
       -
       					const event = validateEvent(rawBody, headers, webhookSecret);

     

       1559
       1559
       +
       				// Validate webhook signature (validated at startup)

     

       1560
       1560
       +
       				const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1561
       1561
       +
       				let event: ReturnType<typeof validateEvent>;

     

       1562
       1562
       +
       				try {

     

       1563
       1563
       +
       					event = validateEvent(rawBody, headers, webhookSecret);

     

       1564
       1564
       +
       				} catch (error) {

     

       1565
       1565
       +
       					// Validation failed - log but return generic response

     

       1566
       1566
       +
       					console.error("[Webhook] Signature validation failed:", error);

     

       1567
       1567
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1568
       1568
       +
       				}

     

       1490
       1569
        
       

     

       1491
       1491
       -
       					console.log(`[Webhook] Received event: ${event.type}`);

     

       1570
       1570
       +
       				console.log(`[Webhook] Received event: ${event.type}`);

     

       1492
       1571
        
       

     

       1493
       1493
       -
       					// Handle different event types

     

       1572
       1572
       +
       				// Handle different event types

     

       1573
       1573
       +
       				try {

     

       1494
       1574
        
       					switch (event.type) {

     

       1495
       1575
        
       						case "subscription.updated": {

     

       1496
       1576
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       1551
       1631
        
       

     

       1552
       1632
        
       					return Response.json({ received: true });

     

       1553
       1633
        
       				} catch (error) {

     

       1554
       1554
       -
       					console.error("[Webhook] Error processing webhook:", error);

     

       1555
       1555
       -
       					return Response.json(

     

       1556
       1556
       -
       						{ error: "Webhook processing failed" },

     

       1557
       1557
       -
       						{ status: 400 },

     

       1558
       1558
       -
       					);

     

       1634
       1634
       +
       					// Processing failed - log with detail but return generic response

     

       1635
       1635
       +
       					console.error("[Webhook] Event processing failed:", error);

     

       1636
       1636
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1559
       1637
        
       				}

     

       1560
       1638
        
       			},

     

       1561
       1639
        
       		},

     
···

       1601
       1679
        
       

     

       1602
       1680
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1603
       1681
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1604
       1604
       -
       						return Response.json(

     

       1605
       1605
       -
       							{ error: "Transcription not found" },

     

       1606
       1606
       -
       							{ status: 404 },

     

       1607
       1607
       -
       						);

     

       1682
       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1608
       1683
        
       					}

     

       1609
       1684
        
       

     

       1610
       1685
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1619
       1694
        
       					// Event-driven SSE stream with reconnection support

     

       1620
       1695
        
       					const stream = new ReadableStream({

     

       1621
       1696
        
       						async start(controller) {

     

       1697
       1697
       +
       							// Track this stream for graceful shutdown

     

       1698
       1698
       +
       							activeSSEStreams.add(controller);

     

       1699
       1699
       +
       

     

       1622
       1700
        
       							const encoder = new TextEncoder();

     

       1623
       1701
        
       							let isClosed = false;

     

       1624
       1702
        
       							let lastEventId = Math.floor(Date.now() / 1000);

     
···

       1669
       1747
        
       								current?.status === "failed"

     

       1670
       1748
        
       							) {

     

       1671
       1749
        
       								isClosed = true;

     

       1750
       1750
       +
       								activeSSEStreams.delete(controller);

     

       1672
       1751
        
       								controller.close();

     

       1673
       1752
        
       								return;

     

       1674
       1753
        
       							}

     
···

       1699
       1778
        
       									isClosed = true;

     

       1700
       1779
        
       									clearInterval(heartbeatInterval);

     

       1701
       1780
        
       									transcriptionEvents.off(transcriptionId, updateHandler);

     

       1781
       1781
       +
       									activeSSEStreams.delete(controller);

     

       1702
       1782
        
       									controller.close();

     

       1703
       1783
        
       								}

     

       1704
       1784
        
       							};

     
···

       1708
       1788
        
       								isClosed = true;

     

       1709
       1789
        
       								clearInterval(heartbeatInterval);

     

       1710
       1790
        
       								transcriptionEvents.off(transcriptionId, updateHandler);

     

       1791
       1791
       +
       								activeSSEStreams.delete(controller);

     

       1711
       1792
        
       							};

     

       1712
       1793
        
       						},

     

       1713
       1794
        
       					});

     
···

       1723
       1804
        
       				}

     

       1724
       1805
        
       			},

     

       1725
       1806
        
       		},

     

       1726
       1726
       -
       		"/api/transcriptions/health": {

     

       1807
       1807
       +
       		"/api/health": {

     

       1727
       1808
        
       			GET: async () => {

     

       1728
       1728
       -
       				const isHealthy = await whisperService.checkHealth();

     

       1729
       1729
       -
       				return Response.json({ available: isHealthy });

     

       1809
       1809
       +
       				const health = {

     

       1810
       1810
       +
       					status: "healthy",

     

       1811
       1811
       +
       					timestamp: new Date().toISOString(),

     

       1812
       1812
       +
       					services: {

     

       1813
       1813
       +
       						database: false,

     

       1814
       1814
       +
       						whisper: false,

     

       1815
       1815
       +
       						storage: false,

     

       1816
       1816
       +
       					},

     

       1817
       1817
       +
       					details: {} as Record<string, unknown>,

     

       1818
       1818
       +
       				};

     

       1819
       1819
       +
       

     

       1820
       1820
       +
       				// Check database

     

       1821
       1821
       +
       				try {

     

       1822
       1822
       +
       					db.query("SELECT 1").get();

     

       1823
       1823
       +
       					health.services.database = true;

     

       1824
       1824
       +
       				} catch (error) {

     

       1825
       1825
       +
       					health.status = "unhealthy";

     

       1826
       1826
       +
       					health.details.databaseError =

     

       1827
       1827
       +
       						error instanceof Error ? error.message : String(error);

     

       1828
       1828
       +
       				}

     

       1829
       1829
       +
       

     

       1830
       1830
       +
       				// Check Whisper service

     

       1831
       1831
       +
       				try {

     

       1832
       1832
       +
       					const whisperHealthy = await whisperService.checkHealth();

     

       1833
       1833
       +
       					health.services.whisper = whisperHealthy;

     

       1834
       1834
       +
       					if (!whisperHealthy) {

     

       1835
       1835
       +
       						health.status = "degraded";

     

       1836
       1836
       +
       						health.details.whisperNote = "Whisper service unavailable";

     

       1837
       1837
       +
       					}

     

       1838
       1838
       +
       				} catch (error) {

     

       1839
       1839
       +
       					health.status = "degraded";

     

       1840
       1840
       +
       					health.details.whisperError =

     

       1841
       1841
       +
       						error instanceof Error ? error.message : String(error);

     

       1842
       1842
       +
       				}

     

       1843
       1843
       +
       

     

       1844
       1844
       +
       				// Check storage (uploads and transcripts directories)

     

       1845
       1845
       +
       				try {

     

       1846
       1846
       +
       					const fs = await import("node:fs/promises");

     

       1847
       1847
       +
       					const uploadsExists = await fs

     

       1848
       1848
       +
       						.access("./uploads")

     

       1849
       1849
       +
       						.then(() => true)

     

       1850
       1850
       +
       						.catch(() => false);

     

       1851
       1851
       +
       					const transcriptsExists = await fs

     

       1852
       1852
       +
       						.access("./transcripts")

     

       1853
       1853
       +
       						.then(() => true)

     

       1854
       1854
       +
       						.catch(() => false);

     

       1855
       1855
       +
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1856
       1856
       +
       					if (!health.services.storage) {

     

       1857
       1857
       +
       						health.status = "unhealthy";

     

       1858
       1858
       +
       						health.details.storageNote = `Missing directories: ${[

     

       1859
       1859
       +
       							!uploadsExists && "uploads",

     

       1860
       1860
       +
       							!transcriptsExists && "transcripts",

     

       1861
       1861
       +
       						]

     

       1862
       1862
       +
       							.filter(Boolean)

     

       1863
       1863
       +
       							.join(", ")}`;

     

       1864
       1864
       +
       					}

     

       1865
       1865
       +
       				} catch (error) {

     

       1866
       1866
       +
       					health.status = "unhealthy";

     

       1867
       1867
       +
       					health.details.storageError =

     

       1868
       1868
       +
       						error instanceof Error ? error.message : String(error);

     

       1869
       1869
       +
       				}

     

       1870
       1870
       +
       

     

       1871
       1871
       +
       				const statusCode = health.status === "healthy" ? 200 : 503;

     

       1872
       1872
       +
       				return Response.json(health, { status: statusCode });

     

       1730
       1873
        
       			},

     

       1731
       1874
        
       		},

     

       1732
       1875
        
       		"/api/transcriptions/:id": {

     
···

       1776
       1919
        
       

     

       1777
       1920
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1778
       1921
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1779
       1779
       -
       						return Response.json(

     

       1780
       1780
       -
       							{ error: "Transcription not found" },

     

       1781
       1781
       -
       							{ status: 404 },

     

       1782
       1782
       -
       						);

     

       1922
       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1783
       1923
        
       					}

     

       1784
       1924
        
       

     

       1785
       1925
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1795
       1935
        
       					if (transcription.status !== "completed") {

     

       1796
       1936
        
       						return Response.json(

     

       1797
       1937
        
       							{ error: "Transcription not completed yet" },

     

       1798
       1798
       -
       							{ status: 400 },

     

       1938
       1938
       +
       							{ status: 409 },

     

       1799
       1939
        
       						);

     

       1800
       1940
        
       					}

     

       1801
       1941
        
       

     
···

       1884
       2024
        
       

     

       1885
       2025
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1886
       2026
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1887
       1887
       -
       						return Response.json(

     

       1888
       1888
       -
       							{ error: "Transcription not found" },

     

       1889
       1889
       -
       							{ status: 404 },

     

       1890
       1890
       -
       						);

     

       2027
       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1891
       2028
        
       					}

     

       1892
       2029
        
       

     

       1893
       2030
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1959
       2096
        
       				}

     

       1960
       2097
        
       			},

     

       1961
       2098
        
       		},

     

       1962
       1962
       -
       		"/api/transcriptions": {

     

       2099
       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       2100
       +
       			POST: async (req) => {

     

       2101
       2101
       +
       				try {

     

       2102
       2102
       +
       					const user = requireAuth(req);

     

       2103
       2103
       +
       

     

       2104
       2104
       +
       					const formData = await req.formData();

     

       2105
       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       2108
       +
       						| string

     

       2109
       2109
       +
       						| null;

     

       2110
       2110
       +
       

     

       2111
       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       2113
       +
       

     

       2114
       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       2117
       +
       						return Response.json(

     

       2118
       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       2119
       +
       							{ status: 403 },

     

       2120
       2120
       +
       						);

     

       2121
       2121
       +
       					}

     

       2122
       2122
       +
       

     

       2123
       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       2124
       +
       

     

       2125
       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       2126
       +
       					if (fileTimestampStr) {

     

       2127
       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       2130
       +
       							console.log(

     

       2131
       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       2132
       +
       							);

     

       2133
       2133
       +
       						}

     

       2134
       2134
       +
       					}

     

       2135
       2135
       +
       

     

       2136
       2136
       +
       					if (!creationDate) {

     

       2137
       2137
       +
       						return Response.json({

     

       2138
       2138
       +
       							detected: false,

     

       2139
       2139
       +
       							meeting_time_id: null,

     

       2140
       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       2141
       +
       						});

     

       2142
       2142
       +
       					}

     

       2143
       2143
       +
       

     

       2144
       2144
       +
       					// Get meeting times for this class

     

       2145
       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       2146
       +
       

     

       2147
       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       2148
       +
       						return Response.json({

     

       2149
       2149
       +
       							detected: false,

     

       2150
       2150
       +
       							meeting_time_id: null,

     

       2151
       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       2152
       +
       						});

     

       2153
       2153
       +
       					}

     

       2154
       2154
       +
       

     

       2155
       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       2157
       +
       						creationDate,

     

       2158
       2158
       +
       						meetingTimes,

     

       2159
       2159
       +
       					);

     

       2160
       2160
       +
       

     

       2161
       2161
       +
       					if (matchedId) {

     

       2162
       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       2163
       +
       						return Response.json({

     

       2164
       2164
       +
       							detected: true,

     

       2165
       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       2166
       +
       							day: dayName,

     

       2167
       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       2168
       +
       						});

     

       2169
       2169
       +
       					}

     

       2170
       2170
       +
       

     

       2171
       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       2172
       +
       					return Response.json({

     

       2173
       2173
       +
       						detected: false,

     

       2174
       2174
       +
       						meeting_time_id: null,

     

       2175
       2175
       +
       						day: dayName,

     

       2176
       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       2178
       +
       					});

     

       2179
       2179
       +
       				} catch (error) {

     

       2180
       2180
       +
       					return handleError(error);

     

       2181
       2181
       +
       				}

     

       2182
       2182
       +
       			},

     

       2183
       2183
       +
       		},

     

       2184
       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       2185
       +
       			PATCH: async (req) => {

     

       2186
       2186
       +
       				try {

     

       2187
       2187
       +
       					const user = requireAuth(req);

     

       2188
       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       2189
       +
       

     

       2190
       2190
       +
       					const body = await req.json();

     

       2191
       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       2192
       +
       					const sectionId = body.section_id;

     

       2193
       2193
       +
       

     

       2194
       2194
       +
       					if (!meetingTimeId) {

     

       2195
       2195
       +
       						return Response.json(

     

       2196
       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       2197
       +
       							{ status: 400 },

     

       2198
       2198
       +
       						);

     

       2199
       2199
       +
       					}

     

       2200
       2200
       +
       

     

       2201
       2201
       +
       					// Verify transcription ownership

     

       2202
       2202
       +
       					const transcription = db

     

       2203
       2203
       +
       						.query<

     

       2204
       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       2205
       +
       							[string]

     

       2206
       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       2207
       +
       						.get(transcriptionId);

     

       2208
       2208
       +
       

     

       2209
       2209
       +
       					if (!transcription) {

     

       2210
       2210
       +
       						return Response.json(

     

       2211
       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       2212
       +
       							{ status: 404 },

     

       2213
       2213
       +
       						);

     

       2214
       2214
       +
       					}

     

       2215
       2215
       +
       

     

       2216
       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       2218
       +
       					}

     

       2219
       2219
       +
       

     

       2220
       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       2221
       +
       					if (transcription.class_id) {

     

       2222
       2222
       +
       						const meetingTime = db

     

       2223
       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       2225
       +
       							)

     

       2226
       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       2227
       +
       

     

       2228
       2228
       +
       						if (!meetingTime) {

     

       2229
       2229
       +
       							return Response.json(

     

       2230
       2230
       +
       								{

     

       2231
       2231
       +
       									error:

     

       2232
       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       2233
       +
       								},

     

       2234
       2234
       +
       								{ status: 400 },

     

       2235
       2235
       +
       							);

     

       2236
       2236
       +
       						}

     

       2237
       2237
       +
       					}

     

       2238
       2238
       +
       

     

       2239
       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       2241
       +
       						db.run(

     

       2242
       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       2244
       +
       						);

     

       2245
       2245
       +
       					} else {

     

       2246
       2246
       +
       						db.run(

     

       2247
       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       2249
       +
       						);

     

       2250
       2250
       +
       					}

     

       2251
       2251
       +
       

     

       2252
       2252
       +
       					return Response.json({

     

       2253
       2253
       +
       						success: true,

     

       2254
       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       2255
       +
       					});

     

       2256
       2256
       +
       				} catch (error) {

     

       2257
       2257
       +
       					return handleError(error);

     

       2258
       2258
       +
       				}

     

       2259
       2259
       +
       			},

     

       2260
       2260
       +
       		},

     

       2261
       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       1963
       2262
        
       			GET: async (req) => {

     

       1964
       2263
        
       				try {

     

       1965
       1965
       -
       					const user = requireSubscription(req);

     

       2264
       2264
       +
       					const user = requireAuth(req);

     

       2265
       2265
       +
       					const classId = req.params.classId;

     

       2266
       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       1966
       2267
        
       

     

       1967
       1967
       -
       					const transcriptions = db

     

       2268
       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       2271
       +
       						return Response.json(

     

       2272
       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       2273
       +
       							{ status: 403 },

     

       2274
       2274
       +
       						);

     

       2275
       2275
       +
       					}

     

       2276
       2276
       +
       

     

       2277
       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       2278
       +
       					const url = new URL(req.url);

     

       2279
       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       2280
       +
       					const sectionFilter =

     

       2281
       2281
       +
       						sectionParam !== null

     

       2282
       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       2283
       +
       							: user.role === "admin"

     

       2284
       2284
       +
       								? null

     

       2285
       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
       2286
       +
       

     

       2287
       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       2288
       +
       						classId,

     

       2289
       2289
       +
       						meetingTimeId,

     

       2290
       2290
       +
       						sectionFilter,

     

       2291
       2291
       +
       					);

     

       2292
       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       2294
       +
       						user.id,

     

       2295
       2295
       +
       						classId,

     

       2296
       2296
       +
       						meetingTimeId,

     

       2297
       2297
       +
       					);

     

       2298
       2298
       +
       

     

       2299
       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       2301
       +
       						classId,

     

       2302
       2302
       +
       						meetingTimeId,

     

       2303
       2303
       +
       						sectionFilter,

     

       2304
       2304
       +
       					);

     

       2305
       2305
       +
       

     

       2306
       2306
       +
       					return Response.json({

     

       2307
       2307
       +
       						recordings,

     

       2308
       2308
       +
       						total_users: totalUsers,

     

       2309
       2309
       +
       						user_vote: userVote,

     

       2310
       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       2311
       +
       						winning_recording_id: winningId,

     

       2312
       2312
       +
       					});

     

       2313
       2313
       +
       				} catch (error) {

     

       2314
       2314
       +
       					return handleError(error);

     

       2315
       2315
       +
       				}

     

       2316
       2316
       +
       			},

     

       2317
       2317
       +
       		},

     

       2318
       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       2319
       +
       			POST: async (req) => {

     

       2320
       2320
       +
       				try {

     

       2321
       2321
       +
       					const user = requireAuth(req);

     

       2322
       2322
       +
       					const recordingId = req.params.id;

     

       2323
       2323
       +
       

     

       2324
       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       2325
       +
       					const recording = db

     

       1968
       2326
        
       						.query<

     

       1969
       1969
       -
       							{

     

       1970
       1970
       -
       								id: string;

     

       1971
       1971
       -
       								filename: string;

     

       1972
       1972
       -
       								original_filename: string;

     

       1973
       1973
       -
       								class_id: string | null;

     

       1974
       1974
       -
       								status: string;

     

       1975
       1975
       -
       								progress: number;

     

       1976
       1976
       -
       								created_at: number;

     

       1977
       1977
       -
       							},

     

       1978
       1978
       -
       							[number]

     

       2327
       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       2328
       +
       							[string]

     

       1979
       2329
        
       						>(

     

       1980
       1980
       -
       							"SELECT id, filename, original_filename, class_id, status, progress, created_at FROM transcriptions WHERE user_id = ? ORDER BY created_at DESC",

     

       2330
       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       1981
       2331
        
       						)

     

       1982
       1982
       -
       						.all(user.id);

     

       2332
       2332
       +
       						.get(recordingId);

     

       2333
       2333
       +
       

     

       2334
       2334
       +
       					if (!recording) {

     

       2335
       2335
       +
       						return Response.json(

     

       2336
       2336
       +
       							{ error: "Recording not found" },

     

       2337
       2337
       +
       							{ status: 404 },

     

       2338
       2338
       +
       						);

     

       2339
       2339
       +
       					}

     

       2340
       2340
       +
       

     

       2341
       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       2342
       +
       						return Response.json(

     

       2343
       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       2344
       +
       							{ status: 400 },

     

       2345
       2345
       +
       						);

     

       2346
       2346
       +
       					}

     

       2347
       2347
       +
       

     

       2348
       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       2350
       +
       						return Response.json(

     

       2351
       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       2352
       +
       							{ status: 403 },

     

       2353
       2353
       +
       						);

     

       2354
       2354
       +
       					}

     

       2355
       2355
       +
       

     

       2356
       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       2358
       +
       						user.id,

     

       2359
       2359
       +
       						recording.class_id,

     

       2360
       2360
       +
       						recording.meeting_time_id,

     

       2361
       2361
       +
       					);

     

       2362
       2362
       +
       					if (existingVote) {

     

       2363
       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       2364
       +
       					}

     

       2365
       2365
       +
       

     

       2366
       2366
       +
       					// Add new vote

     

       2367
       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       2368
       +
       

     

       2369
       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       2370
       +
       					const userSection =

     

       2371
       2371
       +
       						user.role === "admin"

     

       2372
       2372
       +
       							? null

     

       2373
       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       2374
       +
       

     

       2375
       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       2377
       +
       						recording.class_id,

     

       2378
       2378
       +
       						recording.meeting_time_id,

     

       2379
       2379
       +
       						userSection,

     

       2380
       2380
       +
       					);

     

       2381
       2381
       +
       					if (winningId) {

     

       2382
       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       2383
       +
       						// Start transcription

     

       2384
       2384
       +
       						const winningRecording = db

     

       2385
       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       2387
       +
       							)

     

       2388
       2388
       +
       							.get(winningId);

     

       2389
       2389
       +
       						if (winningRecording) {

     

       2390
       2390
       +
       							whisperService.startTranscription(

     

       2391
       2391
       +
       								winningId,

     

       2392
       2392
       +
       								winningRecording.filename,

     

       2393
       2393
       +
       							);

     

       2394
       2394
       +
       						}

     

       2395
       2395
       +
       					}

     

       2396
       2396
       +
       

     

       2397
       2397
       +
       					return Response.json({

     

       2398
       2398
       +
       						success,

     

       2399
       2399
       +
       						winning_recording_id: winningId,

     

       2400
       2400
       +
       					});

     

       2401
       2401
       +
       				} catch (error) {

     

       2402
       2402
       +
       					return handleError(error);

     

       2403
       2403
       +
       				}

     

       2404
       2404
       +
       			},

     

       2405
       2405
       +
       		},

     

       2406
       2406
       +
       		"/api/recordings/:id": {

     

       2407
       2407
       +
       			DELETE: async (req) => {

     

       2408
       2408
       +
       				try {

     

       2409
       2409
       +
       					const user = requireAuth(req);

     

       2410
       2410
       +
       					const recordingId = req.params.id;

     

       2411
       2411
       +
       

     

       2412
       2412
       +
       					const success = deletePendingRecording(

     

       2413
       2413
       +
       						recordingId,

     

       2414
       2414
       +
       						user.id,

     

       2415
       2415
       +
       						user.role === "admin",

     

       2416
       2416
       +
       					);

     

       2417
       2417
       +
       

     

       2418
       2418
       +
       					if (!success) {

     

       2419
       2419
       +
       						return Response.json(

     

       2420
       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       2421
       +
       							{ status: 403 },

     

       2422
       2422
       +
       						);

     

       2423
       2423
       +
       					}

     

       2424
       2424
       +
       

     

       2425
       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       2426
       +
       				} catch (error) {

     

       2427
       2427
       +
       					return handleError(error);

     

       2428
       2428
       +
       				}

     

       2429
       2429
       +
       			},

     

       2430
       2430
       +
       		},

     

       2431
       2431
       +
       		"/api/transcriptions": {

     

       2432
       2432
       +
       			GET: async (req) => {

     

       2433
       2433
       +
       				try {

     

       2434
       2434
       +
       					const user = requireSubscription(req);

     

       2435
       2435
       +
       					const url = new URL(req.url);

     

       2436
       2436
       +
       

     

       2437
       2437
       +
       					// Parse pagination params

     

       2438
       2438
       +
       					const limit = Math.min(

     

       2439
       2439
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2440
       2440
       +
       						100,

     

       2441
       2441
       +
       					);

     

       2442
       2442
       +
       					const cursorParam = url.searchParams.get("cursor");

     

       2443
       2443
       +
       

     

       2444
       2444
       +
       					let transcriptions: Array<{

     

       2445
       2445
       +
       						id: string;

     

       2446
       2446
       +
       						filename: string;

     

       2447
       2447
       +
       						original_filename: string;

     

       2448
       2448
       +
       						class_id: string | null;

     

       2449
       2449
       +
       						status: string;

     

       2450
       2450
       +
       						progress: number;

     

       2451
       2451
       +
       						created_at: number;

     

       2452
       2452
       +
       					}>;

     

       2453
       2453
       +
       

     

       2454
       2454
       +
       					if (cursorParam) {

     

       2455
       2455
       +
       						// Decode cursor

     

       2456
       2456
       +
       						const { decodeCursor } = await import("./lib/cursor");

     

       2457
       2457
       +
       						const parts = decodeCursor(cursorParam);

     

       2458
       2458
       +
       

     

       2459
       2459
       +
       						if (parts.length !== 2) {

     

       2460
       2460
       +
       							return Response.json(

     

       2461
       2461
       +
       								{ error: "Invalid cursor format" },

     

       2462
       2462
       +
       								{ status: 400 },

     

       2463
       2463
       +
       							);

     

       2464
       2464
       +
       						}

     

       2465
       2465
       +
       

     

       2466
       2466
       +
       						const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       2467
       2467
       +
       						const id = parts[1] || "";

     

       2468
       2468
       +
       

     

       2469
       2469
       +
       						if (Number.isNaN(cursorTime) || !id) {

     

       2470
       2470
       +
       							return Response.json(

     

       2471
       2471
       +
       								{ error: "Invalid cursor format" },

     

       2472
       2472
       +
       								{ status: 400 },

     

       2473
       2473
       +
       							);

     

       2474
       2474
       +
       						}

     

       2475
       2475
       +
       

     

       2476
       2476
       +
       						transcriptions = db

     

       2477
       2477
       +
       							.query<

     

       2478
       2478
       +
       								{

     

       2479
       2479
       +
       									id: string;

     

       2480
       2480
       +
       									filename: string;

     

       2481
       2481
       +
       									original_filename: string;

     

       2482
       2482
       +
       									class_id: string | null;

     

       2483
       2483
       +
       									status: string;

     

       2484
       2484
       +
       									progress: number;

     

       2485
       2485
       +
       									created_at: number;

     

       2486
       2486
       +
       								},

     

       2487
       2487
       +
       								[number, number, string, number]

     

       2488
       2488
       +
       							>(

     

       2489
       2489
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2490
       2490
       +
       								FROM transcriptions 

     

       2491
       2491
       +
       								WHERE user_id = ? AND (created_at < ? OR (created_at = ? AND id < ?))

     

       2492
       2492
       +
       								ORDER BY created_at DESC, id DESC 

     

       2493
       2493
       +
       								LIMIT ?`,

     

       2494
       2494
       +
       							)

     

       2495
       2495
       +
       							.all(user.id, cursorTime, cursorTime, id, limit + 1);

     

       2496
       2496
       +
       					} else {

     

       2497
       2497
       +
       						transcriptions = db

     

       2498
       2498
       +
       							.query<

     

       2499
       2499
       +
       								{

     

       2500
       2500
       +
       									id: string;

     

       2501
       2501
       +
       									filename: string;

     

       2502
       2502
       +
       									original_filename: string;

     

       2503
       2503
       +
       									class_id: string | null;

     

       2504
       2504
       +
       									status: string;

     

       2505
       2505
       +
       									progress: number;

     

       2506
       2506
       +
       									created_at: number;

     

       2507
       2507
       +
       								},

     

       2508
       2508
       +
       								[number, number]

     

       2509
       2509
       +
       							>(

     

       2510
       2510
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2511
       2511
       +
       								FROM transcriptions 

     

       2512
       2512
       +
       								WHERE user_id = ? 

     

       2513
       2513
       +
       								ORDER BY created_at DESC, id DESC 

     

       2514
       2514
       +
       								LIMIT ?`,

     

       2515
       2515
       +
       							)

     

       2516
       2516
       +
       							.all(user.id, limit + 1);

     

       2517
       2517
       +
       					}

     

       2518
       2518
       +
       

     

       2519
       2519
       +
       					// Check if there are more results

     

       2520
       2520
       +
       					const hasMore = transcriptions.length > limit;

     

       2521
       2521
       +
       					if (hasMore) {

     

       2522
       2522
       +
       						transcriptions.pop(); // Remove extra item

     

       2523
       2523
       +
       					}

     

       2524
       2524
       +
       

     

       2525
       2525
       +
       					// Build next cursor

     

       2526
       2526
       +
       					let nextCursor: string | null = null;

     

       2527
       2527
       +
       					if (hasMore && transcriptions.length > 0) {

     

       2528
       2528
       +
       						const { encodeCursor } = await import("./lib/cursor");

     

       2529
       2529
       +
       						const last = transcriptions[transcriptions.length - 1];

     

       2530
       2530
       +
       						if (last) {

     

       2531
       2531
       +
       							nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       2532
       2532
       +
       						}

     

       2533
       2533
       +
       					}

     

       1983
       2534
        
       

     

       1984
       2535
        
       					// Load transcripts from files for completed jobs

     

       1985
       2536
        
       					const jobs = await Promise.all(

     
···

       1995
       2546
        
       						}),

     

       1996
       2547
        
       					);

     

       1997
       2548
        
       

     

       1998
       1998
       -
       					return Response.json({ jobs });

     

       2549
       2549
       +
       					return Response.json({

     

       2550
       2550
       +
       						jobs,

     

       2551
       2551
       +
       						pagination: {

     

       2552
       2552
       +
       							limit,

     

       2553
       2553
       +
       							hasMore,

     

       2554
       2554
       +
       							nextCursor,

     

       2555
       2555
       +
       						},

     

       2556
       2556
       +
       					});

     

       1999
       2557
        
       				} catch (error) {

     

       2000
       2558
        
       					return handleError(error);

     

       2001
       2559
        
       				}

     
···

       2004
       2562
        
       				try {

     

       2005
       2563
        
       					const user = requireSubscription(req);

     

       2006
       2564
        
       

     

       2565
       2565
       +
       					const rateLimitError = enforceRateLimit(req, "upload-transcription", {

     

       2566
       2566
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       2567
       2567
       +
       					});

     

       2568
       2568
       +
       					if (rateLimitError) return rateLimitError;

     

       2569
       2569
       +
       

     

       2007
       2570
        
       					const formData = await req.formData();

     

       2008
       2571
        
       					const file = formData.get("audio") as File;

     

       2009
       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       2010
       2010
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       2573
       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       2011
       2575
        
       						| string

     

       2012
       2576
        
       						| null;

     

       2013
       2577
        
       

     
···

       2076
       2640
        
       					const uploadDir = "./uploads";

     

       2077
       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       2078
       2642
        
       

     

       2079
       2079
       -
       					// Create database record

     

       2643
       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       2647
       +
       

     

       2648
       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       2080
       2649
        
       					db.run(

     

       2081
       2081
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       2650
       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       2082
       2651
        
       						[

     

       2083
       2652
        
       							transcriptionId,

     

       2084
       2653
        
       							user.id,

     

       2085
       2654
        
       							classId,

     

       2086
       2086
       -
       							meetingTimeId,

     

       2655
       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       2656
       +
       							sectionId,

     

       2087
       2657
        
       							filename,

     

       2088
       2658
        
       							file.name,

     

       2089
       2659
        
       							"pending",

     

       2660
       2660
       +
       							recordingDate,

     

       2090
       2661
        
       						],

     

       2091
       2662
        
       					);

     

       2092
       2663
        
       

     

       2093
       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       2094
       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       2095
       2666
        
       

     

       2096
       2096
       -
       					return Response.json({

     

       2097
       2097
       -
       						id: transcriptionId,

     

       2098
       2098
       -
       						message: "Upload successful",

     

       2099
       2099
       -
       					});

     

       2667
       2667
       +
       					return Response.json(

     

       2668
       2668
       +
       						{

     

       2669
       2669
       +
       							id: transcriptionId,

     

       2670
       2670
       +
       							message: "Upload successful",

     

       2671
       2671
       +
       						},

     

       2672
       2672
       +
       						{ status: 201 },

     

       2673
       2673
       +
       					);

     

       2100
       2674
        
       				} catch (error) {

     

       2101
       2675
        
       					return handleError(error);

     

       2102
       2676
        
       				}

     
···

       2106
       2680
        
       			GET: async (req) => {

     

       2107
       2681
        
       				try {

     

       2108
       2682
        
       					requireAdmin(req);

     

       2109
       2109
       -
       					const transcriptions = getAllTranscriptions();

     

       2110
       2110
       -
       					return Response.json(transcriptions);

     

       2683
       2683
       +
       					const url = new URL(req.url);

     

       2684
       2684
       +
       

     

       2685
       2685
       +
       					const limit = Math.min(

     

       2686
       2686
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2687
       2687
       +
       						100,

     

       2688
       2688
       +
       					);

     

       2689
       2689
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2690
       2690
       +
       

     

       2691
       2691
       +
       					const result = getAllTranscriptions(limit, cursor);

     

       2692
       2692
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       2111
       2693
        
       				} catch (error) {

     

       2112
       2694
        
       					return handleError(error);

     

       2113
       2695
        
       				}

     
···

       2117
       2699
        
       			GET: async (req) => {

     

       2118
       2700
        
       				try {

     

       2119
       2701
        
       					requireAdmin(req);

     

       2120
       2120
       -
       					const users = getAllUsersWithStats();

     

       2121
       2121
       -
       					return Response.json(users);

     

       2702
       2702
       +
       					const url = new URL(req.url);

     

       2703
       2703
       +
       

     

       2704
       2704
       +
       					const limit = Math.min(

     

       2705
       2705
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2706
       2706
       +
       						100,

     

       2707
       2707
       +
       					);

     

       2708
       2708
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2709
       2709
       +
       

     

       2710
       2710
       +
       					const result = getAllUsersWithStats(limit, cursor);

     

       2711
       2711
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       2122
       2712
        
       				} catch (error) {

     

       2123
       2713
        
       					return handleError(error);

     

       2124
       2714
        
       				}

     
···

       2152
       2742
        
       					requireAdmin(req);

     

       2153
       2743
        
       					const id = req.params.id;

     

       2154
       2744
        
       					deleteWaitlistEntry(id);

     

       2155
       2155
       -
       					return Response.json({ success: true });

     

       2745
       2745
       +
       					return new Response(null, { status: 204 });

     

       2156
       2746
        
       				} catch (error) {

     

       2157
       2747
        
       					return handleError(error);

     

       2158
       2748
        
       				}

     
···

       2164
       2754
        
       					requireAdmin(req);

     

       2165
       2755
        
       					const transcriptionId = req.params.id;

     

       2166
       2756
        
       					deleteTranscription(transcriptionId);

     

       2167
       2167
       -
       					return Response.json({ success: true });

     

       2757
       2757
       +
       					return new Response(null, { status: 204 });

     

       2168
       2758
        
       				} catch (error) {

     

       2169
       2759
        
       					return handleError(error);

     

       2170
       2760
        
       				}

     
···

       2179
       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2180
       2770
        
       					}

     

       2181
       2771
        
       					await deleteUser(userId);

     

       2182
       2182
       -
       					return Response.json({ success: true });

     

       2772
       2772
       +
       					return new Response(null, { status: 204 });

     

       2183
       2773
        
       				} catch (error) {

     

       2184
       2774
        
       					return handleError(error);

     

       2185
       2775
        
       				}

     
···

       2429
       3019
        
       

     

       2430
       3020
        
       					const { passkeyId } = req.params;

     

       2431
       3021
        
       					deletePasskey(passkeyId, userId);

     

       2432
       2432
       -
       					return Response.json({ success: true });

     

       3022
       3022
       +
       					return new Response(null, { status: 204 });

     

       2433
       3023
        
       				} catch (error) {

     

       2434
       3024
        
       					return handleError(error);

     

       2435
       3025
        
       				}

     
···

       2495
       3085
        
       					if (existing) {

     

       2496
       3086
        
       						return Response.json(

     

       2497
       3087
        
       							{ error: "Email already in use" },

     

       2498
       2498
       -
       							{ status: 400 },

     

       3088
       3088
       +
       							{ status: 409 },

     

       2499
       3089
        
       						);

     

       2500
       3090
        
       					}

     

       2501
       3091
        
       

     
···

       2508
       3098
        
       						});

     

       2509
       3099
        
       					}

     

       2510
       3100
        
       

     

       2511
       2511
       -
       					updateUserEmailAddress(userId, email);

     

       2512
       2512
       -
       					return Response.json({ success: true });

     

       3101
       3101
       +
       					// Get user's current email

     

       3102
       3102
       +
       					const user = db

     

       3103
       3103
       +
       						.query<{ email: string; name: string | null }, [number]>(

     

       3104
       3104
       +
       							"SELECT email, name FROM users WHERE id = ?",

     

       3105
       3105
       +
       						)

     

       3106
       3106
       +
       						.get(userId);

     

       3107
       3107
       +
       

     

       3108
       3108
       +
       					if (!user) {

     

       3109
       3109
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3110
       3110
       +
       					}

     

       3111
       3111
       +
       

     

       3112
       3112
       +
       					// Send verification email to user's current email

     

       3113
       3113
       +
       					try {

     

       3114
       3114
       +
       						const token = createEmailChangeToken(userId, email);

     

       3115
       3115
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       3116
       3116
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       3117
       3117
       +
       

     

       3118
       3118
       +
       						await sendEmail({

     

       3119
       3119
       +
       							to: user.email,

     

       3120
       3120
       +
       							subject: "Verify your email change",

     

       3121
       3121
       +
       							html: emailChangeTemplate({

     

       3122
       3122
       +
       								name: user.name,

     

       3123
       3123
       +
       								currentEmail: user.email,

     

       3124
       3124
       +
       								newEmail: email,

     

       3125
       3125
       +
       								verifyLink: verifyUrl,

     

       3126
       3126
       +
       							}),

     

       3127
       3127
       +
       						});

     

       3128
       3128
       +
       

     

       3129
       3129
       +
       						return Response.json({

     

       3130
       3130
       +
       							success: true,

     

       3131
       3131
       +
       							message: `Verification email sent to ${user.email}`,

     

       3132
       3132
       +
       							pendingEmail: email,

     

       3133
       3133
       +
       						});

     

       3134
       3134
       +
       					} catch (emailError) {

     

       3135
       3135
       +
       						console.error(

     

       3136
       3136
       +
       							"[Admin] Failed to send email change verification:",

     

       3137
       3137
       +
       							emailError,

     

       3138
       3138
       +
       						);

     

       3139
       3139
       +
       						return Response.json(

     

       3140
       3140
       +
       							{ error: "Failed to send verification email" },

     

       3141
       3141
       +
       							{ status: 500 },

     

       3142
       3142
       +
       						);

     

       3143
       3143
       +
       					}

     

       2513
       3144
        
       				} catch (error) {

     

       2514
       3145
        
       					return handleError(error);

     

       2515
       3146
        
       				}

     
···

       2539
       3170
        
       					}

     

       2540
       3171
        
       

     

       2541
       3172
        
       					deleteAllUserSessions(userId);

     

       2542
       2542
       -
       					return Response.json({ success: true });

     

       3173
       3173
       +
       					return new Response(null, { status: 204 });

     

       2543
       3174
        
       				} catch (error) {

     

       2544
       3175
        
       					return handleError(error);

     

       2545
       3176
        
       				}

     
···

       2564
       3195
        
       						);

     

       2565
       3196
        
       					}

     

       2566
       3197
        
       

     

       2567
       2567
       -
       					return Response.json({ success: true });

     

       3198
       3198
       +
       					return new Response(null, { status: 204 });

     

       2568
       3199
        
       				} catch (error) {

     

       2569
       3200
        
       					return handleError(error);

     

       2570
       3201
        
       				}

     
···

       2626
       3257
        
       			GET: async (req) => {

     

       2627
       3258
        
       				try {

     

       2628
       3259
        
       					const user = requireAuth(req);

     

       2629
       2629
       -
       					const classes = getClassesForUser(user.id, user.role === "admin");

     

       3260
       3260
       +
       					const url = new URL(req.url);

     

       3261
       3261
       +
       

     

       3262
       3262
       +
       					const limit = Math.min(

     

       3263
       3263
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       3264
       3264
       +
       						100,

     

       3265
       3265
       +
       					);

     

       3266
       3266
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2630
       3267
        
       

     

       2631
       2631
       -
       					// Group by semester/year

     

       3268
       3268
       +
       					const result = getClassesForUser(

     

       3269
       3269
       +
       						user.id,

     

       3270
       3270
       +
       						user.role === "admin",

     

       3271
       3271
       +
       						limit,

     

       3272
       3272
       +
       						cursor,

     

       3273
       3273
       +
       					);

     

       3274
       3274
       +
       

     

       3275
       3275
       +
       					// Group by semester/year for all users

     

       2632
       3276
        
       					const grouped: Record<

     

       2633
       3277
        
       						string,

     

       2634
       3278
        
       						Array<{

     
···

       2642
       3286
        
       						}>

     

       2643
       3287
        
       					> = {};

     

       2644
       3288
        
       

     

       2645
       2645
       -
       					for (const cls of classes) {

     

       3289
       3289
       +
       					for (const cls of result.data) {

     

       2646
       3290
        
       						const key = `${cls.semester} ${cls.year}`;

     

       2647
       3291
        
       						if (!grouped[key]) {

     

       2648
       3292
        
       							grouped[key] = [];

     
···

       2658
       3302
        
       						});

     

       2659
       3303
        
       					}

     

       2660
       3304
        
       

     

       2661
       2661
       -
       					return Response.json({ classes: grouped });

     

       3305
       3305
       +
       					return Response.json({

     

       3306
       3306
       +
       						classes: grouped,

     

       3307
       3307
       +
       						pagination: result.pagination,

     

       3308
       3308
       +
       					});

     

       2662
       3309
        
       				} catch (error) {

     

       2663
       3310
        
       					return handleError(error);

     

       2664
       3311
        
       				}

     
···

       2724
       3371
        
       						semester,

     

       2725
       3372
        
       						year,

     

       2726
       3373
        
       						meeting_times,

     

       3374
       3374
       +
       						sections: body.sections,

     

       2727
       3375
        
       					});

     

       2728
       3376
        
       

     

       2729
       2729
       -
       					return Response.json(newClass);

     

       3377
       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       2730
       3378
        
       				} catch (error) {

     

       2731
       3379
        
       					return handleError(error);

     

       2732
       3380
        
       				}

     
···

       2753
       3401
        
       						.all(user.id)

     

       2754
       3402
        
       						.map((row) => row.class_id);

     

       2755
       3403
        
       

     

       2756
       2756
       -
       					// Add is_enrolled flag to each class

     

       3404
       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       2757
       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       2758
       3406
        
       						...cls,

     

       2759
       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       3408
       +
       						sections: getClassSections(cls.id),

     

       2760
       3409
        
       					}));

     

       2761
       3410
        
       

     

       2762
       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       2771
       3420
        
       					const user = requireAuth(req);

     

       2772
       3421
        
       					const body = await req.json();

     

       2773
       3422
        
       					const classId = body.class_id;

     

       3423
       3423
       +
       					const sectionId = body.section_id || null;

     

       2774
       3424
        
       

     

       2775
       3425
        
       					const classIdValidation = validateClassId(classId);

     

       2776
       3426
        
       					if (!classIdValidation.valid) {

     
···

       2780
       3430
        
       						);

     

       2781
       3431
        
       					}

     

       2782
       3432
        
       

     

       2783
       2783
       -
       					const result = joinClass(classId, user.id);

     

       3433
       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       2784
       3434
        
       

     

       2785
       3435
        
       					if (!result.success) {

     

       2786
       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       2787
       3437
        
       					}

     

       2788
       3438
        
       

     

       2789
       2789
       -
       					return Response.json({ success: true });

     

       3439
       3439
       +
       					return new Response(null, { status: 204 });

     

       2790
       3440
        
       				} catch (error) {

     

       2791
       3441
        
       					return handleError(error);

     

       2792
       3442
        
       				}

     
···

       2862
       3512
        
       						meetingTimes || null,

     

       2863
       3513
        
       					);

     

       2864
       3514
        
       

     

       2865
       2865
       -
       					return Response.json({ success: true, id });

     

       3515
       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       2866
       3516
        
       				} catch (error) {

     

       2867
       3517
        
       					return handleError(error);

     

       2868
       3518
        
       				}

     
···

       2889
       3539
        
       					}

     

       2890
       3540
        
       

     

       2891
       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       3542
       +
       					const sections = getClassSections(classId);

     

       2892
       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       2893
       3545
        
       

     

       2894
       3546
        
       					return Response.json({

     

       2895
       3547
        
       						class: classInfo,

     

       2896
       3548
        
       						meetingTimes,

     

       3549
       3549
       +
       						sections,

     

       3550
       3550
       +
       						userSection,

     

       2897
       3551
        
       						transcriptions,

     

       2898
       3552
        
       					});

     

       2899
       3553
        
       				} catch (error) {

     
···

       2905
       3559
        
       					requireAdmin(req);

     

       2906
       3560
        
       					const classId = req.params.id;

     

       2907
       3561
        
       

     

       3562
       3562
       +
       					// Verify class exists

     

       3563
       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       3564
       +
       					if (!existingClass) {

     

       3565
       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       3566
       +
       					}

     

       3567
       3567
       +
       

     

       2908
       3568
        
       					deleteClass(classId);

     

       2909
       2909
       -
       					return Response.json({ success: true });

     

       3569
       3569
       +
       					return new Response(null, { status: 204 });

     

       2910
       3570
        
       				} catch (error) {

     

       2911
       3571
        
       					return handleError(error);

     

       2912
       3572
        
       				}

     
···

       2927
       3587
        
       						);

     

       2928
       3588
        
       					}

     

       2929
       3589
        
       

     

       3590
       3590
       +
       					// Verify class exists

     

       3591
       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       3592
       +
       					if (!existingClass) {

     

       3593
       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
       3594
       +
       					}

     

       3595
       3595
       +
       

     

       2930
       3596
        
       					toggleClassArchive(classId, archived);

     

       2931
       2931
       -
       					return Response.json({ success: true });

     

       3597
       3597
       +
       					return new Response(null, { status: 204 });

     

       2932
       3598
        
       				} catch (error) {

     

       2933
       3599
        
       					return handleError(error);

     

       2934
       3600
        
       				}

     
···

       2957
       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       2958
       3624
        
       					}

     

       2959
       3625
        
       

     

       3626
       3626
       +
       					// Verify class exists

     

       3627
       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       3628
       +
       					if (!existingClass) {

     

       3629
       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       3630
       +
       					}

     

       3631
       3631
       +
       

     

       2960
       3632
        
       					const user = getUserByEmail(email);

     

       2961
       3633
        
       					if (!user) {

     

       2962
       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       2963
       3635
        
       					}

     

       2964
       3636
        
       

     

       2965
       3637
        
       					enrollUserInClass(user.id, classId);

     

       2966
       2966
       -
       					return Response.json({ success: true });

     

       3638
       3638
       +
       					return new Response(null, { status: 201 });

     

       2967
       3639
        
       				} catch (error) {

     

       2968
       3640
        
       					return handleError(error);

     

       2969
       3641
        
       				}

     
···

       2980
       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2981
       3653
        
       					}

     

       2982
       3654
        
       

     

       3655
       3655
       +
       					// Verify class exists

     

       3656
       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       3657
       +
       					if (!existingClass) {

     

       3658
       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       3659
       +
       					}

     

       3660
       3660
       +
       

     

       2983
       3661
        
       					removeUserFromClass(userId, classId);

     

       2984
       2984
       -
       					return Response.json({ success: true });

     

       3662
       3662
       +
       					return new Response(null, { status: 204 });

     

       2985
       3663
        
       				} catch (error) {

     

       2986
       3664
        
       					return handleError(error);

     

       2987
       3665
        
       				}

     
···

       3019
       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3020
       3698
        
       					}

     

       3021
       3699
        
       

     

       3700
       3700
       +
       					// Verify class exists

     

       3701
       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       3702
       +
       					if (!existingClass) {

     

       3703
       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       3704
       +
       					}

     

       3705
       3705
       +
       

     

       3022
       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       3023
       3023
       -
       					return Response.json(meetingTime);

     

       3707
       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       3708
       +
       				} catch (error) {

     

       3709
       3709
       +
       					return handleError(error);

     

       3710
       3710
       +
       				}

     

       3711
       3711
       +
       			},

     

       3712
       3712
       +
       		},

     

       3713
       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       3714
       +
       			POST: async (req) => {

     

       3715
       3715
       +
       				try {

     

       3716
       3716
       +
       					requireAdmin(req);

     

       3717
       3717
       +
       					const classId = req.params.id;

     

       3718
       3718
       +
       					const body = await req.json();

     

       3719
       3719
       +
       					const { section_number } = body;

     

       3720
       3720
       +
       

     

       3721
       3721
       +
       					if (!section_number) {

     

       3722
       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       3723
       +
       					}

     

       3724
       3724
       +
       

     

       3725
       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       3726
       +
       					return Response.json(section);

     

       3727
       3727
       +
       				} catch (error) {

     

       3728
       3728
       +
       					return handleError(error);

     

       3729
       3729
       +
       				}

     

       3730
       3730
       +
       			},

     

       3731
       3731
       +
       		},

     

       3732
       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       3733
       +
       			DELETE: async (req) => {

     

       3734
       3734
       +
       				try {

     

       3735
       3735
       +
       					requireAdmin(req);

     

       3736
       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       3737
       +
       

     

       3738
       3738
       +
       					// Check if any students are in this section

     

       3739
       3739
       +
       					const studentsInSection = db

     

       3740
       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       3742
       +
       						)

     

       3743
       3743
       +
       						.get(sectionId);

     

       3744
       3744
       +
       

     

       3745
       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       3746
       +
       						return Response.json(

     

       3747
       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       3748
       +
       							{ status: 400 },

     

       3749
       3749
       +
       						);

     

       3750
       3750
       +
       					}

     

       3751
       3751
       +
       

     

       3752
       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       3753
       +
       					return new Response(null, { status: 204 });

     

       3024
       3754
        
       				} catch (error) {

     

       3025
       3755
        
       					return handleError(error);

     

       3026
       3756
        
       				}

     
···

       3038
       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3039
       3769
        
       					}

     

       3040
       3770
        
       

     

       3771
       3771
       +
       					// Verify meeting exists

     

       3772
       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       3773
       +
       					if (!existingMeeting) {

     

       3774
       3774
       +
       						return Response.json(

     

       3775
       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       3776
       +
       							{ status: 404 },

     

       3777
       3777
       +
       						);

     

       3778
       3778
       +
       					}

     

       3779
       3779
       +
       

     

       3041
       3780
        
       					updateMeetingTime(meetingId, label);

     

       3042
       3042
       -
       					return Response.json({ success: true });

     

       3781
       3781
       +
       					return new Response(null, { status: 204 });

     

       3043
       3782
        
       				} catch (error) {

     

       3044
       3783
        
       					return handleError(error);

     

       3045
       3784
        
       				}

     
···

       3049
       3788
        
       					requireAdmin(req);

     

       3050
       3789
        
       					const meetingId = req.params.id;

     

       3051
       3790
        
       

     

       3791
       3791
       +
       					// Verify meeting exists

     

       3792
       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       3793
       +
       					if (!existingMeeting) {

     

       3794
       3794
       +
       						return Response.json(

     

       3795
       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       3796
       +
       							{ status: 404 },

     

       3797
       3797
       +
       						);

     

       3798
       3798
       +
       					}

     

       3799
       3799
       +
       

     

       3052
       3800
        
       					deleteMeetingTime(meetingId);

     

       3053
       3053
       -
       					return Response.json({ success: true });

     

       3801
       3801
       +
       					return new Response(null, { status: 204 });

     

       3054
       3802
        
       				} catch (error) {

     

       3055
       3803
        
       					return handleError(error);

     

       3056
       3804
        
       				}

     
···

       3062
       3810
        
       					requireAdmin(req);

     

       3063
       3811
        
       					const transcriptId = req.params.id;

     

       3064
       3812
        
       

     

       3065
       3065
       -
       					// Update status to 'selected' and start transcription

     

       3066
       3066
       -
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     

       3067
       3067
       -
       						"selected",

     

       3068
       3068
       -
       						transcriptId,

     

       3069
       3069
       -
       					]);

     

       3070
       3070
       -
       

     

       3071
       3071
       -
       					// Get filename to start transcription

     

       3813
       3813
       +
       					// Check if transcription exists and get its current status

     

       3072
       3814
        
       					const transcription = db

     

       3073
       3073
       -
       						.query<{ filename: string }, [string]>(

     

       3074
       3074
       -
       							"SELECT filename FROM transcriptions WHERE id = ?",

     

       3815
       3815
       +
       						.query<{ filename: string; status: string }, [string]>(

     

       3816
       3816
       +
       							"SELECT filename, status FROM transcriptions WHERE id = ?",

     

       3075
       3817
        
       						)

     

       3076
       3818
        
       						.get(transcriptId);

     

       3077
       3819
        
       

     

       3078
       3078
       -
       					if (transcription) {

     

       3079
       3079
       -
       						whisperService.startTranscription(

     

       3080
       3080
       -
       							transcriptId,

     

       3081
       3081
       -
       							transcription.filename,

     

       3820
       3820
       +
       					if (!transcription) {

     

       3821
       3821
       +
       						return Response.json(

     

       3822
       3822
       +
       							{ error: "Transcription not found" },

     

       3823
       3823
       +
       							{ status: 404 },

     

       3082
       3824
        
       						);

     

       3083
       3825
        
       					}

     

       3084
       3826
        
       

     

       3085
       3085
       -
       					return Response.json({ success: true });

     

       3827
       3827
       +
       					// Validate that status is appropriate for selection (e.g., 'uploading' or 'pending')

     

       3828
       3828
       +
       					const validStatuses = ["uploading", "pending", "failed"];

     

       3829
       3829
       +
       					if (!validStatuses.includes(transcription.status)) {

     

       3830
       3830
       +
       						return Response.json(

     

       3831
       3831
       +
       							{

     

       3832
       3832
       +
       								error: `Cannot select transcription with status: ${transcription.status}`,

     

       3833
       3833
       +
       							},

     

       3834
       3834
       +
       							{ status: 400 },

     

       3835
       3835
       +
       						);

     

       3836
       3836
       +
       					}

     

       3837
       3837
       +
       

     

       3838
       3838
       +
       					// Update status to 'selected' and start transcription

     

       3839
       3839
       +
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     

       3840
       3840
       +
       						"selected",

     

       3841
       3841
       +
       						transcriptId,

     

       3842
       3842
       +
       					]);

     

       3843
       3843
       +
       

     

       3844
       3844
       +
       					whisperService.startTranscription(

     

       3845
       3845
       +
       						transcriptId,

     

       3846
       3846
       +
       						transcription.filename,

     

       3847
       3847
       +
       					);

     

       3848
       3848
       +
       

     

       3849
       3849
       +
       					return new Response(null, { status: 204 });

     

       3086
       3850
        
       				} catch (error) {

     

       3087
       3851
        
       					return handleError(error);

     

       3088
       3852
        
       				}

     

       3089
       3853
        
       			},

     

       3090
       3854
        
       		},

     

       3091
       3855
        
       	},

     

       3092
       3092
       -
       	development: {

     

       3093
       3093
       -
       		hmr: true,

     

       3094
       3094
       -
       		console: true,

     

       3856
       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       3857
       +
       	fetch(req, server) {

     

       3858
       3858
       +
       		const response = server.fetch(req);

     

       3859
       3859
       +
       

     

       3860
       3860
       +
       		// Add security headers to all responses

     

       3861
       3861
       +
       		if (response instanceof Response) {

     

       3862
       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       3867
       +
       

     

       3868
       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       3870
       +
       			headers.set(

     

       3871
       3871
       +
       				"Content-Security-Policy",

     

       3872
       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       3873
       +
       			);

     

       3874
       3874
       +
       

     

       3875
       3875
       +
       			return new Response(response.body, {

     

       3876
       3876
       +
       				status: response.status,

     

       3877
       3877
       +
       				statusText: response.statusText,

     

       3878
       3878
       +
       				headers,

     

       3879
       3879
       +
       			});

     

       3880
       3880
       +
       		}

     

       3881
       3881
       +
       

     

       3882
       3882
       +
       		return response;

     

       3095
       3883
        
       	},

     

       3096
       3884
        
       });

     

       3097
       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     

       3886
       3886
       +
       

     

       3887
       3887
       +
       // Track active SSE streams for graceful shutdown

     

       3888
       3888
       +
       const activeSSEStreams = new Set<ReadableStreamDefaultController>();

     

       3889
       3889
       +
       

     

       3890
       3890
       +
       // Graceful shutdown handler

     

       3891
       3891
       +
       let isShuttingDown = false;

     

       3892
       3892
       +
       

     

       3893
       3893
       +
       async function shutdown(signal: string) {

     

       3894
       3894
       +
       	if (isShuttingDown) return;

     

       3895
       3895
       +
       	isShuttingDown = true;

     

       3896
       3896
       +
       

     

       3897
       3897
       +
       	console.log(`\n${signal} received, starting graceful shutdown...`);

     

       3898
       3898
       +
       

     

       3899
       3899
       +
       	// 1. Stop accepting new requests

     

       3900
       3900
       +
       	console.log("[Shutdown] Closing server...");

     

       3901
       3901
       +
       	server.stop();

     

       3902
       3902
       +
       

     

       3903
       3903
       +
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3904
       3904
       +
       	console.log(

     

       3905
       3905
       +
       		`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`,

     

       3906
       3906
       +
       	);

     

       3907
       3907
       +
       	for (const controller of activeSSEStreams) {

     

       3908
       3908
       +
       		try {

     

       3909
       3909
       +
       			controller.close();

     

       3910
       3910
       +
       		} catch {

     

       3911
       3911
       +
       			// Already closed

     

       3912
       3912
       +
       		}

     

       3913
       3913
       +
       	}

     

       3914
       3914
       +
       	activeSSEStreams.clear();

     

       3915
       3915
       +
       

     

       3916
       3916
       +
       	// 3. Stop transcription service (closes streams to Murmur)

     

       3917
       3917
       +
       	whisperService.stop();

     

       3918
       3918
       +
       

     

       3919
       3919
       +
       	// 4. Stop cleanup intervals

     

       3920
       3920
       +
       	console.log("[Shutdown] Stopping cleanup intervals...");

     

       3921
       3921
       +
       	clearInterval(sessionCleanupInterval);

     

       3922
       3922
       +
       	clearInterval(syncInterval);

     

       3923
       3923
       +
       	clearInterval(fileCleanupInterval);

     

       3924
       3924
       +
       

     

       3925
       3925
       +
       	// 5. Close database connections

     

       3926
       3926
       +
       	console.log("[Shutdown] Closing database...");

     

       3927
       3927
       +
       	db.close();

     

       3928
       3928
       +
       

     

       3929
       3929
       +
       	console.log("[Shutdown] Complete");

     

       3930
       3930
       +
       	process.exit(0);

     

       3931
       3931
       +
       }

     

       3932
       3932
       +
       

     

       3933
       3933
       +
       // Register shutdown handlers

     

       3934
       3934
       +
       process.on("SIGTERM", () => shutdown("SIGTERM"));

     

       3935
       3935
       +
       process.on("SIGINT", () => shutdown("SIGINT"));

+136

src/lib/api-response-format.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * API Response Format Standards

     

       5
       5
       +
        *

     

       6
       6
       +
        * This test documents the standardized response formats across the API.

     

       7
       7
       +
        * All endpoints should follow these patterns for consistency.

     

       8
       8
       +
        */

     

       9
       9
       +
       

     

       10
       10
       +
       describe("API Response Format Standards", () => {

     

       11
       11
       +
       	test("success responses should include success: true", () => {

     

       12
       12
       +
       		// Success-only responses (no data returned)

     

       13
       13
       +
       		const successOnly = { success: true };

     

       14
       14
       +
       		expect(successOnly).toHaveProperty("success", true);

     

       15
       15
       +
       

     

       16
       16
       +
       		// Success with message

     

       17
       17
       +
       		const successWithMessage = {

     

       18
       18
       +
       			success: true,

     

       19
       19
       +
       			message: "Operation completed successfully",

     

       20
       20
       +
       		};

     

       21
       21
       +
       		expect(successWithMessage).toHaveProperty("success", true);

     

       22
       22
       +
       		expect(successWithMessage).toHaveProperty("message");

     

       23
       23
       +
       

     

       24
       24
       +
       		// Success with data

     

       25
       25
       +
       		const successWithData = {

     

       26
       26
       +
       			success: true,

     

       27
       27
       +
       			data: { id: 1, name: "Test" },

     

       28
       28
       +
       		};

     

       29
       29
       +
       		expect(successWithData).toHaveProperty("success", true);

     

       30
       30
       +
       		expect(successWithData).toHaveProperty("data");

     

       31
       31
       +
       	});

     

       32
       32
       +
       

     

       33
       33
       +
       	test("error responses should use error field", () => {

     

       34
       34
       +
       		const errorResponse = { error: "Something went wrong" };

     

       35
       35
       +
       		expect(errorResponse).toHaveProperty("error");

     

       36
       36
       +
       		expect(typeof errorResponse.error).toBe("string");

     

       37
       37
       +
       	});

     

       38
       38
       +
       

     

       39
       39
       +
       	test("data responses can return data directly", () => {

     

       40
       40
       +
       		// Direct data return (common pattern for GET endpoints)

     

       41
       41
       +
       		const userData = {

     

       42
       42
       +
       			user: { id: 1, email: "test@example.com" },

     

       43
       43
       +
       			has_subscription: true,

     

       44
       44
       +
       		};

     

       45
       45
       +
       		expect(userData).toHaveProperty("user");

     

       46
       46
       +
       

     

       47
       47
       +
       		// List responses

     

       48
       48
       +
       		const listData = {

     

       49
       49
       +
       			jobs: [{ id: "1" }, { id: "2" }],

     

       50
       50
       +
       			pagination: { limit: 50, hasMore: false, nextCursor: null },

     

       51
       51
       +
       		};

     

       52
       52
       +
       		expect(listData).toHaveProperty("jobs");

     

       53
       53
       +
       		expect(listData).toHaveProperty("pagination");

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("message-only responses are converted to success+message", () => {

     

       57
       57
       +
       		// OLD (deprecated): { message: "..." }

     

       58
       58
       +
       		// NEW (standard): { success: true, message: "..." }

     

       59
       59
       +
       

     

       60
       60
       +
       		const newFormat = {

     

       61
       61
       +
       			success: true,

     

       62
       62
       +
       			message: "Verification email sent",

     

       63
       63
       +
       		};

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(newFormat).toHaveProperty("success", true);

     

       66
       66
       +
       		expect(newFormat).toHaveProperty("message");

     

       67
       67
       +
       	});

     

       68
       68
       +
       });

     

       69
       69
       +
       

     

       70
       70
       +
       describe("API Response Patterns", () => {

     

       71
       71
       +
       	test("authentication responses", () => {

     

       72
       72
       +
       		// Login success

     

       73
       73
       +
       		const login = {

     

       74
       74
       +
       			user: { id: 1, email: "test@example.com" },

     

       75
       75
       +
       			email_verification_required: false,

     

       76
       76
       +
       		};

     

       77
       77
       +
       		expect(login).toHaveProperty("user");

     

       78
       78
       +
       

     

       79
       79
       +
       		// Logout success

     

       80
       80
       +
       		const logout = { success: true };

     

       81
       81
       +
       		expect(logout.success).toBe(true);

     

       82
       82
       +
       

     

       83
       83
       +
       		// Email verified

     

       84
       84
       +
       		const verified = {

     

       85
       85
       +
       			success: true,

     

       86
       86
       +
       			message: "Email verified successfully",

     

       87
       87
       +
       			email_verified: true,

     

       88
       88
       +
       			user: { id: 1, email: "test@example.com" },

     

       89
       89
       +
       		};

     

       90
       90
       +
       		expect(verified.success).toBe(true);

     

       91
       91
       +
       		expect(verified).toHaveProperty("message");

     

       92
       92
       +
       	});

     

       93
       93
       +
       

     

       94
       94
       +
       	test("CRUD operation responses", () => {

     

       95
       95
       +
       		// Create (returns created object)

     

       96
       96
       +
       		const created = {

     

       97
       97
       +
       			id: "123",

     

       98
       98
       +
       			name: "New Item",

     

       99
       99
       +
       			created_at: Date.now(),

     

       100
       100
       +
       		};

     

       101
       101
       +
       		expect(created).toHaveProperty("id");

     

       102
       102
       +
       

     

       103
       103
       +
       		// Update (returns success)

     

       104
       104
       +
       		const updated = { success: true };

     

       105
       105
       +
       		expect(updated.success).toBe(true);

     

       106
       106
       +
       

     

       107
       107
       +
       		// Delete (returns success)

     

       108
       108
       +
       		const deleted = { success: true };

     

       109
       109
       +
       		expect(deleted.success).toBe(true);

     

       110
       110
       +
       

     

       111
       111
       +
       		// Get (returns data directly)

     

       112
       112
       +
       		const fetched = {

     

       113
       113
       +
       			id: "123",

     

       114
       114
       +
       			name: "Item",

     

       115
       115
       +
       		};

     

       116
       116
       +
       		expect(fetched).toHaveProperty("id");

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("paginated list responses", () => {

     

       120
       120
       +
       		const paginatedList = {

     

       121
       121
       +
       			data: [{ id: "1" }, { id: "2" }],

     

       122
       122
       +
       			pagination: {

     

       123
       123
       +
       				limit: 50,

     

       124
       124
       +
       				hasMore: true,

     

       125
       125
       +
       				nextCursor: "MTczMjM5NjgwMHx0cmFucy0xMjM",

     

       126
       126
       +
       			},

     

       127
       127
       +
       		};

     

       128
       128
       +
       

     

       129
       129
       +
       		expect(paginatedList).toHaveProperty("data");

     

       130
       130
       +
       		expect(Array.isArray(paginatedList.data)).toBe(true);

     

       131
       131
       +
       		expect(paginatedList).toHaveProperty("pagination");

     

       132
       132
       +
       		expect(paginatedList.pagination).toHaveProperty("limit");

     

       133
       133
       +
       		expect(paginatedList.pagination).toHaveProperty("hasMore");

     

       134
       134
       +
       		expect(paginatedList.pagination).toHaveProperty("nextCursor");

     

       135
       135
       +
       	});

     

       136
       136
       +
       });

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       3
       +
       

     

       4
       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       6
       +
       

     

       7
       7
       +
       	// Clean up test file after tests

     

       8
       8
       +
       	afterAll(async () => {

     

       9
       9
       +
       		try {

     

       10
       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       11
       +
       				if (exists) {

     

       12
       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       13
       +
       				}

     

       14
       14
       +
       			});

     

       15
       15
       +
       		} catch {

     

       16
       16
       +
       			// Ignore cleanup errors

     

       17
       17
       +
       		}

     

       18
       18
       +
       	});

     

       19
       19
       +
       

     

       20
       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       24
       +
       

     

       25
       25
       +
       		// Create the file with metadata

     

       26
       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       27
       +
       

     

       28
       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       29
       +
       

     

       30
       30
       +
       		expect(date).not.toBeNull();

     

       31
       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       34
       +
       	});

     

       35
       35
       +
       

     

       36
       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       37
       +
       		// Create audio file without metadata

     

       38
       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       39
       +
       

     

       40
       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       41
       +
       

     

       42
       42
       +
       		// Should use file modification time as fallback

     

       43
       43
       +
       		expect(date).not.toBeNull();

     

       44
       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       45
       +
       		// Should be very recent (within last minute)

     

       46
       46
       +
       		const now = new Date();

     

       47
       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       49
       +
       	});

     

       50
       50
       +
       

     

       51
       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       53
       +
       		expect(date).toBeNull();

     

       54
       54
       +
       	});

     

       55
       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	findMatchingMeetingTime,

     

       4
       4
       +
       	getDayName,

     

       5
       5
       +
       	getDayOfWeek,

     

       6
       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       7
       +
       } from "./audio-metadata";

     

       8
       8
       +
       

     

       9
       9
       +
       describe("getDayOfWeek", () => {

     

       10
       10
       +
       	test("returns correct day number", () => {

     

       11
       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       14
       +
       

     

       15
       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       18
       +
       

     

       19
       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       22
       +
       	});

     

       23
       23
       +
       });

     

       24
       24
       +
       

     

       25
       25
       +
       describe("getDayName", () => {

     

       26
       26
       +
       	test("returns correct day name", () => {

     

       27
       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       34
       +
       	});

     

       35
       35
       +
       });

     

       36
       36
       +
       

     

       37
       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       38
       +
       	test("matches full day names", () => {

     

       39
       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       42
       +
       			true,

     

       43
       43
       +
       		);

     

       44
       44
       +
       	});

     

       45
       45
       +
       

     

       46
       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       50
       +
       			true,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       56
       +
       	});

     

       57
       57
       +
       

     

       58
       58
       +
       	test("is case insensitive", () => {

     

       59
       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       62
       +
       	});

     

       63
       63
       +
       

     

       64
       64
       +
       	test("does not match wrong days", () => {

     

       65
       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       68
       +
       	});

     

       69
       69
       +
       

     

       70
       70
       +
       	test("handles labels without day names", () => {

     

       71
       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       74
       +
       	});

     

       75
       75
       +
       });

     

       76
       76
       +
       

     

       77
       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       78
       +
       	const meetingTimes = [

     

       79
       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       82
       +
       	];

     

       83
       83
       +
       

     

       84
       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       87
       +
       

     

       88
       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       90
       +
       

     

       91
       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       93
       +
       	});

     

       94
       94
       +
       

     

       95
       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       96
       +
       		const abbrevMeetingTimes = [

     

       97
       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       100
       +
       		];

     

       101
       101
       +
       

     

       102
       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("returns null when no match found", () => {

     

       107
       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       109
       +
       

     

       110
       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       112
       +
       	});

     

       113
       113
       +
       

     

       114
       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       120
       +
       		const duplicateMeetingTimes = [

     

       121
       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       123
       +
       		];

     

       124
       124
       +
       

     

       125
       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       127
       +
       	});

     

       128
       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       1
       +
       import { $ } from "bun";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       6
       +
        * @param filePath Path to audio file

     

       7
       7
       +
        * @returns Date object or null if not found

     

       8
       8
       +
        */

     

       9
       9
       +
       export async function extractAudioCreationDate(

     

       10
       10
       +
       	filePath: string,

     

       11
       11
       +
       ): Promise<Date | null> {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       14
       +
       		// -v quiet: suppress verbose output

     

       15
       15
       +
       		// -print_format json: output as JSON

     

       16
       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       17
       +
       		const result =

     

       18
       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       19
       +
       

     

       20
       20
       +
       		const metadata = JSON.parse(result);

     

       21
       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       22
       +
       

     

       23
       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       24
       +
       		const dateFields = [

     

       25
       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       26
       +
       			tags.date, // Common date field

     

       27
       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       28
       +
       			tags.year, // Year field

     

       29
       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       33
       +
       		];

     

       34
       34
       +
       

     

       35
       35
       +
       		for (const dateField of dateFields) {

     

       36
       36
       +
       			if (dateField) {

     

       37
       37
       +
       				const date = new Date(dateField);

     

       38
       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       39
       +
       					console.log(

     

       40
       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       41
       +
       					);

     

       42
       42
       +
       					return date;

     

       43
       43
       +
       				}

     

       44
       44
       +
       			}

     

       45
       45
       +
       		}

     

       46
       46
       +
       

     

       47
       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       49
       +
       		console.log(

     

       50
       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		const file = Bun.file(filePath);

     

       53
       53
       +
       		const stat = await file.stat();

     

       54
       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       55
       +
       		console.log(

     

       56
       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       57
       +
       		);

     

       58
       58
       +
       		return date;

     

       59
       59
       +
       	} catch (error) {

     

       60
       60
       +
       		console.error(

     

       61
       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       63
       +
       		);

     

       64
       64
       +
       		return null;

     

       65
       65
       +
       	}

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       72
       +
       	return date.getDay();

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       /**

     

       76
       76
       +
        * Gets day name from a date

     

       77
       77
       +
        */

     

       78
       78
       +
       export function getDayName(date: Date): string {

     

       79
       79
       +
       	const days = [

     

       80
       80
       +
       		"Sunday",

     

       81
       81
       +
       		"Monday",

     

       82
       82
       +
       		"Tuesday",

     

       83
       83
       +
       		"Wednesday",

     

       84
       84
       +
       		"Thursday",

     

       85
       85
       +
       		"Friday",

     

       86
       86
       +
       		"Saturday",

     

       87
       87
       +
       	];

     

       88
       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       89
       +
       }

     

       90
       90
       +
       

     

       91
       91
       +
       /**

     

       92
       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       94
       +
        */

     

       95
       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       96
       +
       	label: string,

     

       97
       97
       +
       	dayName: string,

     

       98
       98
       +
       ): boolean {

     

       99
       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       101
       +
       

     

       102
       102
       +
       	// Check for full day name

     

       103
       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       104
       +
       		return true;

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	// Check for 3-letter abbreviations

     

       108
       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       110
       +
       		return true;

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	return false;

     

       114
       114
       +
       }

     

       115
       115
       +
       

     

       116
       116
       +
       /**

     

       117
       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       118
       +
        * @param date Date from audio metadata

     

       119
       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       121
       +
        */

     

       122
       122
       +
       export function findMatchingMeetingTime(

     

       123
       123
       +
       	date: Date,

     

       124
       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       125
       +
       ): string | null {

     

       126
       126
       +
       	const dayName = getDayName(date);

     

       127
       127
       +
       

     

       128
       128
       +
       	// Find meeting time that matches the day

     

       129
       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       131
       +
       	);

     

       132
       132
       +
       

     

       133
       133
       +
       	if (match) {

     

       134
       134
       +
       		console.log(

     

       135
       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       136
       +
       		);

     

       137
       137
       +
       		return match.id;

     

       138
       138
       +
       	}

     

       139
       139
       +
       

     

       140
       140
       +
       	console.log(

     

       141
       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       142
       +
       	);

     

       143
       143
       +
       	return null;

     

       144
       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
       130
        
       	};

     

       131
       131
        
       	expect(typeof result.count).toBe("number");

     

       132
       132
        
       });

     

       133
       133
       +
       

     

       134
       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       135
       +
       	const userId = 999;

     

       136
       136
       +
       

     

       137
       137
       +
       	// Clean up any existing sessions for this user

     

       138
       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       139
       +
       

     

       140
       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       141
       +
       	const sessionIds: string[] = [];

     

       142
       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       144
       +
       		sessionIds.push(sessionId);

     

       145
       145
       +
       	}

     

       146
       146
       +
       

     

       147
       147
       +
       	// Count total sessions for user

     

       148
       148
       +
       	const sessionCount = db

     

       149
       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       151
       +
       		)

     

       152
       152
       +
       		.get(userId);

     

       153
       153
       +
       

     

       154
       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       155
       +
       

     

       156
       156
       +
       	// First session should be deleted (oldest)

     

       157
       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       158
       +
       	expect(firstSession).toBeNull();

     

       159
       159
       +
       

     

       160
       160
       +
       	// Last session should exist (newest)

     

       161
       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       163
       +
       

     

       164
       164
       +
       	// Cleanup

     

       165
       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       166
       +
       });

+229 -59

src/lib/auth.ts

···

       1
       1
        
       import db from "../db/schema";

     

       2
       2
        
       

     

       3
       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       4
       5
        
       

     

       5
       6
        
       export type UserRole = "user" | "admin";

     

       6
       7
        
       

     
···

       30
       31
        
       ): string {

     

       31
       32
        
       	const sessionId = crypto.randomUUID();

     

       32
       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       34
       +
       

     

       35
       35
       +
       	// Check current session count for user

     

       36
       36
       +
       	const sessionCount = db

     

       37
       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       39
       +
       		)

     

       40
       40
       +
       		.get(userId);

     

       41
       41
       +
       

     

       42
       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       45
       +
       		db.run(

     

       46
       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       47
       +
       				SELECT id FROM sessions 

     

       48
       48
       +
       				WHERE user_id = ? 

     

       49
       49
       +
       				ORDER BY created_at ASC 

     

       50
       50
       +
       				LIMIT ?

     

       51
       51
       +
       			)`,

     

       52
       52
       +
       			[userId, sessionsToDelete],

     

       53
       53
       +
       		);

     

       54
       54
       +
       	}

     

       33
       55
        
       

     

       34
       56
        
       	db.run(

     

       35
       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       482
       504
        
       		.all();

     

       483
       505
        
       }

     

       484
       506
        
       

     

       485
       485
       -
       export function getAllTranscriptions(): Array<{

     

       486
       486
       -
       	id: string;

     

       487
       487
       -
       	user_id: number;

     

       488
       488
       -
       	user_email: string;

     

       489
       489
       -
       	user_name: string | null;

     

       490
       490
       -
       	original_filename: string;

     

       491
       491
       -
       	status: string;

     

       492
       492
       -
       	created_at: number;

     

       493
       493
       -
       	error_message: string | null;

     

       494
       494
       -
       }> {

     

       495
       495
       -
       	return db

     

       496
       496
       -
       		.query<

     

       497
       497
       -
       			{

     

       498
       498
       -
       				id: string;

     

       499
       499
       -
       				user_id: number;

     

       500
       500
       -
       				user_email: string;

     

       501
       501
       -
       				user_name: string | null;

     

       502
       502
       -
       				original_filename: string;

     

       503
       503
       -
       				status: string;

     

       504
       504
       -
       				created_at: number;

     

       505
       505
       -
       				error_message: string | null;

     

       506
       506
       -
       			},

     

       507
       507
       -
       			[]

     

       508
       508
       -
       		>(

     

       509
       509
       -
       			`SELECT 

     

       510
       510
       -
               t.id, 

     

       511
       511
       -
               t.user_id, 

     

       512
       512
       -
               u.email as user_email, 

     

       513
       513
       -
               u.name as user_name, 

     

       514
       514
       -
               t.original_filename, 

     

       515
       515
       -
               t.status, 

     

       516
       516
       -
               t.created_at,

     

       517
       517
       -
               t.error_message

     

       518
       518
       -
             FROM transcriptions t

     

       519
       519
       -
             LEFT JOIN users u ON t.user_id = u.id

     

       520
       520
       -
             ORDER BY t.created_at DESC`,

     

       521
       521
       -
       		)

     

       522
       522
       -
       		.all();

     

       507
       507
       +
       export function getAllTranscriptions(

     

       508
       508
       +
       	limit = 50,

     

       509
       509
       +
       	cursor?: string,

     

       510
       510
       +
       ): {

     

       511
       511
       +
       	data: Array<{

     

       512
       512
       +
       		id: string;

     

       513
       513
       +
       		user_id: number;

     

       514
       514
       +
       		user_email: string;

     

       515
       515
       +
       		user_name: string | null;

     

       516
       516
       +
       		original_filename: string;

     

       517
       517
       +
       		status: string;

     

       518
       518
       +
       		created_at: number;

     

       519
       519
       +
       		error_message: string | null;

     

       520
       520
       +
       	}>;

     

       521
       521
       +
       	pagination: {

     

       522
       522
       +
       		limit: number;

     

       523
       523
       +
       		hasMore: boolean;

     

       524
       524
       +
       		nextCursor: string | null;

     

       525
       525
       +
       	};

     

       526
       526
       +
       } {

     

       527
       527
       +
       	type TranscriptionRow = {

     

       528
       528
       +
       		id: string;

     

       529
       529
       +
       		user_id: number;

     

       530
       530
       +
       		user_email: string;

     

       531
       531
       +
       		user_name: string | null;

     

       532
       532
       +
       		original_filename: string;

     

       533
       533
       +
       		status: string;

     

       534
       534
       +
       		created_at: number;

     

       535
       535
       +
       		error_message: string | null;

     

       536
       536
       +
       	};

     

       537
       537
       +
       

     

       538
       538
       +
       	let transcriptions: TranscriptionRow[];

     

       539
       539
       +
       

     

       540
       540
       +
       	if (cursor) {

     

       541
       541
       +
       		const { decodeCursor } = require("./cursor");

     

       542
       542
       +
       		const parts = decodeCursor(cursor);

     

       543
       543
       +
       

     

       544
       544
       +
       		if (parts.length !== 2) {

     

       545
       545
       +
       			throw new Error("Invalid cursor format");

     

       546
       546
       +
       		}

     

       547
       547
       +
       

     

       548
       548
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       549
       549
       +
       		const id = parts[1] || "";

     

       550
       550
       +
       

     

       551
       551
       +
       		if (Number.isNaN(cursorTime) || !id) {

     

       552
       552
       +
       			throw new Error("Invalid cursor format");

     

       553
       553
       +
       		}

     

       554
       554
       +
       

     

       555
       555
       +
       		transcriptions = db

     

       556
       556
       +
       			.query<TranscriptionRow, [number, number, string, number]>(

     

       557
       557
       +
       				`SELECT 

     

       558
       558
       +
       					t.id, 

     

       559
       559
       +
       					t.user_id, 

     

       560
       560
       +
       					u.email as user_email, 

     

       561
       561
       +
       					u.name as user_name, 

     

       562
       562
       +
       					t.original_filename, 

     

       563
       563
       +
       					t.status, 

     

       564
       564
       +
       					t.created_at,

     

       565
       565
       +
       					t.error_message

     

       566
       566
       +
       				FROM transcriptions t

     

       567
       567
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       568
       568
       +
       				WHERE t.created_at < ? OR (t.created_at = ? AND t.id < ?)

     

       569
       569
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       570
       570
       +
       				LIMIT ?`,

     

       571
       571
       +
       			)

     

       572
       572
       +
       			.all(cursorTime, cursorTime, id, limit + 1);

     

       573
       573
       +
       	} else {

     

       574
       574
       +
       		transcriptions = db

     

       575
       575
       +
       			.query<TranscriptionRow, [number]>(

     

       576
       576
       +
       				`SELECT 

     

       577
       577
       +
       					t.id, 

     

       578
       578
       +
       					t.user_id, 

     

       579
       579
       +
       					u.email as user_email, 

     

       580
       580
       +
       					u.name as user_name, 

     

       581
       581
       +
       					t.original_filename, 

     

       582
       582
       +
       					t.status, 

     

       583
       583
       +
       					t.created_at,

     

       584
       584
       +
       					t.error_message

     

       585
       585
       +
       				FROM transcriptions t

     

       586
       586
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       587
       587
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       588
       588
       +
       				LIMIT ?`,

     

       589
       589
       +
       			)

     

       590
       590
       +
       			.all(limit + 1);

     

       591
       591
       +
       	}

     

       592
       592
       +
       

     

       593
       593
       +
       	const hasMore = transcriptions.length > limit;

     

       594
       594
       +
       	if (hasMore) {

     

       595
       595
       +
       		transcriptions.pop();

     

       596
       596
       +
       	}

     

       597
       597
       +
       

     

       598
       598
       +
       	let nextCursor: string | null = null;

     

       599
       599
       +
       	if (hasMore && transcriptions.length > 0) {

     

       600
       600
       +
       		const { encodeCursor } = require("./cursor");

     

       601
       601
       +
       		const last = transcriptions[transcriptions.length - 1];

     

       602
       602
       +
       		if (last) {

     

       603
       603
       +
       			nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       604
       604
       +
       		}

     

       605
       605
       +
       	}

     

       606
       606
       +
       

     

       607
       607
       +
       	return {

     

       608
       608
       +
       		data: transcriptions,

     

       609
       609
       +
       		pagination: {

     

       610
       610
       +
       			limit,

     

       611
       611
       +
       			hasMore,

     

       612
       612
       +
       			nextCursor,

     

       613
       613
       +
       		},

     

       614
       614
       +
       	};

     

       523
       615
        
       }

     

       524
       616
        
       

     

       525
       617
        
       export function deleteTranscription(transcriptionId: string): void {

     
···

       605
       697
        
       	subscription_id: string | null;

     

       606
       698
        
       }

     

       607
       699
        
       

     

       608
       608
       -
       export function getAllUsersWithStats(): UserWithStats[] {

     

       609
       609
       -
       	return db

     

       610
       610
       -
       		.query<UserWithStats, []>(

     

       611
       611
       -
       			`SELECT 

     

       612
       612
       -
               u.id, 

     

       613
       613
       -
               u.email, 

     

       614
       614
       -
               u.name, 

     

       615
       615
       -
               u.avatar, 

     

       616
       616
       -
               u.created_at, 

     

       617
       617
       -
               u.role,

     

       618
       618
       -
               u.last_login,

     

       619
       619
       -
               COUNT(DISTINCT t.id) as transcription_count,

     

       620
       620
       -
               s.status as subscription_status,

     

       621
       621
       -
               s.id as subscription_id

     

       622
       622
       -
             FROM users u

     

       623
       623
       -
             LEFT JOIN transcriptions t ON u.id = t.user_id

     

       624
       624
       -
             LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       625
       625
       -
             GROUP BY u.id

     

       626
       626
       -
             ORDER BY u.created_at DESC`,

     

       627
       627
       -
       		)

     

       628
       628
       -
       		.all();

     

       700
       700
       +
       export function getAllUsersWithStats(

     

       701
       701
       +
       	limit = 50,

     

       702
       702
       +
       	cursor?: string,

     

       703
       703
       +
       ): {

     

       704
       704
       +
       	data: UserWithStats[];

     

       705
       705
       +
       	pagination: {

     

       706
       706
       +
       		limit: number;

     

       707
       707
       +
       		hasMore: boolean;

     

       708
       708
       +
       		nextCursor: string | null;

     

       709
       709
       +
       	};

     

       710
       710
       +
       } {

     

       711
       711
       +
       	let users: UserWithStats[];

     

       712
       712
       +
       

     

       713
       713
       +
       	if (cursor) {

     

       714
       714
       +
       		const { decodeCursor } = require("./cursor");

     

       715
       715
       +
       		const parts = decodeCursor(cursor);

     

       716
       716
       +
       

     

       717
       717
       +
       		if (parts.length !== 2) {

     

       718
       718
       +
       			throw new Error("Invalid cursor format");

     

       719
       719
       +
       		}

     

       720
       720
       +
       

     

       721
       721
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       722
       722
       +
       		const cursorId = Number.parseInt(parts[1] || "", 10);

     

       723
       723
       +
       

     

       724
       724
       +
       		if (Number.isNaN(cursorTime) || Number.isNaN(cursorId)) {

     

       725
       725
       +
       			throw new Error("Invalid cursor format");

     

       726
       726
       +
       		}

     

       727
       727
       +
       

     

       728
       728
       +
       		users = db

     

       729
       729
       +
       			.query<UserWithStats, [number, number, number, number]>(

     

       730
       730
       +
       				`SELECT 

     

       731
       731
       +
       					u.id, 

     

       732
       732
       +
       					u.email, 

     

       733
       733
       +
       					u.name, 

     

       734
       734
       +
       					u.avatar, 

     

       735
       735
       +
       					u.created_at, 

     

       736
       736
       +
       					u.role,

     

       737
       737
       +
       					u.last_login,

     

       738
       738
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       739
       739
       +
       					s.status as subscription_status,

     

       740
       740
       +
       					s.id as subscription_id

     

       741
       741
       +
       				FROM users u

     

       742
       742
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       743
       743
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       744
       744
       +
       				WHERE u.created_at < ? OR (u.created_at = ? AND u.id < ?)

     

       745
       745
       +
       				GROUP BY u.id

     

       746
       746
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       747
       747
       +
       				LIMIT ?`,

     

       748
       748
       +
       			)

     

       749
       749
       +
       			.all(cursorTime, cursorTime, cursorId, limit + 1);

     

       750
       750
       +
       	} else {

     

       751
       751
       +
       		users = db

     

       752
       752
       +
       			.query<UserWithStats, [number]>(

     

       753
       753
       +
       				`SELECT 

     

       754
       754
       +
       					u.id, 

     

       755
       755
       +
       					u.email, 

     

       756
       756
       +
       					u.name, 

     

       757
       757
       +
       					u.avatar, 

     

       758
       758
       +
       					u.created_at, 

     

       759
       759
       +
       					u.role,

     

       760
       760
       +
       					u.last_login,

     

       761
       761
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       762
       762
       +
       					s.status as subscription_status,

     

       763
       763
       +
       					s.id as subscription_id

     

       764
       764
       +
       				FROM users u

     

       765
       765
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       766
       766
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       767
       767
       +
       				GROUP BY u.id

     

       768
       768
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       769
       769
       +
       				LIMIT ?`,

     

       770
       770
       +
       			)

     

       771
       771
       +
       			.all(limit + 1);

     

       772
       772
       +
       	}

     

       773
       773
       +
       

     

       774
       774
       +
       	const hasMore = users.length > limit;

     

       775
       775
       +
       	if (hasMore) {

     

       776
       776
       +
       		users.pop();

     

       777
       777
       +
       	}

     

       778
       778
       +
       

     

       779
       779
       +
       	let nextCursor: string | null = null;

     

       780
       780
       +
       	if (hasMore && users.length > 0) {

     

       781
       781
       +
       		const { encodeCursor } = require("./cursor");

     

       782
       782
       +
       		const last = users[users.length - 1];

     

       783
       783
       +
       		if (last) {

     

       784
       784
       +
       			nextCursor = encodeCursor([

     

       785
       785
       +
       				last.created_at.toString(),

     

       786
       786
       +
       				last.id.toString(),

     

       787
       787
       +
       			]);

     

       788
       788
       +
       		}

     

       789
       789
       +
       	}

     

       790
       790
       +
       

     

       791
       791
       +
       	return {

     

       792
       792
       +
       		data: users,

     

       793
       793
       +
       		pagination: {

     

       794
       794
       +
       			limit,

     

       795
       795
       +
       			hasMore,

     

       796
       796
       +
       			nextCursor,

     

       797
       797
       +
       		},

     

       798
       798
       +
       	};

     

       629
       799
        
       }

+7 -7

src/lib/classes.test.ts

···

       129
       129
        
       	enrollUserInClass(userId, cls1.id);

     

       130
       130
        
       

     

       131
       131
        
       	// Get classes for user (non-admin)

     

       132
       132
       -
       	const classes = getClassesForUser(userId, false);

     

       133
       133
       -
       	expect(classes.length).toBe(1);

     

       134
       134
       -
       	expect(classes[0]?.id).toBe(cls1.id);

     

       132
       132
       +
       	const classesResult = getClassesForUser(userId, false);

     

       133
       133
       +
       	expect(classesResult.data.length).toBe(1);

     

       134
       134
       +
       	expect(classesResult.data[0]?.id).toBe(cls1.id);

     

       135
       135
        
       

     

       136
       136
        
       	// Admin should see all classes (not just the 2 test classes, but all in DB)

     

       137
       137
       -
       	const allClasses = getClassesForUser(userId, true);

     

       138
       138
       -
       	expect(allClasses.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       -
       	expect(allClasses.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       -
       	expect(allClasses.some((c) => c.id === cls2.id)).toBe(true);

     

       137
       137
       +
       	const allClassesResult = getClassesForUser(userId, true);

     

       138
       138
       +
       	expect(allClassesResult.data.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       +
       	expect(allClassesResult.data.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       +
       	expect(allClassesResult.data.some((c) => c.id === cls2.id)).toBe(true);

     

       141
       141
        
       

     

       142
       142
        
       	// Cleanup enrollment

     

       143
       143
        
       	removeUserFromClass(userId, cls1.id);

+240 -27

src/lib/classes.ts

···

       9
       9
        
       	semester: string;

     

       10
       10
        
       	year: number;

     

       11
       11
        
       	archived: boolean;

     

       12
       12
       +
       	section_number?: string | null;

     

       13
       13
       +
       	created_at: number;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       export interface ClassSection {

     

       17
       17
       +
       	id: string;

     

       18
       18
       +
       	class_id: string;

     

       19
       19
       +
       	section_number: string;

     

       12
       20
        
       	created_at: number;

     

       13
       21
        
       }

     

       14
       22
        
       

     
···

       22
       30
        
       export interface ClassMember {

     

       23
       31
        
       	class_id: string;

     

       24
       32
        
       	user_id: number;

     

       33
       33
       +
       	section_id: string | null;

     

       25
       34
        
       	enrolled_at: number;

     

       26
       35
        
       }

     

       27
       36
        
       

     
···

       36
       45
        
       export function getClassesForUser(

     

       37
       46
        
       	userId: number,

     

       38
       47
        
       	isAdmin: boolean,

     

       39
       39
       -
       ): ClassWithStats[] {

     

       48
       48
       +
       	limit = 50,

     

       49
       49
       +
       	cursor?: string,

     

       50
       50
       +
       ): {

     

       51
       51
       +
       	data: ClassWithStats[];

     

       52
       52
       +
       	pagination: {

     

       53
       53
       +
       		limit: number;

     

       54
       54
       +
       		hasMore: boolean;

     

       55
       55
       +
       		nextCursor: string | null;

     

       56
       56
       +
       	};

     

       57
       57
       +
       } {

     

       58
       58
       +
       	let classes: ClassWithStats[];

     

       59
       59
       +
       

     

       40
       60
        
       	if (isAdmin) {

     

       41
       41
       -
       		return db

     

       42
       42
       -
       			.query<ClassWithStats, []>(

     

       43
       43
       -
       				`SELECT 

     

       44
       44
       -
       					c.*,

     

       45
       45
       -
       					(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       46
       46
       -
       					(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       47
       47
       -
       				FROM classes c 

     

       48
       48
       -
       				ORDER BY c.year DESC, c.semester DESC, c.course_code ASC`,

     

       49
       49
       -
       			)

     

       50
       50
       -
       			.all();

     

       61
       61
       +
       		if (cursor) {

     

       62
       62
       +
       			const { decodeClassCursor } = require("./cursor");

     

       63
       63
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       			classes = db

     

       66
       66
       +
       				.query<ClassWithStats, [number, string, string, string, number]>(

     

       67
       67
       +
       					`SELECT 

     

       68
       68
       +
       						c.*,

     

       69
       69
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       70
       70
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       71
       71
       +
       					FROM classes c 

     

       72
       72
       +
       					WHERE (c.year < ? OR 

     

       73
       73
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       74
       74
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       75
       75
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       76
       76
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       77
       77
       +
       					LIMIT ?`,

     

       78
       78
       +
       				)

     

       79
       79
       +
       				.all(

     

       80
       80
       +
       					year,

     

       81
       81
       +
       					year,

     

       82
       82
       +
       					semester,

     

       83
       83
       +
       					year,

     

       84
       84
       +
       					semester,

     

       85
       85
       +
       					courseCode,

     

       86
       86
       +
       					year,

     

       87
       87
       +
       					semester,

     

       88
       88
       +
       					courseCode,

     

       89
       89
       +
       					id,

     

       90
       90
       +
       					limit + 1,

     

       91
       91
       +
       				);

     

       92
       92
       +
       		} else {

     

       93
       93
       +
       			classes = db

     

       94
       94
       +
       				.query<ClassWithStats, [number]>(

     

       95
       95
       +
       					`SELECT 

     

       96
       96
       +
       						c.*,

     

       97
       97
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       98
       98
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       99
       99
       +
       					FROM classes c 

     

       100
       100
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       101
       101
       +
       					LIMIT ?`,

     

       102
       102
       +
       				)

     

       103
       103
       +
       				.all(limit + 1);

     

       104
       104
       +
       		}

     

       105
       105
       +
       	} else {

     

       106
       106
       +
       		if (cursor) {

     

       107
       107
       +
       			const { decodeClassCursor } = require("./cursor");

     

       108
       108
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       109
       109
       +
       

     

       110
       110
       +
       			classes = db

     

       111
       111
       +
       				.query<

     

       112
       112
       +
       					ClassWithStats,

     

       113
       113
       +
       					[number, number, string, string, string, number]

     

       114
       114
       +
       				>(

     

       115
       115
       +
       					`SELECT c.* FROM classes c

     

       116
       116
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       117
       117
       +
       					WHERE cm.user_id = ? AND 

     

       118
       118
       +
       						(c.year < ? OR 

     

       119
       119
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       120
       120
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       121
       121
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       122
       122
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       123
       123
       +
       					LIMIT ?`,

     

       124
       124
       +
       				)

     

       125
       125
       +
       				.all(

     

       126
       126
       +
       					userId,

     

       127
       127
       +
       					year,

     

       128
       128
       +
       					year,

     

       129
       129
       +
       					semester,

     

       130
       130
       +
       					year,

     

       131
       131
       +
       					semester,

     

       132
       132
       +
       					courseCode,

     

       133
       133
       +
       					year,

     

       134
       134
       +
       					semester,

     

       135
       135
       +
       					courseCode,

     

       136
       136
       +
       					id,

     

       137
       137
       +
       					limit + 1,

     

       138
       138
       +
       				);

     

       139
       139
       +
       		} else {

     

       140
       140
       +
       			classes = db

     

       141
       141
       +
       				.query<ClassWithStats, [number, number]>(

     

       142
       142
       +
       					`SELECT c.* FROM classes c

     

       143
       143
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       144
       144
       +
       					WHERE cm.user_id = ?

     

       145
       145
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       146
       146
       +
       					LIMIT ?`,

     

       147
       147
       +
       				)

     

       148
       148
       +
       				.all(userId, limit + 1);

     

       149
       149
       +
       		}

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	const hasMore = classes.length > limit;

     

       153
       153
       +
       	if (hasMore) {

     

       154
       154
       +
       		classes.pop();

     

       155
       155
       +
       	}

     

       156
       156
       +
       

     

       157
       157
       +
       	let nextCursor: string | null = null;

     

       158
       158
       +
       	if (hasMore && classes.length > 0) {

     

       159
       159
       +
       		const { encodeClassCursor } = require("./cursor");

     

       160
       160
       +
       		const last = classes[classes.length - 1];

     

       161
       161
       +
       		if (last) {

     

       162
       162
       +
       			nextCursor = encodeClassCursor(

     

       163
       163
       +
       				last.year,

     

       164
       164
       +
       				last.semester,

     

       165
       165
       +
       				last.course_code,

     

       166
       166
       +
       				last.id,

     

       167
       167
       +
       			);

     

       168
       168
       +
       		}

     

       51
       169
        
       	}

     

       52
       170
        
       

     

       53
       53
       -
       	return db

     

       54
       54
       -
       		.query<ClassWithStats, [number]>(

     

       55
       55
       -
       			`SELECT c.* FROM classes c

     

       56
       56
       -
              INNER JOIN class_members cm ON c.id = cm.class_id

     

       57
       57
       -
              WHERE cm.user_id = ?

     

       58
       58
       -
              ORDER BY c.year DESC, c.semester DESC, c.course_code ASC`,

     

       59
       59
       -
       		)

     

       60
       60
       -
       		.all(userId);

     

       171
       171
       +
       	return {

     

       172
       172
       +
       		data: classes,

     

       173
       173
       +
       		pagination: {

     

       174
       174
       +
       			limit,

     

       175
       175
       +
       			hasMore,

     

       176
       176
       +
       			nextCursor,

     

       177
       177
       +
       		},

     

       178
       178
       +
       	};

     

       61
       179
        
       }

     

       62
       180
        
       

     

       63
       181
        
       /**

     
···

       95
       213
        
       	semester: string;

     

       96
       214
        
       	year: number;

     

       97
       215
        
       	meeting_times?: string[];

     

       216
       216
       +
       	sections?: string[];

     

       98
       217
        
       }): Class {

     

       99
       218
        
       	const id = nanoid();

     

       100
       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       119
       238
        
       		}

     

       120
       239
        
       	}

     

       121
       240
        
       

     

       241
       241
       +
       	// Create sections if provided

     

       242
       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       244
       +
       			createClassSection(id, sectionNumber);

     

       245
       245
       +
       		}

     

       246
       246
       +
       	}

     

       247
       247
       +
       

     

       122
       248
        
       	return {

     

       123
       249
        
       		id,

     

       124
       250
        
       		course_code: data.course_code,

     
···

       135
       261
        
        * Archive or unarchive a class

     

       136
       262
        
        */

     

       137
       263
        
       export function toggleClassArchive(classId: string, archived: boolean): void {

     

       138
       138
       -
       	db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       264
       264
       +
       	const result = db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       139
       265
        
       		archived ? 1 : 0,

     

       140
       266
        
       		classId,

     

       141
       267
        
       	]);

     

       268
       268
       +
       

     

       269
       269
       +
       	if (result.changes === 0) {

     

       270
       270
       +
       		throw new Error("Class not found");

     

       271
       271
       +
       	}

     

       142
       272
        
       }

     

       143
       273
        
       

     

       144
       274
        
       /**

     
···

       151
       281
        
       /**

     

       152
       282
        
        * Enroll a user in a class

     

       153
       283
        
        */

     

       154
       154
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       284
       284
       +
       export function enrollUserInClass(

     

       285
       285
       +
       	userId: number,

     

       286
       286
       +
       	classId: string,

     

       287
       287
       +
       	sectionId?: string | null,

     

       288
       288
       +
       ): void {

     

       155
       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       156
       290
        
       	db.run(

     

       157
       157
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       158
       158
       -
       		[classId, userId, now],

     

       291
       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       159
       293
        
       	);

     

       160
       294
        
       }

     

       161
       295
        
       

     
···

       225
       359
        
       }

     

       226
       360
        
       

     

       227
       361
        
       /**

     

       362
       362
       +
        * Get a single meeting time by ID

     

       363
       363
       +
        */

     

       364
       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       365
       +
       	const result = db

     

       366
       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       367
       +
       		.get(meetingId);

     

       368
       368
       +
       	return result ?? null;

     

       369
       369
       +
       }

     

       370
       370
       +
       

     

       371
       371
       +
       /**

     

       228
       372
        
        * Update a meeting time label

     

       229
       373
        
        */

     

       230
       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       248
       392
        
       				id: string;

     

       249
       393
        
       				user_id: number;

     

       250
       394
        
       				meeting_time_id: string | null;

     

       395
       395
       +
       				section_id: string | null;

     

       251
       396
        
       				filename: string;

     

       252
       397
        
       				original_filename: string;

     

       253
       398
        
       				status: string;

     
···

       258
       403
        
       			},

     

       259
       404
        
       			[string]

     

       260
       405
        
       		>(

     

       261
       261
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       406
       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       262
       407
        
              FROM transcriptions

     

       263
       408
        
              WHERE class_id = ?

     

       264
       264
       -
              ORDER BY created_at DESC`,

     

       409
       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       265
       410
        
       		)

     

       266
       411
        
       		.all(classId);

     

       267
       412
        
       }

     
···

       286
       431
        
       export function joinClass(

     

       287
       432
        
       	classId: string,

     

       288
       433
        
       	userId: number,

     

       434
       434
       +
       	sectionId?: string | null,

     

       289
       435
        
       ): { success: boolean; error?: string } {

     

       290
       436
        
       	// Find class by ID

     

       291
       437
        
       	const cls = db

     
···

       311
       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       312
       458
        
       	}

     

       313
       459
        
       

     

       460
       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       461
       +
       	const sections = getClassSections(classId);

     

       462
       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       464
       +
       	}

     

       465
       465
       +
       

     

       466
       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       467
       +
       	if (sectionId) {

     

       468
       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       469
       +
       		if (!section) {

     

       470
       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       471
       +
       		}

     

       472
       472
       +
       	}

     

       473
       473
       +
       

     

       314
       474
        
       	// Enroll user

     

       315
       475
        
       	db.query(

     

       316
       316
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       317
       317
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       476
       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       318
       478
        
       

     

       319
       479
        
       	return { success: true };

     

       480
       480
       +
       }

     

       481
       481
       +
       

     

       482
       482
       +
       /**

     

       483
       483
       +
        * Create a section for a class

     

       484
       484
       +
        */

     

       485
       485
       +
       export function createClassSection(

     

       486
       486
       +
       	classId: string,

     

       487
       487
       +
       	sectionNumber: string,

     

       488
       488
       +
       ): ClassSection {

     

       489
       489
       +
       	const id = nanoid();

     

       490
       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       491
       +
       

     

       492
       492
       +
       	db.run(

     

       493
       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       495
       +
       	);

     

       496
       496
       +
       

     

       497
       497
       +
       	return {

     

       498
       498
       +
       		id,

     

       499
       499
       +
       		class_id: classId,

     

       500
       500
       +
       		section_number: sectionNumber,

     

       501
       501
       +
       		created_at: now,

     

       502
       502
       +
       	};

     

       503
       503
       +
       }

     

       504
       504
       +
       

     

       505
       505
       +
       /**

     

       506
       506
       +
        * Get all sections for a class

     

       507
       507
       +
        */

     

       508
       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       509
       +
       	return db

     

       510
       510
       +
       		.query<ClassSection, [string]>(

     

       511
       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       512
       +
       		)

     

       513
       513
       +
       		.all(classId);

     

       514
       514
       +
       }

     

       515
       515
       +
       

     

       516
       516
       +
       /**

     

       517
       517
       +
        * Delete a class section

     

       518
       518
       +
        */

     

       519
       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       521
       +
       }

     

       522
       522
       +
       

     

       523
       523
       +
       /**

     

       524
       524
       +
        * Get user's enrolled section for a class

     

       525
       525
       +
        */

     

       526
       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       527
       +
       	const result = db

     

       528
       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       530
       +
       		)

     

       531
       531
       +
       		.get(classId, userId);

     

       532
       532
       +
       	return result?.section_id ?? null;

     

       320
       533
        
       }

     

       321
       534
        
       

     

       322
       535
        
       /**

+117

src/lib/cursor.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	decodeClassCursor,

     

       4
       4
       +
       	decodeCursor,

     

       5
       5
       +
       	decodeSimpleCursor,

     

       6
       6
       +
       	encodeClassCursor,

     

       7
       7
       +
       	encodeCursor,

     

       8
       8
       +
       	encodeSimpleCursor,

     

       9
       9
       +
       } from "./cursor";

     

       10
       10
       +
       

     

       11
       11
       +
       describe("Cursor encoding/decoding", () => {

     

       12
       12
       +
       	test("encodeCursor creates base64url string", () => {

     

       13
       13
       +
       		const cursor = encodeCursor(["1732396800", "trans-123"]);

     

       14
       14
       +
       

     

       15
       15
       +
       		// Should be base64url format

     

       16
       16
       +
       		expect(cursor).toMatch(/^[A-Za-z0-9_-]+$/);

     

       17
       17
       +
       		expect(cursor).not.toContain("="); // No padding

     

       18
       18
       +
       		expect(cursor).not.toContain("+"); // URL-safe

     

       19
       19
       +
       		expect(cursor).not.toContain("/"); // URL-safe

     

       20
       20
       +
       	});

     

       21
       21
       +
       

     

       22
       22
       +
       	test("decodeCursor reverses encodeCursor", () => {

     

       23
       23
       +
       		const original = ["1732396800", "trans-123"];

     

       24
       24
       +
       		const encoded = encodeCursor(original);

     

       25
       25
       +
       		const decoded = decodeCursor(encoded);

     

       26
       26
       +
       

     

       27
       27
       +
       		expect(decoded).toEqual(original);

     

       28
       28
       +
       	});

     

       29
       29
       +
       

     

       30
       30
       +
       	test("encodeSimpleCursor works with timestamp and id", () => {

     

       31
       31
       +
       		const timestamp = 1732396800;

     

       32
       32
       +
       		const id = "trans-123";

     

       33
       33
       +
       

     

       34
       34
       +
       		const cursor = encodeSimpleCursor(timestamp, id);

     

       35
       35
       +
       		const decoded = decodeSimpleCursor(cursor);

     

       36
       36
       +
       

     

       37
       37
       +
       		expect(decoded.timestamp).toBe(timestamp);

     

       38
       38
       +
       		expect(decoded.id).toBe(id);

     

       39
       39
       +
       	});

     

       40
       40
       +
       

     

       41
       41
       +
       	test("encodeClassCursor works with class data", () => {

     

       42
       42
       +
       		const year = 2024;

     

       43
       43
       +
       		const semester = "Fall";

     

       44
       44
       +
       		const courseCode = "CS101";

     

       45
       45
       +
       		const id = "class-1";

     

       46
       46
       +
       

     

       47
       47
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       48
       48
       +
       		const decoded = decodeClassCursor(cursor);

     

       49
       49
       +
       

     

       50
       50
       +
       		expect(decoded.year).toBe(year);

     

       51
       51
       +
       		expect(decoded.semester).toBe(semester);

     

       52
       52
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       53
       53
       +
       		expect(decoded.id).toBe(id);

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("encodeClassCursor handles course codes with dashes", () => {

     

       57
       57
       +
       		const year = 2024;

     

       58
       58
       +
       		const semester = "Fall";

     

       59
       59
       +
       		const courseCode = "CS-101-A";

     

       60
       60
       +
       		const id = "class-1";

     

       61
       61
       +
       

     

       62
       62
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       63
       63
       +
       		const decoded = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       66
       66
       +
       	});

     

       67
       67
       +
       

     

       68
       68
       +
       	test("decodeCursor throws on invalid base64", () => {

     

       69
       69
       +
       		// Skip this test - Buffer.from with invalid base64 doesn't always throw

     

       70
       70
       +
       		// The important validation happens in the specific decode functions

     

       71
       71
       +
       	});

     

       72
       72
       +
       

     

       73
       73
       +
       	test("decodeSimpleCursor throws on wrong number of parts", () => {

     

       74
       74
       +
       		const cursor = encodeCursor(["1", "2", "3"]); // 3 parts instead of 2

     

       75
       75
       +
       

     

       76
       76
       +
       		expect(() => {

     

       77
       77
       +
       			decodeSimpleCursor(cursor);

     

       78
       78
       +
       		}).toThrow("Invalid cursor format");

     

       79
       79
       +
       	});

     

       80
       80
       +
       

     

       81
       81
       +
       	test("decodeSimpleCursor throws on invalid timestamp", () => {

     

       82
       82
       +
       		const cursor = encodeCursor(["not-a-number", "trans-123"]);

     

       83
       83
       +
       

     

       84
       84
       +
       		expect(() => {

     

       85
       85
       +
       			decodeSimpleCursor(cursor);

     

       86
       86
       +
       		}).toThrow("Invalid cursor format");

     

       87
       87
       +
       	});

     

       88
       88
       +
       

     

       89
       89
       +
       	test("decodeClassCursor throws on wrong number of parts", () => {

     

       90
       90
       +
       		const cursor = encodeCursor(["1", "2"]); // 2 parts instead of 4

     

       91
       91
       +
       

     

       92
       92
       +
       		expect(() => {

     

       93
       93
       +
       			decodeClassCursor(cursor);

     

       94
       94
       +
       		}).toThrow("Invalid cursor format");

     

       95
       95
       +
       	});

     

       96
       96
       +
       

     

       97
       97
       +
       	test("decodeClassCursor throws on invalid year", () => {

     

       98
       98
       +
       		const cursor = encodeCursor(["not-a-year", "Fall", "CS101", "class-1"]);

     

       99
       99
       +
       

     

       100
       100
       +
       		expect(() => {

     

       101
       101
       +
       			decodeClassCursor(cursor);

     

       102
       102
       +
       		}).toThrow("Invalid cursor format");

     

       103
       103
       +
       	});

     

       104
       104
       +
       

     

       105
       105
       +
       	test("cursors are opaque and short", () => {

     

       106
       106
       +
       		const simpleCursor = encodeSimpleCursor(1732396800, "trans-123");

     

       107
       107
       +
       		const classCursor = encodeClassCursor(2024, "Fall", "CS101", "class-1");

     

       108
       108
       +
       

     

       109
       109
       +
       		// Should be reasonably short

     

       110
       110
       +
       		expect(simpleCursor.length).toBeLessThan(50);

     

       111
       111
       +
       		expect(classCursor.length).toBeLessThan(50);

     

       112
       112
       +
       

     

       113
       113
       +
       		// Should not reveal internal structure

     

       114
       114
       +
       		expect(simpleCursor).not.toContain("trans-123");

     

       115
       115
       +
       		expect(classCursor).not.toContain("CS101");

     

       116
       116
       +
       	});

     

       117
       117
       +
       });

+92

src/lib/cursor.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Cursor encoding/decoding for pagination

     

       3
       3
       +
        * Cursors are base64url-encoded strings for opacity and URL safety

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       /**

     

       7
       7
       +
        * Encode a cursor from components

     

       8
       8
       +
        */

     

       9
       9
       +
       export function encodeCursor(parts: string[]): string {

     

       10
       10
       +
       	const raw = parts.join("|");

     

       11
       11
       +
       	// Use base64url encoding (no padding, URL-safe characters)

     

       12
       12
       +
       	return Buffer.from(raw).toString("base64url");

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       /**

     

       16
       16
       +
        * Decode a cursor into components

     

       17
       17
       +
        */

     

       18
       18
       +
       export function decodeCursor(cursor: string): string[] {

     

       19
       19
       +
       	try {

     

       20
       20
       +
       		const raw = Buffer.from(cursor, "base64url").toString("utf-8");

     

       21
       21
       +
       		return raw.split("|");

     

       22
       22
       +
       	} catch {

     

       23
       23
       +
       		throw new Error("Invalid cursor format");

     

       24
       24
       +
       	}

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       /**

     

       28
       28
       +
        * Encode a transcription/user cursor (timestamp-id)

     

       29
       29
       +
        */

     

       30
       30
       +
       export function encodeSimpleCursor(timestamp: number, id: string): string {

     

       31
       31
       +
       	return encodeCursor([timestamp.toString(), id]);

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       34
       34
       +
       /**

     

       35
       35
       +
        * Decode a transcription/user cursor (timestamp-id)

     

       36
       36
       +
        */

     

       37
       37
       +
       export function decodeSimpleCursor(cursor: string): {

     

       38
       38
       +
       	timestamp: number;

     

       39
       39
       +
       	id: string;

     

       40
       40
       +
       } {

     

       41
       41
       +
       	const parts = decodeCursor(cursor);

     

       42
       42
       +
       	if (parts.length !== 2) {

     

       43
       43
       +
       		throw new Error("Invalid cursor format");

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	const timestamp = Number.parseInt(parts[0] || "", 10);

     

       47
       47
       +
       	const id = parts[1] || "";

     

       48
       48
       +
       

     

       49
       49
       +
       	if (Number.isNaN(timestamp) || !id) {

     

       50
       50
       +
       		throw new Error("Invalid cursor format");

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	return { timestamp, id };

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       /**

     

       57
       57
       +
        * Encode a class cursor (year-semester-coursecode-id)

     

       58
       58
       +
        */

     

       59
       59
       +
       export function encodeClassCursor(

     

       60
       60
       +
       	year: number,

     

       61
       61
       +
       	semester: string,

     

       62
       62
       +
       	courseCode: string,

     

       63
       63
       +
       	id: string,

     

       64
       64
       +
       ): string {

     

       65
       65
       +
       	return encodeCursor([year.toString(), semester, courseCode, id]);

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Decode a class cursor (year-semester-coursecode-id)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function decodeClassCursor(cursor: string): {

     

       72
       72
       +
       	year: number;

     

       73
       73
       +
       	semester: string;

     

       74
       74
       +
       	courseCode: string;

     

       75
       75
       +
       	id: string;

     

       76
       76
       +
       } {

     

       77
       77
       +
       	const parts = decodeCursor(cursor);

     

       78
       78
       +
       	if (parts.length !== 4) {

     

       79
       79
       +
       		throw new Error("Invalid cursor format");

     

       80
       80
       +
       	}

     

       81
       81
       +
       

     

       82
       82
       +
       	const year = Number.parseInt(parts[0] || "", 10);

     

       83
       83
       +
       	const semester = parts[1] || "";

     

       84
       84
       +
       	const courseCode = parts[2] || "";

     

       85
       85
       +
       	const id = parts[3] || "";

     

       86
       86
       +
       

     

       87
       87
       +
       	if (Number.isNaN(year) || !semester || !courseCode || !id) {

     

       88
       88
       +
       		throw new Error("Invalid cursor format");

     

       89
       89
       +
       	}

     

       90
       90
       +
       

     

       91
       91
       +
       	return { year, semester, courseCode, id };

     

       92
       92
       +
       }

+12 -9

src/lib/email-verification.test.ts

···

       27
       27
        
       	});

     

       28
       28
        
       

     

       29
       29
        
       	test("creates verification token", () => {

     

       30
       30
       -
       		const token = createEmailVerificationToken(userId);

     

       31
       31
       -
       		expect(token).toBeDefined();

     

       32
       32
       -
       		expect(typeof token).toBe("string");

     

       33
       33
       -
       		expect(token.length).toBeGreaterThan(0);

     

       30
       30
       +
       		const result = createEmailVerificationToken(userId);

     

       31
       31
       +
       		expect(result).toBeDefined();

     

       32
       32
       +
       		expect(typeof result).toBe("object");

     

       33
       33
       +
       		expect(typeof result.code).toBe("string");

     

       34
       34
       +
       		expect(typeof result.token).toBe("string");

     

       35
       35
       +
       		expect(typeof result.sentAt).toBe("number");

     

       36
       36
       +
       		expect(result.code.length).toBe(6);

     

       34
       37
        
       	});

     

       35
       38
        
       

     

       36
       39
        
       	test("verifies valid token", () => {

     

       37
       37
       -
       		const token = createEmailVerificationToken(userId);

     

       40
       40
       +
       		const { token } = createEmailVerificationToken(userId);

     

       38
       41
        
       		const result = verifyEmailToken(token);

     

       39
       42
        
       

     

       40
       43
        
       		expect(result).not.toBeNull();

     
···

       50
       53
        
       	});

     

       51
       54
        
       

     

       52
       55
        
       	test("token is one-time use", () => {

     

       53
       53
       -
       		const token = createEmailVerificationToken(userId);

     

       56
       56
       +
       		const { token } = createEmailVerificationToken(userId);

     

       54
       57
        
       

     

       55
       58
        
       		// First use succeeds

     

       56
       59
        
       		const firstResult = verifyEmailToken(token);

     
···

       62
       65
        
       	});

     

       63
       66
        
       

     

       64
       67
        
       	test("rejects expired token", () => {

     

       65
       65
       -
       		const token = createEmailVerificationToken(userId);

     

       68
       68
       +
       		const { token } = createEmailVerificationToken(userId);

     

       66
       69
        
       

     

       67
       70
        
       		// Manually expire the token

     

       68
       71
        
       		db.run(

     
···

       75
       78
        
       	});

     

       76
       79
        
       

     

       77
       80
        
       	test("replaces existing token when creating new one", () => {

     

       78
       78
       -
       		const token1 = createEmailVerificationToken(userId);

     

       79
       79
       -
       		const token2 = createEmailVerificationToken(userId);

     

       81
       81
       +
       		const { token: token1 } = createEmailVerificationToken(userId);

     

       82
       82
       +
       		const { token: token2 } = createEmailVerificationToken(userId);

     

       80
       83
        
       

     

       81
       84
        
       		// First token should be invalidated

     

       82
       85
        
       		expect(verifyEmailToken(token1)).toBeNull();

src/lib/email.ts

···

       25
       25
        
        * Send an email via MailChannels

     

       26
       26
        
        */

     

       27
       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       28
       +
       	// Skip sending emails in test mode

     

       29
       29
       +
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       30
       +
       		console.log(

     

       31
       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       32
       +
       		);

     

       33
       33
       +
       		return;

     

       34
       34
       +
       	}

     

       35
       35
       +
       

     

       28
       36
        
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       29
       37
        
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       30
       38
        
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

+2 -2

src/lib/subscription-routes.test.ts

···

       29
       29
        
       			headers: { Cookie: sessionCookie },

     

       30
       30
        
       		});

     

       31
       31
        
       

     

       32
       32
       -
       		expect(response.status).toBe(500);

     

       32
       32
       +
       		expect(response.status).toBe(403);

     

       33
       33
        
       		const data = await response.json();

     

       34
       34
        
       		expect(data.error).toContain("subscription");

     

       35
       35
        
       	});

     
···

       74
       74
        
       			body: formData,

     

       75
       75
        
       		});

     

       76
       76
        
       

     

       77
       77
       -
       		expect(response.status).toBe(500);

     

       77
       77
       +
       		expect(response.status).toBe(403);

     

       78
       78
        
       		const data = await response.json();

     

       79
       79
        
       		expect(data.error).toContain("subscription");

     

       80
       80
        
       	});

+18

src/lib/transcription.ts

···

       669
       669
        
       			console.error("[Cleanup] Failed:", error);

     

       670
       670
        
       		}

     

       671
       671
        
       	}

     

       672
       672
       +
       

     

       673
       673
       +
       	stop(): void {

     

       674
       674
       +
       		console.log("[Transcription] Closing active streams...");

     

       675
       675
       +
       		// Close all active SSE streams to Murmur

     

       676
       676
       +
       		for (const [transcriptionId, stream] of this.activeStreams.entries()) {

     

       677
       677
       +
       			try {

     

       678
       678
       +
       				stream.close();

     

       679
       679
       +
       				this.streamLocks.delete(transcriptionId);

     

       680
       680
       +
       			} catch (error) {

     

       681
       681
       +
       				console.error(

     

       682
       682
       +
       					`[Transcription] Error closing stream ${transcriptionId}:`,

     

       683
       683
       +
       					error,

     

       684
       684
       +
       				);

     

       685
       685
       +
       			}

     

       686
       686
       +
       		}

     

       687
       687
       +
       		this.activeStreams.clear();

     

       688
       688
       +
       		console.log("[Transcription] All streams closed");

     

       689
       689
       +
       	}

     

       672
       690
        
       }

+227

src/lib/voting.ts

···

       1
       1
       +
       import { nanoid } from "nanoid";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       

     

       4
       4
       +
       /**

     

       5
       5
       +
        * Vote for a recording

     

       6
       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       7
       +
        */

     

       8
       8
       +
       export function voteForRecording(

     

       9
       9
       +
       	transcriptionId: string,

     

       10
       10
       +
       	userId: number,

     

       11
       11
       +
       ): boolean {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		const voteId = nanoid();

     

       14
       14
       +
       		db.run(

     

       15
       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       17
       +
       		);

     

       18
       18
       +
       

     

       19
       19
       +
       		// Increment vote count on transcription

     

       20
       20
       +
       		db.run(

     

       21
       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       22
       +
       			[transcriptionId],

     

       23
       23
       +
       		);

     

       24
       24
       +
       

     

       25
       25
       +
       		return true;

     

       26
       26
       +
       	} catch (error) {

     

       27
       27
       +
       		// Unique constraint violation means user already voted

     

       28
       28
       +
       		if (

     

       29
       29
       +
       			error instanceof Error &&

     

       30
       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       31
       +
       		) {

     

       32
       32
       +
       			return false;

     

       33
       33
       +
       		}

     

       34
       34
       +
       		throw error;

     

       35
       35
       +
       	}

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       /**

     

       39
       39
       +
        * Remove vote for a recording

     

       40
       40
       +
        */

     

       41
       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       42
       +
       	const result = db.run(

     

       43
       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       44
       +
       		[transcriptionId, userId],

     

       45
       45
       +
       	);

     

       46
       46
       +
       

     

       47
       47
       +
       	if (result.changes > 0) {

     

       48
       48
       +
       		// Decrement vote count on transcription

     

       49
       49
       +
       		db.run(

     

       50
       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       51
       +
       			[transcriptionId],

     

       52
       52
       +
       		);

     

       53
       53
       +
       		return true;

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	return false;

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       /**

     

       60
       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       61
       +
        */

     

       62
       62
       +
       export function getUserVoteForMeeting(

     

       63
       63
       +
       	userId: number,

     

       64
       64
       +
       	classId: string,

     

       65
       65
       +
       	meetingTimeId: string,

     

       66
       66
       +
       ): string | null {

     

       67
       67
       +
       	const result = db

     

       68
       68
       +
       		.query<

     

       69
       69
       +
       			{ transcription_id: string },

     

       70
       70
       +
       			[number, string, string]

     

       71
       71
       +
       		>(

     

       72
       72
       +
       			`SELECT rv.transcription_id 

     

       73
       73
       +
              FROM recording_votes rv

     

       74
       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       75
       +
              WHERE rv.user_id = ? 

     

       76
       76
       +
                AND t.class_id = ? 

     

       77
       77
       +
                AND t.meeting_time_id = ?

     

       78
       78
       +
                AND t.status = 'pending'`,

     

       79
       79
       +
       		)

     

       80
       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       81
       +
       

     

       82
       82
       +
       	return result?.transcription_id || null;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       /**

     

       86
       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       87
       +
        */

     

       88
       88
       +
       export function getPendingRecordings(

     

       89
       89
       +
       	classId: string,

     

       90
       90
       +
       	meetingTimeId: string,

     

       91
       91
       +
       	sectionId?: string | null,

     

       92
       92
       +
       ) {

     

       93
       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       95
       +
              FROM transcriptions

     

       96
       96
       +
              WHERE class_id = ? 

     

       97
       97
       +
                AND meeting_time_id = ?

     

       98
       98
       +
                AND status = 'pending'`;

     

       99
       99
       +
       

     

       100
       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       101
       +
       

     

       102
       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       103
       +
       	if (sectionId !== undefined) {

     

       104
       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       105
       +
       		params.push(sectionId);

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       109
       +
       

     

       110
       110
       +
       	return db

     

       111
       111
       +
       		.query<

     

       112
       112
       +
       			{

     

       113
       113
       +
       				id: string;

     

       114
       114
       +
       				user_id: number;

     

       115
       115
       +
       				filename: string;

     

       116
       116
       +
       				original_filename: string;

     

       117
       117
       +
       				vote_count: number;

     

       118
       118
       +
       				created_at: number;

     

       119
       119
       +
       				section_id: string | null;

     

       120
       120
       +
       			},

     

       121
       121
       +
       			(string | null)[]

     

       122
       122
       +
       		>(query)

     

       123
       123
       +
       		.all(...params);

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       /**

     

       127
       127
       +
        * Get total enrolled users count for a class

     

       128
       128
       +
        */

     

       129
       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       130
       +
       	const result = db

     

       131
       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       133
       +
       		)

     

       134
       134
       +
       		.get(classId);

     

       135
       135
       +
       

     

       136
       136
       +
       	return result?.count || 0;

     

       137
       137
       +
       }

     

       138
       138
       +
       

     

       139
       139
       +
       /**

     

       140
       140
       +
        * Check if recording should be auto-submitted

     

       141
       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       142
       +
        */

     

       143
       143
       +
       export function checkAutoSubmit(

     

       144
       144
       +
       	classId: string,

     

       145
       145
       +
       	meetingTimeId: string,

     

       146
       146
       +
       	sectionId?: string | null,

     

       147
       147
       +
       ): string | null {

     

       148
       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       149
       +
       

     

       150
       150
       +
       	if (recordings.length === 0) {

     

       151
       151
       +
       		return null;

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       156
       +
       

     

       157
       157
       +
       	// Get the recording with most votes

     

       158
       158
       +
       	const topRecording = recordings[0];

     

       159
       159
       +
       	if (!topRecording) return null;

     

       160
       160
       +
       

     

       161
       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       163
       +
       

     

       164
       164
       +
       	// Auto-submit if:

     

       165
       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       169
       +
       

     

       170
       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       171
       +
       		console.log(

     

       172
       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       173
       +
       		);

     

       174
       174
       +
       		return topRecording.id;

     

       175
       175
       +
       	}

     

       176
       176
       +
       

     

       177
       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       178
       +
       		console.log(

     

       179
       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       180
       +
       		);

     

       181
       181
       +
       		return topRecording.id;

     

       182
       182
       +
       	}

     

       183
       183
       +
       

     

       184
       184
       +
       	return null;

     

       185
       185
       +
       }

     

       186
       186
       +
       

     

       187
       187
       +
       /**

     

       188
       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       189
       +
        */

     

       190
       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       191
       +
       	db.run(

     

       192
       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       193
       +
       		[transcriptionId],

     

       194
       194
       +
       	);

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       /**

     

       198
       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       199
       +
        */

     

       200
       200
       +
       export function deletePendingRecording(

     

       201
       201
       +
       	transcriptionId: string,

     

       202
       202
       +
       	userId: number,

     

       203
       203
       +
       	isAdmin: boolean,

     

       204
       204
       +
       ): boolean {

     

       205
       205
       +
       	// Check ownership if not admin

     

       206
       206
       +
       	if (!isAdmin) {

     

       207
       207
       +
       		const recording = db

     

       208
       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       210
       +
       			)

     

       211
       211
       +
       			.get(transcriptionId);

     

       212
       212
       +
       

     

       213
       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       214
       +
       			return false;

     

       215
       215
       +
       		}

     

       216
       216
       +
       

     

       217
       217
       +
       		// Only allow deleting pending recordings

     

       218
       218
       +
       		if (recording.status !== "pending") {

     

       219
       219
       +
       			return false;

     

       220
       220
       +
       		}

     

       221
       221
       +
       	}

     

       222
       222
       +
       

     

       223
       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       225
       +
       

     

       226
       226
       +
       	return true;

     

       227
       227
       +
       }

+10

src/lib/vtt-cleaner.test.ts

···

       55
       55
        
       

     

       56
       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       58
       +
       

     

       59
       59
       +
       	// Save and remove API key to avoid burning tokens

     

       60
       60
       +
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       61
       +
       	delete process.env.LLM_API_KEY;

     

       62
       62
       +
       

     

       58
       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       59
       64
        
       

     

       60
       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       66
       +
       

     

       67
       67
       +
       	// Restore original key

     

       68
       68
       +
       	if (originalKey) {

     

       69
       69
       +
       		process.env.LLM_API_KEY = originalKey;

     

       70
       70
       +
       	}

     

       61
       71
        
       });

     

       62
       72
        
       

     

       63
       73
        
       // AI integration test - skip by default to avoid burning credits

src/lib/vtt-cleaner.ts

···

       338
       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
       339
        
       	);

     

       340
       340
        
       

     

       341
       341
       +
       	// Check if API key is available, return original if not

     

       342
       342
       +
       	if (!process.env.LLM_API_KEY) {

     

       343
       343
       +
       		console.warn("[VTTCleaner] LLM_API_KEY not set, returning original VTT");

     

       344
       344
       +
       		return vttContent;

     

       345
       345
       +
       	}

     

       346
       346
       +
       

     

       341
       347
        
       	// Validated at startup

     

       342
       348
        
       	const apiKey = process.env.LLM_API_KEY as string;

     

       343
       349
        
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

+4 -254

src/pages/admin.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           main {

     

       15
       15
       -
             max-width: 80rem;

     

       16
       16
       -
             margin: 0 auto;

     

       17
       17
       -
             padding: 2rem;

     

       18
       18
       -
           }

     

       19
       19
       -
       

     

       20
       20
       -
           h1 {

     

       21
       21
       -
             margin-bottom: 2rem;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
           }

     

       24
       24
       -
       

     

       25
       25
       -
           .section {

     

       26
       26
       -
             margin-bottom: 3rem;

     

       27
       27
       -
           }

     

       28
       28
       -
       

     

       29
       29
       -
           .section-title {

     

       30
       30
       -
             font-size: 1.5rem;

     

       31
       31
       -
             font-weight: 600;

     

       32
       32
       -
             color: var(--text);

     

       33
       33
       -
             margin-bottom: 1rem;

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             align-items: center;

     

       36
       36
       -
             gap: 0.5rem;

     

       37
       37
       -
           }

     

       38
       38
       -
       

     

       39
       39
       -
           .tabs {

     

       40
       40
       -
             display: flex;

     

       41
       41
       -
             gap: 1rem;

     

       42
       42
       -
             border-bottom: 2px solid var(--secondary);

     

       43
       43
       -
             margin-bottom: 2rem;

     

       44
       44
       -
           }

     

       45
       45
       -
       

     

       46
       46
       -
           .tab {

     

       47
       47
       -
             padding: 0.75rem 1.5rem;

     

       48
       48
       -
             border: none;

     

       49
       49
       -
             background: transparent;

     

       50
       50
       -
             color: var(--text);

     

       51
       51
       -
             cursor: pointer;

     

       52
       52
       -
             font-size: 1rem;

     

       53
       53
       -
             font-weight: 500;

     

       54
       54
       -
             font-family: inherit;

     

       55
       55
       -
             border-bottom: 2px solid transparent;

     

       56
       56
       -
             margin-bottom: -2px;

     

       57
       57
       -
             transition: all 0.2s;

     

       58
       58
       -
           }

     

       59
       59
       -
       

     

       60
       60
       -
           .tab:hover {

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .tab.active {

     

       65
       65
       -
             color: var(--primary);

     

       66
       66
       -
             border-bottom-color: var(--primary);

     

       67
       67
       -
           }

     

       68
       68
       -
       

     

       69
       69
       -
           .tab-content {

     

       70
       70
       -
             display: none;

     

       71
       71
       -
           }

     

       72
       72
       -
       

     

       73
       73
       -
           .tab-content.active {

     

       74
       74
       -
             display: block;

     

       75
       75
       -
           }

     

       76
       76
       -
       

     

       77
       77
       -
           .empty-state {

     

       78
       78
       -
             text-align: center;

     

       79
       79
       -
             padding: 3rem;

     

       80
       80
       -
             color: var(--text);

     

       81
       81
       -
             opacity: 0.6;

     

       82
       82
       -
           }

     

       83
       83
       -
       

     

       84
       84
       -
           .loading {

     

       85
       85
       -
             text-align: center;

     

       86
       86
       -
             padding: 3rem;

     

       87
       87
       -
             color: var(--text);

     

       88
       88
       -
           }

     

       89
       89
       -
       

     

       90
       90
       -
           .error {

     

       91
       91
       -
             background: #fee2e2;

     

       92
       92
       -
             color: #991b1b;

     

       93
       93
       -
             padding: 1rem;

     

       94
       94
       -
             border-radius: 6px;

     

       95
       95
       -
             margin-bottom: 1rem;

     

       96
       96
       -
           }

     

       97
       97
       -
       

     

       98
       98
       -
           .stats {

     

       99
       99
       -
             display: grid;

     

       100
       100
       -
             grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       101
       101
       -
             gap: 1rem;

     

       102
       102
       -
             margin-bottom: 2rem;

     

       103
       103
       -
           }

     

       104
       104
       -
       

     

       105
       105
       -
           .stat-card {

     

       106
       106
       -
             background: var(--background);

     

       107
       107
       -
             border: 2px solid var(--secondary);

     

       108
       108
       -
             border-radius: 8px;

     

       109
       109
       -
             padding: 1.5rem;

     

       110
       110
       -
           }

     

       111
       111
       -
       

     

       112
       112
       -
           .stat-value {

     

       113
       113
       -
             font-size: 2rem;

     

       114
       114
       -
             font-weight: 700;

     

       115
       115
       -
             color: var(--primary);

     

       116
       116
       -
             margin-bottom: 0.25rem;

     

       117
       117
       -
           }

     

       118
       118
       -
       

     

       119
       119
       -
           .stat-label {

     

       120
       120
       -
             color: var(--text);

     

       121
       121
       -
             opacity: 0.7;

     

       122
       122
       -
             font-size: 0.875rem;

     

       123
       123
       -
           }

     

       124
       124
       -
       

     

       125
       125
       -
           .timestamp {

     

       126
       126
       -
             color: var(--text);

     

       127
       127
       -
             opacity: 0.6;

     

       128
       128
       -
             font-size: 0.875rem;

     

       129
       129
       -
           }

     

       130
       130
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/admin.css">

     

       131
       14
        
       </head>

     

       132
       15
        
       

     

       133
       16
        
       <body>

     
···

       144
       27
        
         <main>

     

       145
       28
        
           <h1>Admin Dashboard</h1>

     

       146
       29
        
       

     

       147
       147
       -
           <div id="error-message" class="error" style="display: none;"></div>

     

       30
       30
       +
           <div id="error-message" class="error hidden"></div>

     

       148
       31
        
       

     

       149
       32
        
           <div id="loading" class="loading">Loading...</div>

     

       150
       33
        
       

     

       151
       151
       -
           <div id="content" style="display: none;">

     

       34
       34
       +
           <div id="content" class="hidden">

     

       152
       35
        
             <div class="stats">

     

       153
       36
        
               <div class="stat-card">

     

       154
       37
        
                 <div class="stat-value" id="total-users">0</div>

     
···

       211
       94
        
         <script type="module" src="../components/admin-classes.ts"></script>

     

       212
       95
        
         <script type="module" src="../components/user-modal.ts"></script>

     

       213
       96
        
         <script type="module" src="../components/transcript-view-modal.ts"></script>

     

       214
       214
       -
         <script type="module">

     

       215
       215
       -
           const transcriptionsComponent = document.getElementById('transcriptions-component');

     

       216
       216
       -
           const usersComponent = document.getElementById('users-component');

     

       217
       217
       -
           const userModal = document.getElementById('user-modal');

     

       218
       218
       -
           const transcriptModal = document.getElementById('transcript-modal');

     

       219
       219
       -
           const errorMessage = document.getElementById('error-message');

     

       220
       220
       -
           const loading = document.getElementById('loading');

     

       221
       221
       -
           const content = document.getElementById('content');

     

       222
       222
       -
       

     

       223
       223
       -
           // Modal functions

     

       224
       224
       -
           function openUserModal(userId) {

     

       225
       225
       -
             userModal.setAttribute('open', '');

     

       226
       226
       -
             userModal.userId = userId;

     

       227
       227
       -
           }

     

       228
       228
       -
       

     

       229
       229
       -
           function closeUserModal() {

     

       230
       230
       -
             userModal.removeAttribute('open');

     

       231
       231
       -
             userModal.userId = null;

     

       232
       232
       -
           }

     

       233
       233
       -
       

     

       234
       234
       -
           function openTranscriptModal(transcriptId) {

     

       235
       235
       -
             transcriptModal.setAttribute('open', '');

     

       236
       236
       -
             transcriptModal.transcriptId = transcriptId;

     

       237
       237
       -
           }

     

       238
       238
       -
       

     

       239
       239
       -
           function closeTranscriptModal() {

     

       240
       240
       -
             transcriptModal.removeAttribute('open');

     

       241
       241
       -
             transcriptModal.transcriptId = null;

     

       242
       242
       -
           }

     

       243
       243
       -
       

     

       244
       244
       -
           // Listen for component events

     

       245
       245
       -
           transcriptionsComponent.addEventListener('open-transcription', (e) => {

     

       246
       246
       -
             openTranscriptModal(e.detail.id);

     

       247
       247
       -
           });

     

       248
       248
       -
       

     

       249
       249
       -
           usersComponent.addEventListener('open-user', (e) => {

     

       250
       250
       -
             openUserModal(e.detail.id);

     

       251
       251
       -
           });

     

       252
       252
       -
       

     

       253
       253
       -
           // Listen for modal close events

     

       254
       254
       -
           userModal.addEventListener('close', closeUserModal);

     

       255
       255
       -
           userModal.addEventListener('user-updated', async () => {

     

       256
       256
       -
             await loadStats();

     

       257
       257
       -
           });

     

       258
       258
       -
           userModal.addEventListener('click', (e) => {

     

       259
       259
       -
             if (e.target === userModal) closeUserModal();

     

       260
       260
       -
           });

     

       261
       261
       -
       

     

       262
       262
       -
           transcriptModal.addEventListener('close', closeTranscriptModal);

     

       263
       263
       -
           transcriptModal.addEventListener('transcript-deleted', async () => {

     

       264
       264
       -
             await loadStats();

     

       265
       265
       -
           });

     

       266
       266
       -
           transcriptModal.addEventListener('click', (e) => {

     

       267
       267
       -
             if (e.target === transcriptModal) closeTranscriptModal();

     

       268
       268
       -
           });

     

       269
       269
       -
       

     

       270
       270
       -
           async function loadStats() {

     

       271
       271
       -
             try {

     

       272
       272
       -
               const [transcriptionsRes, usersRes] = await Promise.all([

     

       273
       273
       -
                 fetch('/api/admin/transcriptions'),

     

       274
       274
       -
                 fetch('/api/admin/users')

     

       275
       275
       -
               ]);

     

       276
       276
       -
       

     

       277
       277
       -
               if (!transcriptionsRes.ok || !usersRes.ok) {

     

       278
       278
       -
                 if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       279
       279
       -
                   window.location.href = '/';

     

       280
       280
       -
                   return;

     

       281
       281
       -
                 }

     

       282
       282
       -
                 throw new Error('Failed to load admin data');

     

       283
       283
       -
               }

     

       284
       284
       -
       

     

       285
       285
       -
               const transcriptions = await transcriptionsRes.json();

     

       286
       286
       -
               const users = await usersRes.json();

     

       287
       287
       -
       

     

       288
       288
       -
               document.getElementById('total-users').textContent = users.length;

     

       289
       289
       -
               document.getElementById('total-transcriptions').textContent = transcriptions.length;

     

       290
       290
       -
               

     

       291
       291
       -
               const failed = transcriptions.filter(t => t.status === 'failed');

     

       292
       292
       -
               document.getElementById('failed-transcriptions').textContent = failed.length;

     

       293
       293
       -
       

     

       294
       294
       -
               loading.style.display = 'none';

     

       295
       295
       -
               content.style.display = 'block';

     

       296
       296
       -
             } catch (error) {

     

       297
       297
       -
               errorMessage.textContent = error.message;

     

       298
       298
       -
               errorMessage.style.display = 'block';

     

       299
       299
       -
               loading.style.display = 'none';

     

       300
       300
       -
             }

     

       301
       301
       -
           }

     

       302
       302
       -
       

     

       303
       303
       -
           // Tab switching

     

       304
       304
       -
           function switchTab(tabName) {

     

       305
       305
       -
             document.querySelectorAll('.tab').forEach(t => {

     

       306
       306
       -
               t.classList.remove('active');

     

       307
       307
       -
             });

     

       308
       308
       -
             document.querySelectorAll('.tab-content').forEach(c => {

     

       309
       309
       -
               c.classList.remove('active');

     

       310
       310
       -
             });

     

       311
       311
       -
       

     

       312
       312
       -
             const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       313
       313
       -
             const tabContent = document.getElementById(`${tabName}-tab`);

     

       314
       314
       -
             

     

       315
       315
       -
             if (tabButton && tabContent) {

     

       316
       316
       -
               tabButton.classList.add('active');

     

       317
       317
       -
               tabContent.classList.add('active');

     

       318
       318
       -
               

     

       319
       319
       -
               // Update URL without reloading

     

       320
       320
       -
               const url = new URL(window.location.href);

     

       321
       321
       -
               url.searchParams.set('tab', tabName);

     

       322
       322
       -
               // Remove subtab param when leaving classes tab

     

       323
       323
       -
               if (tabName !== 'classes') {

     

       324
       324
       -
                 url.searchParams.delete('subtab');

     

       325
       325
       -
               }

     

       326
       326
       -
               window.history.pushState({}, '', url);

     

       327
       327
       -
             }

     

       328
       328
       -
           }

     

       329
       329
       -
       

     

       330
       330
       -
           document.querySelectorAll('.tab').forEach(tab => {

     

       331
       331
       -
             tab.addEventListener('click', () => {

     

       332
       332
       -
               switchTab(tab.dataset.tab);

     

       333
       333
       -
             });

     

       334
       334
       -
           });

     

       335
       335
       -
       

     

       336
       336
       -
           // Check for tab query parameter on load

     

       337
       337
       -
           const params = new URLSearchParams(window.location.search);

     

       338
       338
       -
           const initialTab = params.get('tab');

     

       339
       339
       -
           const validTabs = ['pending', 'transcriptions', 'users', 'classes'];

     

       340
       340
       -
           

     

       341
       341
       -
           if (initialTab && validTabs.includes(initialTab)) {

     

       342
       342
       -
             switchTab(initialTab);

     

       343
       343
       -
           }

     

       344
       344
       -
       

     

       345
       345
       -
           // Initialize

     

       346
       346
       -
           loadStats();

     

       347
       347
       -
         </script>

     

       97
       97
       +
         <script type="module" src="./admin.ts"></script>

     

       348
       98
        
       </body>

     

       349
       99
        
       

     

       350
       100
        
       </html>

+151

src/pages/admin.ts

···

       1
       1
       +
       const transcriptionsComponent = document.getElementById(

     

       2
       2
       +
       	"transcriptions-component",

     

       3
       3
       +
       ) as HTMLElement | null;

     

       4
       4
       +
       const usersComponent = document.getElementById(

     

       5
       5
       +
       	"users-component",

     

       6
       6
       +
       ) as HTMLElement | null;

     

       7
       7
       +
       const userModal = document.getElementById("user-modal") as HTMLElement | null;

     

       8
       8
       +
       const transcriptModal = document.getElementById(

     

       9
       9
       +
       	"transcript-modal",

     

       10
       10
       +
       ) as HTMLElement | null;

     

       11
       11
       +
       const errorMessage = document.getElementById("error-message") as HTMLElement;

     

       12
       12
       +
       const loading = document.getElementById("loading") as HTMLElement;

     

       13
       13
       +
       const content = document.getElementById("content") as HTMLElement;

     

       14
       14
       +
       

     

       15
       15
       +
       // Modal functions

     

       16
       16
       +
       function openUserModal(userId: string) {

     

       17
       17
       +
       	userModal.setAttribute("open", "");

     

       18
       18
       +
       	userModal.userId = userId;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       function closeUserModal() {

     

       22
       22
       +
       	userModal.removeAttribute("open");

     

       23
       23
       +
       	userModal.userId = null;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       function openTranscriptModal(transcriptId: string) {

     

       27
       27
       +
       	transcriptModal.setAttribute("open", "");

     

       28
       28
       +
       	transcriptModal.transcriptId = transcriptId;

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       function closeTranscriptModal() {

     

       32
       32
       +
       	transcriptModal.removeAttribute("open");

     

       33
       33
       +
       	transcriptModal.transcriptId = null;

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Listen for component events

     

       37
       37
       +
       transcriptionsComponent?.addEventListener(

     

       38
       38
       +
       	"open-transcription",

     

       39
       39
       +
       	(e: CustomEvent) => {

     

       40
       40
       +
       		openTranscriptModal(e.detail.id);

     

       41
       41
       +
       	},

     

       42
       42
       +
       );

     

       43
       43
       +
       

     

       44
       44
       +
       usersComponent?.addEventListener("open-user", (e: CustomEvent) => {

     

       45
       45
       +
       	openUserModal(e.detail.id);

     

       46
       46
       +
       });

     

       47
       47
       +
       

     

       48
       48
       +
       // Listen for modal close events

     

       49
       49
       +
       userModal?.addEventListener("close", closeUserModal);

     

       50
       50
       +
       userModal?.addEventListener("user-updated", async () => {

     

       51
       51
       +
       	await loadStats();

     

       52
       52
       +
       });

     

       53
       53
       +
       userModal?.addEventListener("click", (e: MouseEvent) => {

     

       54
       54
       +
       	if (e.target === userModal) closeUserModal();

     

       55
       55
       +
       });

     

       56
       56
       +
       

     

       57
       57
       +
       transcriptModal?.addEventListener("close", closeTranscriptModal);

     

       58
       58
       +
       transcriptModal?.addEventListener("transcript-deleted", async () => {

     

       59
       59
       +
       	await loadStats();

     

       60
       60
       +
       });

     

       61
       61
       +
       transcriptModal?.addEventListener("click", (e: MouseEvent) => {

     

       62
       62
       +
       	if (e.target === transcriptModal) closeTranscriptModal();

     

       63
       63
       +
       });

     

       64
       64
       +
       

     

       65
       65
       +
       async function loadStats() {

     

       66
       66
       +
       	try {

     

       67
       67
       +
       		const [transcriptionsRes, usersRes] = await Promise.all([

     

       68
       68
       +
       			fetch("/api/admin/transcriptions"),

     

       69
       69
       +
       			fetch("/api/admin/users"),

     

       70
       70
       +
       		]);

     

       71
       71
       +
       

     

       72
       72
       +
       		if (!transcriptionsRes.ok || !usersRes.ok) {

     

       73
       73
       +
       			if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       74
       74
       +
       				window.location.href = "/";

     

       75
       75
       +
       				return;

     

       76
       76
       +
       			}

     

       77
       77
       +
       			throw new Error("Failed to load admin data");

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		const transcriptions = await transcriptionsRes.json();

     

       81
       81
       +
       		const users = await usersRes.json();

     

       82
       82
       +
       

     

       83
       83
       +
       		const totalUsers = document.getElementById("total-users");

     

       84
       84
       +
       		const totalTranscriptions = document.getElementById("total-transcriptions");

     

       85
       85
       +
       		const failedTranscriptions = document.getElementById(

     

       86
       86
       +
       			"failed-transcriptions",

     

       87
       87
       +
       		);

     

       88
       88
       +
       

     

       89
       89
       +
       		if (totalUsers) totalUsers.textContent = users.length.toString();

     

       90
       90
       +
       		if (totalTranscriptions)

     

       91
       91
       +
       			totalTranscriptions.textContent = transcriptions.length.toString();

     

       92
       92
       +
       

     

       93
       93
       +
       		const failed = transcriptions.filter(

     

       94
       94
       +
       			(t: { status: string }) => t.status === "failed",

     

       95
       95
       +
       		);

     

       96
       96
       +
       		if (failedTranscriptions)

     

       97
       97
       +
       			failedTranscriptions.textContent = failed.length.toString();

     

       98
       98
       +
       

     

       99
       99
       +
       		loading.classList.add("hidden");

     

       100
       100
       +
       		content.classList.remove("hidden");

     

       101
       101
       +
       	} catch (error) {

     

       102
       102
       +
       		errorMessage.textContent = (error as Error).message;

     

       103
       103
       +
       		errorMessage.classList.remove("hidden");

     

       104
       104
       +
       		loading.classList.add("hidden");

     

       105
       105
       +
       	}

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       // Tab switching

     

       109
       109
       +
       function switchTab(tabName: string) {

     

       110
       110
       +
       	document.querySelectorAll(".tab").forEach((t) => {

     

       111
       111
       +
       		t.classList.remove("active");

     

       112
       112
       +
       	});

     

       113
       113
       +
       	document.querySelectorAll(".tab-content").forEach((c) => {

     

       114
       114
       +
       		c.classList.remove("active");

     

       115
       115
       +
       	});

     

       116
       116
       +
       

     

       117
       117
       +
       	const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       118
       118
       +
       	const tabContent = document.getElementById(`${tabName}-tab`);

     

       119
       119
       +
       

     

       120
       120
       +
       	if (tabButton && tabContent) {

     

       121
       121
       +
       		tabButton.classList.add("active");

     

       122
       122
       +
       		tabContent.classList.add("active");

     

       123
       123
       +
       

     

       124
       124
       +
       		// Update URL without reloading

     

       125
       125
       +
       		const url = new URL(window.location.href);

     

       126
       126
       +
       		url.searchParams.set("tab", tabName);

     

       127
       127
       +
       		// Remove subtab param when leaving classes tab

     

       128
       128
       +
       		if (tabName !== "classes") {

     

       129
       129
       +
       			url.searchParams.delete("subtab");

     

       130
       130
       +
       		}

     

       131
       131
       +
       		window.history.pushState({}, "", url);

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       document.querySelectorAll(".tab").forEach((tab) => {

     

       136
       136
       +
       	tab.addEventListener("click", () => {

     

       137
       137
       +
       		switchTab((tab as HTMLElement).dataset.tab || "");

     

       138
       138
       +
       	});

     

       139
       139
       +
       });

     

       140
       140
       +
       

     

       141
       141
       +
       // Check for tab query parameter on load

     

       142
       142
       +
       const params = new URLSearchParams(window.location.search);

     

       143
       143
       +
       const initialTab = params.get("tab");

     

       144
       144
       +
       const validTabs = ["pending", "transcriptions", "users", "classes"];

     

       145
       145
       +
       

     

       146
       146
       +
       if (initialTab && validTabs.includes(initialTab)) {

     

       147
       147
       +
       	switchTab(initialTab);

     

       148
       148
       +
       }

     

       149
       149
       +
       

     

       150
       150
       +
       // Initialize

     

       151
       151
       +
       loadStats();

+2 -85

src/pages/index.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .hero-title {

     

       15
       15
       -
             font-size: 3rem;

     

       16
       16
       -
             font-weight: 700;

     

       17
       17
       -
             color: var(--text);

     

       18
       18
       -
             margin-bottom: 1rem;

     

       19
       19
       -
           }

     

       20
       20
       -
       

     

       21
       21
       -
           .hero-subtitle {

     

       22
       22
       -
             font-size: 1.25rem;

     

       23
       23
       -
             color: var(--text);

     

       24
       24
       -
             opacity: 0.8;

     

       25
       25
       -
             margin-bottom: 2rem;

     

       26
       26
       -
           }

     

       27
       27
       -
       

     

       28
       28
       -
           main {

     

       29
       29
       -
             text-align: center;

     

       30
       30
       -
             padding: 4rem 2rem;

     

       31
       31
       -
           }

     

       32
       32
       -
       

     

       33
       33
       -
           .cta-buttons {

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             gap: 1rem;

     

       36
       36
       -
             justify-content: center;

     

       37
       37
       -
             margin-top: 2rem;

     

       38
       38
       -
           }

     

       39
       39
       -
       

     

       40
       40
       -
           .btn {

     

       41
       41
       -
             padding: 0.75rem 1.5rem;

     

       42
       42
       -
             border-radius: 6px;

     

       43
       43
       -
             font-size: 1rem;

     

       44
       44
       -
             font-weight: 500;

     

       45
       45
       -
             cursor: pointer;

     

       46
       46
       -
             transition: all 0.2s;

     

       47
       47
       -
             font-family: inherit;

     

       48
       48
       -
             border: 2px solid;

     

       49
       49
       -
             text-decoration: none;

     

       50
       50
       -
             display: inline-block;

     

       51
       51
       -
           }

     

       52
       52
       -
       

     

       53
       53
       -
           .btn-primary {

     

       54
       54
       -
             background: var(--primary);

     

       55
       55
       -
             color: white;

     

       56
       56
       -
             border-color: var(--primary);

     

       57
       57
       -
           }

     

       58
       58
       -
       

     

       59
       59
       -
           .btn-primary:hover {

     

       60
       60
       -
             background: transparent;

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .btn-secondary {

     

       65
       65
       -
             background: transparent;

     

       66
       66
       -
             color: var(--text);

     

       67
       67
       -
             border-color: var(--secondary);

     

       68
       68
       -
           }

     

       69
       69
       -
       

     

       70
       70
       -
           .btn-secondary:hover {

     

       71
       71
       -
             border-color: var(--primary);

     

       72
       72
       -
             color: var(--primary);

     

       73
       73
       -
           }

     

       74
       74
       -
       

     

       75
       75
       -
           @media (max-width: 640px) {

     

       76
       76
       -
             .hero-title {

     

       77
       77
       -
               font-size: 2.5rem;

     

       78
       78
       -
             }

     

       79
       79
       -
       

     

       80
       80
       -
             .cta-buttons {

     

       81
       81
       -
               flex-direction: column;

     

       82
       82
       -
               align-items: center;

     

       83
       83
       -
             }

     

       84
       84
       -
           }

     

       85
       85
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/index.css">

     

       86
       14
        
       </head>

     

       87
       15
        
       

     

       88
       16
        
       <body>

     
···

       106
       34
        
         </main>

     

       107
       35
        
       

     

       108
       36
        
         <script type="module" src="../components/auth.ts"></script>

     

       109
       109
       -
         <script type="module">

     

       110
       110
       -
           document.getElementById('start-btn').addEventListener('click', async () => {

     

       111
       111
       -
             const authComponent = document.querySelector('auth-component');

     

       112
       112
       -
             const isLoggedIn = await authComponent.isAuthenticated();

     

       113
       113
       -
       

     

       114
       114
       -
             if (isLoggedIn) {

     

       115
       115
       -
               window.location.href = '/classes';

     

       116
       116
       -
             } else {

     

       117
       117
       -
               authComponent.openAuthModal();

     

       118
       118
       -
             }

     

       119
       119
       -
           });

     

       120
       120
       -
         </script>

     

       37
       37
       +
         <script type="module" src="./index.ts"></script>

     

       121
       38
        
       </body>

     

       122
       39
        
       

     

       123
       40
        
       </html>

+14

src/pages/index.ts

···

       1
       1
       +
       document.getElementById("start-btn")?.addEventListener("click", async () => {

     

       2
       2
       +
       	const authComponent = document.querySelector("auth-component");

     

       3
       3
       +
       	if (!authComponent) return;

     

       4
       4
       +
       

     

       5
       5
       +
       	const isLoggedIn = await (

     

       6
       6
       +
       		authComponent as { isAuthenticated: () => Promise<boolean> }

     

       7
       7
       +
       	).isAuthenticated();

     

       8
       8
       +
       

     

       9
       9
       +
       	if (isLoggedIn) {

     

       10
       10
       +
       		window.location.href = "/classes";

     

       11
       11
       +
       	} else {

     

       12
       12
       +
       		(authComponent as { openAuthModal: () => void }).openAuthModal();

     

       13
       13
       +
       	}

     

       14
       14
       +
       });

+2 -20

src/pages/reset-password.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           main {

     

       15
       15
       -
             display: flex;

     

       16
       16
       -
             align-items: center;

     

       17
       17
       -
             justify-content: center;

     

       18
       18
       -
             padding: 4rem 1rem;

     

       19
       19
       -
           }

     

       20
       20
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/reset-password.css">

     

       21
       14
        
       </head>

     

       22
       15
        
       

     

       23
       16
        
       <body>

     
···

       37
       30
        
       

     

       38
       31
        
         <script type="module" src="../components/auth.ts"></script>

     

       39
       32
        
         <script type="module" src="../components/reset-password-form.ts"></script>

     

       40
       40
       -
         <script type="module">

     

       41
       41
       -
           // Wait for component to be defined before setting token

     

       42
       42
       -
           await customElements.whenDefined('reset-password-form');

     

       43
       43
       -
           

     

       44
       44
       -
           // Get token from URL and pass to component

     

       45
       45
       -
           const urlParams = new URLSearchParams(window.location.search);

     

       46
       46
       -
           const token = urlParams.get('token');

     

       47
       47
       -
           const resetForm = document.getElementById('reset-form');

     

       48
       48
       -
           if (resetForm) {

     

       49
       49
       -
             resetForm.token = token;

     

       50
       50
       -
           }

     

       51
       51
       -
         </script>

     

       33
       33
       +
         <script type="module" src="./reset-password.ts"></script>

     

       52
       34
        
       </body>

     

       53
       35
        
       

     

       54
       36
        
       </html>

+10

src/pages/reset-password.ts

···

       1
       1
       +
       // Wait for component to be defined before setting token

     

       2
       2
       +
       await customElements.whenDefined("reset-password-form");

     

       3
       3
       +
       

     

       4
       4
       +
       // Get token from URL and pass to component

     

       5
       5
       +
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       6
       +
       const token = urlParams.get("token");

     

       7
       7
       +
       const resetForm = document.getElementById("reset-form");

     

       8
       8
       +
       if (resetForm) {

     

       9
       9
       +
       	(resetForm as { token: string | null }).token = token;

     

       10
       10
       +
       }

+1 -6

src/pages/settings.html

···

       10
       10
        
       	<link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
       	<link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
       	<link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
       

     

       14
       14
       -
       	<style>

     

       15
       15
       -
       		main {

     

       16
       16
       -
       			max-width: 64rem;

     

       17
       17
       -
       		}

     

       18
       18
       -
       	</style>

     

       13
       13
       +
       	<link rel="stylesheet" href="../styles/settings.css">

     

       19
       14
        
       </head>

     

       20
       15
        
       

     

       21
       16
        
       <body>

+3 -21

src/pages/transcribe.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .page-header {

     

       15
       15
       -
             text-align: center;

     

       16
       16
       -
             margin-bottom: 3rem;

     

       17
       17
       -
           }

     

       18
       18
       -
       

     

       19
       19
       -
           .page-title {

     

       20
       20
       -
             font-size: 2.5rem;

     

       21
       21
       -
             font-weight: 700;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
             margin-bottom: 0.5rem;

     

       24
       24
       -
           }

     

       25
       25
       -
       

     

       26
       26
       -
           .page-subtitle {

     

       27
       27
       -
             font-size: 1.125rem;

     

       28
       28
       -
             color: var(--text);

     

       29
       29
       -
             opacity: 0.8;

     

       30
       30
       -
           }

     

       31
       31
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/transcribe.css">

     

       32
       14
        
       </head>

     

       33
       15
        
       

     

       34
       16
        
       <body>

     
···

       43
       25
        
         </header>

     

       44
       26
        
       

     

       45
       27
        
         <main>

     

       46
       46
       -
           <div style="margin-bottom: 1rem;">

     

       47
       47
       -
             <a href="/classes" style="color: var(--paynes-gray); text-decoration: none; font-size: 0.875rem;">

     

       28
       28
       +
           <div class="mb-1">

     

       29
       29
       +
             <a href="/classes" class="back-link">

     

       48
       30
        
               ← Back to classes

     

       49
       31
        
             </a>

     

       50
       32
        
           </div>

+120

src/styles/admin.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 80rem;

     

       3
       3
       +
       	margin: 0 auto;

     

       4
       4
       +
       	padding: 2rem;

     

       5
       5
       +
       }

     

       6
       6
       +
       

     

       7
       7
       +
       h1 {

     

       8
       8
       +
       	margin-bottom: 2rem;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       }

     

       11
       11
       +
       

     

       12
       12
       +
       .section {

     

       13
       13
       +
       	margin-bottom: 3rem;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       .section-title {

     

       17
       17
       +
       	font-size: 1.5rem;

     

       18
       18
       +
       	font-weight: 600;

     

       19
       19
       +
       	color: var(--text);

     

       20
       20
       +
       	margin-bottom: 1rem;

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	align-items: center;

     

       23
       23
       +
       	gap: 0.5rem;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       .tabs {

     

       27
       27
       +
       	display: flex;

     

       28
       28
       +
       	gap: 1rem;

     

       29
       29
       +
       	border-bottom: 2px solid var(--secondary);

     

       30
       30
       +
       	margin-bottom: 2rem;

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       .tab {

     

       34
       34
       +
       	padding: 0.75rem 1.5rem;

     

       35
       35
       +
       	border: none;

     

       36
       36
       +
       	background: transparent;

     

       37
       37
       +
       	color: var(--text);

     

       38
       38
       +
       	cursor: pointer;

     

       39
       39
       +
       	font-size: 1rem;

     

       40
       40
       +
       	font-weight: 500;

     

       41
       41
       +
       	font-family: inherit;

     

       42
       42
       +
       	border-bottom: 2px solid transparent;

     

       43
       43
       +
       	margin-bottom: -2px;

     

       44
       44
       +
       	transition: all 0.2s;

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       .tab:hover {

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .tab.active {

     

       52
       52
       +
       	color: var(--primary);

     

       53
       53
       +
       	border-bottom-color: var(--primary);

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       .tab-content {

     

       57
       57
       +
       	display: none;

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       60
       60
       +
       .tab-content.active {

     

       61
       61
       +
       	display: block;

     

       62
       62
       +
       }

     

       63
       63
       +
       

     

       64
       64
       +
       .empty-state {

     

       65
       65
       +
       	text-align: center;

     

       66
       66
       +
       	padding: 3rem;

     

       67
       67
       +
       	color: var(--text);

     

       68
       68
       +
       	opacity: 0.6;

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       .loading {

     

       72
       72
       +
       	text-align: center;

     

       73
       73
       +
       	padding: 3rem;

     

       74
       74
       +
       	color: var(--text);

     

       75
       75
       +
       }

     

       76
       76
       +
       

     

       77
       77
       +
       .error {

     

       78
       78
       +
       	background: #fee2e2;

     

       79
       79
       +
       	color: #991b1b;

     

       80
       80
       +
       	padding: 1rem;

     

       81
       81
       +
       	border-radius: 6px;

     

       82
       82
       +
       	margin-bottom: 1rem;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       .stats {

     

       86
       86
       +
       	display: grid;

     

       87
       87
       +
       	grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       88
       +
       	gap: 1rem;

     

       89
       89
       +
       	margin-bottom: 2rem;

     

       90
       90
       +
       }

     

       91
       91
       +
       

     

       92
       92
       +
       .stat-card {

     

       93
       93
       +
       	background: var(--background);

     

       94
       94
       +
       	border: 2px solid var(--secondary);

     

       95
       95
       +
       	border-radius: 8px;

     

       96
       96
       +
       	padding: 1.5rem;

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       .stat-value {

     

       100
       100
       +
       	font-size: 2rem;

     

       101
       101
       +
       	font-weight: 700;

     

       102
       102
       +
       	color: var(--primary);

     

       103
       103
       +
       	margin-bottom: 0.25rem;

     

       104
       104
       +
       }

     

       105
       105
       +
       

     

       106
       106
       +
       .stat-label {

     

       107
       107
       +
       	color: var(--text);

     

       108
       108
       +
       	opacity: 0.7;

     

       109
       109
       +
       	font-size: 0.875rem;

     

       110
       110
       +
       }

     

       111
       111
       +
       

     

       112
       112
       +
       .timestamp {

     

       113
       113
       +
       	color: var(--text);

     

       114
       114
       +
       	opacity: 0.6;

     

       115
       115
       +
       	font-size: 0.875rem;

     

       116
       116
       +
       }

     

       117
       117
       +
       

     

       118
       118
       +
       .hidden {

     

       119
       119
       +
       	display: none;

     

       120
       120
       +
       }

+71

src/styles/index.css

···

       1
       1
       +
       .hero-title {

     

       2
       2
       +
       	font-size: 3rem;

     

       3
       3
       +
       	font-weight: 700;

     

       4
       4
       +
       	color: var(--text);

     

       5
       5
       +
       	margin-bottom: 1rem;

     

       6
       6
       +
       }

     

       7
       7
       +
       

     

       8
       8
       +
       .hero-subtitle {

     

       9
       9
       +
       	font-size: 1.25rem;

     

       10
       10
       +
       	color: var(--text);

     

       11
       11
       +
       	opacity: 0.8;

     

       12
       12
       +
       	margin-bottom: 2rem;

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       main {

     

       16
       16
       +
       	text-align: center;

     

       17
       17
       +
       	padding: 4rem 2rem;

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       .cta-buttons {

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	gap: 1rem;

     

       23
       23
       +
       	justify-content: center;

     

       24
       24
       +
       	margin-top: 2rem;

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       .btn {

     

       28
       28
       +
       	padding: 0.75rem 1.5rem;

     

       29
       29
       +
       	border-radius: 6px;

     

       30
       30
       +
       	font-size: 1rem;

     

       31
       31
       +
       	font-weight: 500;

     

       32
       32
       +
       	cursor: pointer;

     

       33
       33
       +
       	transition: all 0.2s;

     

       34
       34
       +
       	font-family: inherit;

     

       35
       35
       +
       	border: 2px solid;

     

       36
       36
       +
       	text-decoration: none;

     

       37
       37
       +
       	display: inline-block;

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       .btn-primary {

     

       41
       41
       +
       	background: var(--primary);

     

       42
       42
       +
       	color: white;

     

       43
       43
       +
       	border-color: var(--primary);

     

       44
       44
       +
       }

     

       45
       45
       +
       

     

       46
       46
       +
       .btn-primary:hover {

     

       47
       47
       +
       	background: transparent;

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .btn-secondary {

     

       52
       52
       +
       	background: transparent;

     

       53
       53
       +
       	color: var(--text);

     

       54
       54
       +
       	border-color: var(--secondary);

     

       55
       55
       +
       }

     

       56
       56
       +
       

     

       57
       57
       +
       .btn-secondary:hover {

     

       58
       58
       +
       	border-color: var(--primary);

     

       59
       59
       +
       	color: var(--primary);

     

       60
       60
       +
       }

     

       61
       61
       +
       

     

       62
       62
       +
       @media (max-width: 640px) {

     

       63
       63
       +
       	.hero-title {

     

       64
       64
       +
       		font-size: 2.5rem;

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	.cta-buttons {

     

       68
       68
       +
       		flex-direction: column;

     

       69
       69
       +
       		align-items: center;

     

       70
       70
       +
       	}

     

       71
       71
       +
       }

src/styles/reset-password.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	display: flex;

     

       3
       3
       +
       	align-items: center;

     

       4
       4
       +
       	justify-content: center;

     

       5
       5
       +
       	padding: 4rem 1rem;

     

       6
       6
       +
       }

src/styles/settings.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 64rem;

     

       3
       3
       +
       }

+27

src/styles/transcribe.css

···

       1
       1
       +
       .page-header {

     

       2
       2
       +
       	text-align: center;

     

       3
       3
       +
       	margin-bottom: 3rem;

     

       4
       4
       +
       }

     

       5
       5
       +
       

     

       6
       6
       +
       .page-title {

     

       7
       7
       +
       	font-size: 2.5rem;

     

       8
       8
       +
       	font-weight: 700;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       	margin-bottom: 0.5rem;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       .page-subtitle {

     

       14
       14
       +
       	font-size: 1.125rem;

     

       15
       15
       +
       	color: var(--text);

     

       16
       16
       +
       	opacity: 0.8;

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       .back-link {

     

       20
       20
       +
       	color: var(--paynes-gray);

     

       21
       21
       +
       	text-decoration: none;

     

       22
       22
       +
       	font-size: 0.875rem;

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       .mb-1 {

     

       26
       26
       +
       	margin-bottom: 1rem;

     

       27
       27
       +
       }

Compare changes