comparing 3756b706c460dd50c8bb436258ecd12c7e1fb433 and main on dunkirk.sh/thistle

+1 -1

.env.example

···

       7
        
       # Configure your LLM service endpoint and credentials

     

       8
        
       LLM_API_KEY=paste_your_api_key_here

     

       9
        
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       -
       LLM_MODEL=anthropic/claude-3.5-sonnet

     

       11
        
       

     

       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
        
       # In development, these default to localhost values

···

       7
        
       # Configure your LLM service endpoint and credentials

     

       8
        
       LLM_API_KEY=paste_your_api_key_here

     

       9
        
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       +
       LLM_MODEL=moonshotai/kimi-k2-0905

     

       11
        
       

     

       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
        
       # In development, these default to localhost values

+2 -2

package.json

···

       6
        
       	"scripts": {

     

       7
        
       		"dev": "bun run src/index.ts --hot",

     

       8
        
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       -
       		"test": "bun test",

     

       10
       -
       		"test:integration": "bun test src/index.test.ts",

     

       11
        
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
        
       	},

     

       13
        
       	"devDependencies": {

···

       6
        
       	"scripts": {

     

       7
        
       		"dev": "bun run src/index.ts --hot",

     

       8
        
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       +
       		"test": "NODE_ENV=test bun test",

     

       10
       +
       		"test:integration": "NODE_ENV=test bun test src/index.test.ts",

     

       11
        
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
        
       	},

     

       13
        
       	"devDependencies": {

+39

scripts/remove-from-classes.ts

···

       1
       +
       #!/usr/bin/env bun

     

       2
       +
       

     

       3
       +
       import db from "../src/db/schema";

     

       4
       +
       

     

       5
       +
       const email = process.argv[2];

     

       6
       +
       

     

       7
       +
       if (!email) {

     

       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       +
       	process.exit(1);

     

       11
       +
       }

     

       12
       +
       

     

       13
       +
       const user = db

     

       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       +
       	)

     

       17
       +
       	.get(email);

     

       18
       +
       

     

       19
       +
       if (!user) {

     

       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       +
       	process.exit(1);

     

       22
       +
       }

     

       23
       +
       

     

       24
       +
       // Get current enrollments

     

       25
       +
       const enrollments = db

     

       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       +
       	)

     

       29
       +
       	.all(user.id);

     

       30
       +
       

     

       31
       +
       if (enrollments.length === 0) {

     

       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       +
       	process.exit(0);

     

       34
       +
       }

     

       35
       +
       

     

       36
       +
       // Remove from all classes

     

       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       +
       

     

       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+215 -15

src/components/admin-classes.ts

···

       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       42
        
       	@state() showModal = false;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       43
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       0
        
       
     

       44
        
       	@state() editingClass = {

     

       45
        
       		courseCode: "",

     

       46
        
       		courseName: "",

     
···

       664
        
       		this.showModal = true;

     

       665
        
       	}

     

       666
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       667
        
       	private getFilteredClasses() {

     

       668
        
       		if (!this.searchTerm) return this.classes;

     

       669
        
       

     
···

       714
        
       			}

     

       715
        
       

     

       716
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       0
        
       
     

       717
        
           `;

     

       718
        
       	}

     

       719
        
       

     
···

       743
        
                 <div class="classes-grid">

     

       744
        
                   ${filteredClasses.map(

     

       745
        
       							(cls) => html`

     

       746
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       747
        
                       <div class="class-header">

     

       748
        
                         <div class="class-info">

     

       749
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       756
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       757
        
                           </div>

     

       758
        
                         </div>

     

       759
       -
                         <div class="actions">

     

       760
       -
                           <button

     

       761
       -
                             class="btn-archive"

     

       762
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       763
       -
                           >

     

       764
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       765
       -
                           </button>

     

       766
       -
                           <button

     

       767
       -
                             class="btn-delete"

     

       768
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       769
       -
                           >

     

       770
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       771
       -
                           </button>

     

       772
       -
                         </div>

     

       773
        
                       </div>

     

       774
        
                     </div>

     

       775
        
                   `,

     
···

       780
        
           `;

     

       781
        
       	}

     

       782
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       783
        
       	private renderWaitlist() {

     

       784
        
       		return html`

     

       785
        
             ${

     
···

       865
        
       		this.meetingTimes = e.detail;

     

       866
        
       	}

     

       867
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       868
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       869
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       870
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       874
        
       		this.showModal = false;

     

       875
        
       		this.approvingEntry = null;

     

       876
        
       		this.meetingTimes = [];

     

       0
        
       
     

       877
        
       		this.editingClass = {

     

       878
        
       			courseCode: "",

     

       879
        
       			courseName: "",

     
···

       903
        
       					semester: this.editingClass.semester,

     

       904
        
       					year: this.editingClass.year,

     

       905
        
       					meeting_times: labels,

     

       0
        
       
     

       906
        
       				}),

     

       907
        
       			});

     

       908
        
       

     
···

       1018
        
                       .value=${this.meetingTimes}

     

       1019
        
                       @change=${this.handleMeetingTimesChange}

     

       1020
        
                     ></meeting-time-picker>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1021
        
                   </div>

     

       1022
        
                 </div>

     

       1023

···

       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       42
        
       	@state() showModal = false;

     

       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       +
       	@state() newSectionNumber = "";

     

       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       +
       	@state() sections: string[] = [];

     

       50
        
       	@state() editingClass = {

     

       51
        
       		courseCode: "",

     

       52
        
       		courseName: "",

     
···

       670
        
       		this.showModal = true;

     

       671
        
       	}

     

       672
        
       

     

       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       +
       		try {

     

       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       +
       			

     

       678
       +
       			const data = await response.json();

     

       679
       +
       			this.editingClassId = classId;

     

       680
       +
       			this.editingClassInfo = data.class;

     

       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       +
       			this.newSectionNumber = "";

     

       683
       +
       			this.showClassSettingsModal = true;

     

       684
       +
       		} catch {

     

       685
       +
       			this.error = "Failed to load class details";

     

       686
       +
       		}

     

       687
       +
       	}

     

       688
       +
       

     

       689
       +
       	private async handleAddSection() {

     

       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       +
       

     

       692
       +
       		try {

     

       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       +
       				method: "POST",

     

       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       +
       			});

     

       698
       +
       

     

       699
       +
       			if (!response.ok) {

     

       700
       +
       				const data = await response.json();

     

       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       +
       				return;

     

       703
       +
       			}

     

       704
       +
       

     

       705
       +
       			const newSection = await response.json();

     

       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       +
       			this.newSectionNumber = "";

     

       708
       +
       		} catch {

     

       709
       +
       			this.error = "Failed to add section";

     

       710
       +
       		}

     

       711
       +
       	}

     

       712
       +
       

     

       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       +
       		if (!this.editingClassId) return;

     

       715
       +
       

     

       716
       +
       		try {

     

       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       +
       				method: "DELETE",

     

       719
       +
       			});

     

       720
       +
       

     

       721
       +
       			if (!response.ok) {

     

       722
       +
       				const data = await response.json();

     

       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       +
       				return;

     

       725
       +
       			}

     

       726
       +
       

     

       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       +
       		} catch {

     

       729
       +
       			this.error = "Failed to delete section";

     

       730
       +
       		}

     

       731
       +
       	}

     

       732
       +
       

     

       733
       +
       	private handleCloseSectionsModal() {

     

       734
       +
       		this.showClassSettingsModal = false;

     

       735
       +
       		this.editingClassId = null;

     

       736
       +
       		this.editingClassInfo = null;

     

       737
       +
       		this.editingClassSections = [];

     

       738
       +
       		this.newSectionNumber = "";

     

       739
       +
       		this.loadData();

     

       740
       +
       	}

     

       741
       +
       

     

       742
       +
       

     

       743
        
       	private getFilteredClasses() {

     

       744
        
       		if (!this.searchTerm) return this.classes;

     

       745
        
       

     
···

       790
        
       			}

     

       791
        
       

     

       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       794
        
           `;

     

       795
        
       	}

     

       796
        
       

     
···

       820
        
                 <div class="classes-grid">

     

       821
        
                   ${filteredClasses.map(

     

       822
        
       							(cls) => html`

     

       823
       +
                     <div 

     

       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       +
                       style="cursor: pointer;"

     

       827
       +
                     >

     

       828
        
                       <div class="class-header">

     

       829
        
                         <div class="class-info">

     

       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       838
        
                           </div>

     

       839
        
                         </div>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       840
        
                       </div>

     

       841
        
                     </div>

     

       842
        
                   `,

     
···

       847
        
           `;

     

       848
        
       	}

     

       849
        
       

     

       850
       +
       	private renderClassSettingsModal() {

     

       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       +
       

     

       853
       +
       		return html`

     

       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       +
                 <div class="modal-header">

     

       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       +
                 </div>

     

       860
       +
       

     

       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       +
                     <button

     

       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       +
                     >

     

       866
       +
                       Sections

     

       867
       +
                     </button>

     

       868
       +
                   </div>

     

       869
       +
                 </div>

     

       870
       +
       

     

       871
       +
                 <!-- Sections Tab -->

     

       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       +
                   

     

       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       +
                     <input

     

       877
       +
                       type="text"

     

       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       +
                       .value=${this.newSectionNumber}

     

       880
       +
                       @input=${(e: Event) => {

     

       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       +
       								}}

     

       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       +
       									if (e.key === "Enter") {

     

       885
       +
       										e.preventDefault();

     

       886
       +
       										this.handleAddSection();

     

       887
       +
       									}

     

       888
       +
       								}}

     

       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       +
                     />

     

       891
       +
                     <button

     

       892
       +
                       @click=${this.handleAddSection}

     

       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       +
                     >

     

       896
       +
                       Add Section

     

       897
       +
                     </button>

     

       898
       +
                   </div>

     

       899
       +
       

     

       900
       +
                   ${

     

       901
       +
       							this.editingClassSections.length === 0

     

       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       +
       								: html`

     

       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       +
                         ${this.editingClassSections.map(

     

       906
       +
       										(section) => html`

     

       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       +
                             <button

     

       910
       +
                               @click=${(e: Event) => {

     

       911
       +
       													e.stopPropagation();

     

       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       +
       												}}

     

       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       +
                             >

     

       916
       +
                               Delete

     

       917
       +
                             </button>

     

       918
       +
                           </div>

     

       919
       +
                         `,

     

       920
       +
       									)}

     

       921
       +
                       </div>

     

       922
       +
                     `

     

       923
       +
       						}

     

       924
       +
                 </div>

     

       925
       +
       

     

       926
       +
                 <!-- Actions -->

     

       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       +
                     <button

     

       930
       +
                       @click=${(e: Event) => {

     

       931
       +
       									e.stopPropagation();

     

       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       +
       									this.handleCloseSectionsModal();

     

       934
       +
       								}}

     

       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       +
                     >

     

       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       +
                     </button>

     

       939
       +
                     <button

     

       940
       +
                       @click=${(e: Event) => {

     

       941
       +
       									e.stopPropagation();

     

       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       +
       								}}

     

       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       +
                     >

     

       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       +
                     </button>

     

       948
       +
                   </div>

     

       949
       +
                   <button

     

       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       +
                   >

     

       953
       +
                     Done

     

       954
       +
                   </button>

     

       955
       +
                 </div>

     

       956
       +
       

     

       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       +
               </div>

     

       959
       +
             </div>

     

       960
       +
           `;

     

       961
       +
       	}

     

       962
       +
       

     

       963
        
       	private renderWaitlist() {

     

       964
        
       		return html`

     

       965
        
             ${

     
···

       1045
        
       		this.meetingTimes = e.detail;

     

       1046
        
       	}

     

       1047
        
       

     

       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       +
       		this.sections = value

     

       1051
       +
       			.split(",")

     

       1052
       +
       			.map((s) => s.trim())

     

       1053
       +
       			.filter((s) => s);

     

       1054
       +
       	}

     

       1055
       +
       

     

       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       1062
        
       		this.showModal = false;

     

       1063
        
       		this.approvingEntry = null;

     

       1064
        
       		this.meetingTimes = [];

     

       1065
       +
       		this.sections = [];

     

       1066
        
       		this.editingClass = {

     

       1067
        
       			courseCode: "",

     

       1068
        
       			courseName: "",

     
···

       1092
        
       					semester: this.editingClass.semester,

     

       1093
        
       					year: this.editingClass.year,

     

       1094
        
       					meeting_times: labels,

     

       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       1096
        
       				}),

     

       1097
        
       			});

     

       1098
        
       

     
···

       1208
        
                       .value=${this.meetingTimes}

     

       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       1210
        
                     ></meeting-time-picker>

     

       1211
       +
                   </div>

     

       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       +
                     <input

     

       1215
       +
                       type="text"

     

       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       +
                     />

     

       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       1221
        
                   </div>

     

       1222
        
                 </div>

     

       1223

+112 -6

src/components/class-view.ts

···

       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
        
       import "./upload-recording-modal.ts";

     

       4
        
       import "./vtt-viewer.ts";

     

       0
        
       
     

       5
        
       

     

       6
        
       interface Class {

     

       7
        
       	id: string;

     
···

       24
        
       	id: string;

     

       25
        
       	user_id: number;

     

       26
        
       	meeting_time_id: string | null;

     

       0
        
       
     

       27
        
       	filename: string;

     

       28
        
       	original_filename: string;

     

       29
        
       	status:

     
···

       42
        
       	audioUrl?: string;

     

       43
        
       }

     

       44
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       45
        
       @customElement("class-view")

     

       46
        
       export class ClassView extends LitElement {

     

       47
        
       	@state() classId = "";

     

       48
        
       	@state() classInfo: Class | null = null;

     

       49
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       50
        
       	@state() transcriptions: Transcription[] = [];

     

       51
        
       	@state() isLoading = true;

     

       52
        
       	@state() error: string | null = null;

     
···

       363
        
       			const data = await response.json();

     

       364
        
       			this.classInfo = data.class;

     

       365
        
       			this.meetingTimes = data.meetingTimes || [];

     

       0
        
       
     

       0
        
       
     

       366
        
       			this.transcriptions = data.transcriptions || [];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       367
        
       

     

       368
        
       			// Load VTT for completed transcriptions

     

       369
        
       			await this.loadVTTForCompleted();

     
···

       450
        
       	}

     

       451
        
       

     

       452
        
       	private get filteredTranscriptions() {

     

       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       454
        
       

     

       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       -
       		);

     

       459
        
       	}

     

       460
        
       

     

       461
        
       	private formatDate(timestamp: number): string {

     
···

       521
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
        
                   <h1>${this.classInfo.name}</h1>

     

       523
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       525
        
                 </div>

     

       526
        
               </div>

     

       527
        
       

     
···

       549
        
               `

     

       550
        
       						: html`

     

       551
        
               <div class="search-upload">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       552
        
                 <input

     

       553
        
                   type="text"

     

       554
        
                   class="search-box"

     
···

       567
        
                 </button>

     

       568
        
               </div>

     

       569
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       570
        
               ${

     

       571
        
       					this.filteredTranscriptions.length === 0

     

       572
        
       						? html`

     
···

       631
        
               ?open=${this.uploadModalOpen}

     

       632
        
               .classId=${this.classId}

     

       633
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       0
        
       
     

       0
        
       
     

       634
        
               @close=${this.handleModalClose}

     

       635
        
               @upload-success=${this.handleUploadSuccess}

     

       636
        
             ></upload-recording-modal>

···

       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
        
       import "./upload-recording-modal.ts";

     

       4
        
       import "./vtt-viewer.ts";

     

       5
       +
       import "./pending-recordings-view.ts";

     

       6
        
       

     

       7
        
       interface Class {

     

       8
        
       	id: string;

     
···

       25
        
       	id: string;

     

       26
        
       	user_id: number;

     

       27
        
       	meeting_time_id: string | null;

     

       28
       +
       	section_id: string | null;

     

       29
        
       	filename: string;

     

       30
        
       	original_filename: string;

     

       31
        
       	status:

     
···

       44
        
       	audioUrl?: string;

     

       45
        
       }

     

       46
        
       

     

       47
       +
       interface ClassSection {

     

       48
       +
       	id: string;

     

       49
       +
       	section_number: string;

     

       50
       +
       }

     

       51
       +
       

     

       52
        
       @customElement("class-view")

     

       53
        
       export class ClassView extends LitElement {

     

       54
        
       	@state() classId = "";

     

       55
        
       	@state() classInfo: Class | null = null;

     

       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       +
       	@state() userSection: string | null = null;

     

       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       60
        
       	@state() transcriptions: Transcription[] = [];

     

       61
        
       	@state() isLoading = true;

     

       62
        
       	@state() error: string | null = null;

     
···

       373
        
       			const data = await response.json();

     

       374
        
       			this.classInfo = data.class;

     

       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       +
       			this.sections = data.sections || [];

     

       377
       +
       			this.userSection = data.userSection || null;

     

       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       +
       

     

       380
       +
       			// Default to user's section for filtering

     

       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       +
       			}

     

       384
        
       

     

       385
        
       			// Load VTT for completed transcriptions

     

       386
        
       			await this.loadVTTForCompleted();

     
···

       467
        
       	}

     

       468
        
       

     

       469
        
       	private get filteredTranscriptions() {

     

       470
       +
       		let filtered = this.transcriptions;

     

       471
       +
       

     

       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       +
       		

     

       475
       +
       		// Only filter by section if:

     

       476
       +
       		// 1. There are sections in the class

     

       477
       +
       		// 2. User has a section OR has selected one

     

       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       +
       			// For admins: show all transcriptions

     

       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       +
       			if (!this.isAdmin) {

     

       482
       +
       				filtered = filtered.filter(

     

       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       +
       				);

     

       485
       +
       			}

     

       486
       +
       		}

     

       487
       +
       

     

       488
       +
       		// Filter by search query

     

       489
       +
       		if (this.searchQuery) {

     

       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       +
       			);

     

       494
       +
       		}

     

       495
        
       

     

       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       +
       

     

       499
       +
       		return filtered;

     

       500
        
       	}

     

       501
        
       

     

       502
        
       	private formatDate(timestamp: number): string {

     
···

       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       563
        
                   <h1>${this.classInfo.name}</h1>

     

       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       565
       +
                   <div class="semester">

     

       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       +
                     ${

     

       568
       +
       								this.userSection

     

       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       +
       									: ""

     

       571
       +
       							}

     

       572
       +
                   </div>

     

       573
        
                 </div>

     

       574
        
               </div>

     

       575
        
       

     
···

       597
        
               `

     

       598
        
       						: html`

     

       599
        
               <div class="search-upload">

     

       600
       +
                 ${

     

       601
       +
       						this.sections.length > 1

     

       602
       +
       							? html`

     

       603
       +
                     <select

     

       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       +
                       @change=${(e: Event) => {

     

       606
       +
       									this.selectedSectionFilter =

     

       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       +
       								}}

     

       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       +
                     >

     

       611
       +
                       ${this.sections.map(

     

       612
       +
       									(s) =>

     

       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       +
       								)}

     

       615
       +
                     </select>

     

       616
       +
                   `

     

       617
       +
       							: ""

     

       618
       +
       					}

     

       619
        
                 <input

     

       620
        
                   type="text"

     

       621
        
                   class="search-box"

     
···

       634
        
                 </button>

     

       635
        
               </div>

     

       636
        
       

     

       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       +
               ${

     

       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       +
       						// Apply section filtering to pending recordings

     

       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       +
       						

     

       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       +
       								return false;

     

       646
       +
       							}

     

       647
       +
       							

     

       648
       +
       							// Filter by section if applicable

     

       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       +
       							}

     

       653
       +
       							

     

       654
       +
       							return true;

     

       655
       +
       						}).length;

     

       656
       +
       

     

       657
       +
       						// Only show if there are pending recordings

     

       658
       +
       						if (pendingCount === 0) return "";

     

       659
       +
       

     

       660
       +
       						return html`

     

       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       +
                     <pending-recordings-view

     

       663
       +
                       .classId=${this.classId}

     

       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       +
                       .sectionId=${sectionFilter}

     

       667
       +
                     ></pending-recordings-view>

     

       668
       +
                   </div>

     

       669
       +
                 `;

     

       670
       +
       					})

     

       671
       +
       				}

     

       672
       +
       

     

       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       674
        
               ${

     

       675
        
       					this.filteredTranscriptions.length === 0

     

       676
        
       						? html`

     
···

       735
        
               ?open=${this.uploadModalOpen}

     

       736
        
               .classId=${this.classId}

     

       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       +
               .sections=${this.sections}

     

       739
       +
               .userSection=${this.userSection}

     

       740
        
               @close=${this.handleModalClose}

     

       741
        
               @upload-success=${this.handleUploadSuccess}

     

       742
        
             ></upload-recording-modal>

src/components/classes-overview.ts

···

       232
        
       	}

     

       233
        
       

     

       234
        
       	private async handleClassJoined() {

     

       0
        
       
     

       235
        
       		await this.loadClasses();

     

       236
        
       	}

     

       237

···

       232
        
       	}

     

       233
        
       

     

       234
        
       	private async handleClassJoined() {

     

       235
       +
       		this.showRegistrationModal = false;

     

       236
        
       		await this.loadClasses();

     

       237
        
       	}

     

       238

+436

src/components/pending-recordings-view.ts

···

       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       +
       

     

       4
       +
       interface PendingRecording {

     

       5
       +
       	id: string;

     

       6
       +
       	user_id: number;

     

       7
       +
       	filename: string;

     

       8
       +
       	original_filename: string;

     

       9
       +
       	vote_count: number;

     

       10
       +
       	created_at: number;

     

       11
       +
       }

     

       12
       +
       

     

       13
       +
       interface RecordingsData {

     

       14
       +
       	recordings: PendingRecording[];

     

       15
       +
       	total_users: number;

     

       16
       +
       	user_vote: string | null;

     

       17
       +
       	vote_threshold: number;

     

       18
       +
       	winning_recording_id: string | null;

     

       19
       +
       }

     

       20
       +
       

     

       21
       +
       @customElement("pending-recordings-view")

     

       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       +
       	@property({ type: String }) classId = "";

     

       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       +
       

     

       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       +
       	@state() private userVote: string | null = null;

     

       30
       +
       	@state() private voteThreshold = 0;

     

       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       +
       	@state() private error: string | null = null;

     

       33
       +
       	@state() private timeRemaining = "";

     

       34
       +
       

     

       35
       +
       	private refreshInterval?: number;

     

       36
       +
       	private loadingInProgress = false;

     

       37
       +
       

     

       38
       +
       	static override styles = css`

     

       39
       +
           :host {

     

       40
       +
             display: block;

     

       41
       +
             padding: 1rem;

     

       42
       +
           }

     

       43
       +
       

     

       44
       +
           .container {

     

       45
       +
             max-width: 56rem;

     

       46
       +
             margin: 0 auto;

     

       47
       +
           }

     

       48
       +
       

     

       49
       +
           h2 {

     

       50
       +
             color: var(--text);

     

       51
       +
             margin-bottom: 0.5rem;

     

       52
       +
           }

     

       53
       +
       

     

       54
       +
           .info {

     

       55
       +
             color: var(--paynes-gray);

     

       56
       +
             font-size: 0.875rem;

     

       57
       +
             margin-bottom: 1.5rem;

     

       58
       +
           }

     

       59
       +
       

     

       60
       +
           .stats {

     

       61
       +
             display: flex;

     

       62
       +
             gap: 2rem;

     

       63
       +
             margin-bottom: 1.5rem;

     

       64
       +
             padding: 1rem;

     

       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       +
             border-radius: 8px;

     

       67
       +
           }

     

       68
       +
       

     

       69
       +
           .stat {

     

       70
       +
             display: flex;

     

       71
       +
             flex-direction: column;

     

       72
       +
             gap: 0.25rem;

     

       73
       +
           }

     

       74
       +
       

     

       75
       +
           .stat-label {

     

       76
       +
             font-size: 0.75rem;

     

       77
       +
             color: var(--paynes-gray);

     

       78
       +
             text-transform: uppercase;

     

       79
       +
             letter-spacing: 0.05em;

     

       80
       +
           }

     

       81
       +
       

     

       82
       +
           .stat-value {

     

       83
       +
             font-size: 1.5rem;

     

       84
       +
             font-weight: 600;

     

       85
       +
             color: var(--text);

     

       86
       +
           }

     

       87
       +
       

     

       88
       +
           .recordings-list {

     

       89
       +
             display: flex;

     

       90
       +
             flex-direction: column;

     

       91
       +
             gap: 1rem;

     

       92
       +
           }

     

       93
       +
       

     

       94
       +
           .recording-card {

     

       95
       +
             border: 2px solid var(--secondary);

     

       96
       +
             border-radius: 8px;

     

       97
       +
             padding: 1rem;

     

       98
       +
             transition: all 0.2s;

     

       99
       +
           }

     

       100
       +
       

     

       101
       +
           .recording-card.voted {

     

       102
       +
             border-color: var(--accent);

     

       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       +
           }

     

       105
       +
       

     

       106
       +
           .recording-card.winning {

     

       107
       +
             border-color: var(--accent);

     

       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       +
           }

     

       110
       +
       

     

       111
       +
           .recording-header {

     

       112
       +
             display: flex;

     

       113
       +
             justify-content: space-between;

     

       114
       +
             align-items: center;

     

       115
       +
             margin-bottom: 0.75rem;

     

       116
       +
           }

     

       117
       +
       

     

       118
       +
           .recording-info {

     

       119
       +
             flex: 1;

     

       120
       +
           }

     

       121
       +
       

     

       122
       +
           .recording-name {

     

       123
       +
             font-weight: 600;

     

       124
       +
             color: var(--text);

     

       125
       +
             margin-bottom: 0.25rem;

     

       126
       +
           }

     

       127
       +
       

     

       128
       +
           .recording-meta {

     

       129
       +
             font-size: 0.75rem;

     

       130
       +
             color: var(--paynes-gray);

     

       131
       +
           }

     

       132
       +
       

     

       133
       +
           .vote-section {

     

       134
       +
             display: flex;

     

       135
       +
             align-items: center;

     

       136
       +
             gap: 1rem;

     

       137
       +
           }

     

       138
       +
       

     

       139
       +
           .vote-count {

     

       140
       +
             font-size: 1.25rem;

     

       141
       +
             font-weight: 600;

     

       142
       +
             color: var(--accent);

     

       143
       +
             min-width: 3rem;

     

       144
       +
             text-align: center;

     

       145
       +
           }

     

       146
       +
       

     

       147
       +
           .vote-button {

     

       148
       +
             padding: 0.5rem 1rem;

     

       149
       +
             border-radius: 6px;

     

       150
       +
             font-size: 0.875rem;

     

       151
       +
             font-weight: 500;

     

       152
       +
             cursor: pointer;

     

       153
       +
             transition: all 0.2s;

     

       154
       +
             border: 2px solid var(--secondary);

     

       155
       +
             background: var(--background);

     

       156
       +
             color: var(--text);

     

       157
       +
           }

     

       158
       +
       

     

       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       +
             border-color: var(--accent);

     

       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       +
           }

     

       163
       +
       

     

       164
       +
           .vote-button.voted {

     

       165
       +
             border-color: var(--accent);

     

       166
       +
             background: var(--accent);

     

       167
       +
             color: var(--white);

     

       168
       +
           }

     

       169
       +
       

     

       170
       +
           .vote-button:disabled {

     

       171
       +
             opacity: 0.5;

     

       172
       +
             cursor: not-allowed;

     

       173
       +
           }

     

       174
       +
       

     

       175
       +
           .delete-button {

     

       176
       +
             padding: 0.5rem;

     

       177
       +
             border: none;

     

       178
       +
             background: transparent;

     

       179
       +
             color: var(--paynes-gray);

     

       180
       +
             cursor: pointer;

     

       181
       +
             border-radius: 4px;

     

       182
       +
             transition: all 0.2s;

     

       183
       +
           }

     

       184
       +
       

     

       185
       +
           .delete-button:hover {

     

       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       +
             color: red;

     

       188
       +
           }

     

       189
       +
       

     

       190
       +
           .winning-badge {

     

       191
       +
             background: var(--accent);

     

       192
       +
             color: var(--white);

     

       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       +
             border-radius: 12px;

     

       195
       +
             font-size: 0.75rem;

     

       196
       +
             font-weight: 600;

     

       197
       +
           }

     

       198
       +
       

     

       199
       +
           .error {

     

       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       +
             border: 1px solid red;

     

       202
       +
             color: red;

     

       203
       +
             padding: 0.75rem;

     

       204
       +
             border-radius: 4px;

     

       205
       +
             margin-bottom: 1rem;

     

       206
       +
             font-size: 0.875rem;

     

       207
       +
           }

     

       208
       +
       

     

       209
       +
           .empty-state {

     

       210
       +
             text-align: center;

     

       211
       +
             padding: 3rem 1rem;

     

       212
       +
             color: var(--paynes-gray);

     

       213
       +
           }

     

       214
       +
       

     

       215
       +
           .audio-player {

     

       216
       +
             margin-top: 0.75rem;

     

       217
       +
           }

     

       218
       +
       

     

       219
       +
           audio {

     

       220
       +
             width: 100%;

     

       221
       +
             height: 2.5rem;

     

       222
       +
           }

     

       223
       +
         `;

     

       224
       +
       

     

       225
       +
       	override connectedCallback() {

     

       226
       +
       		super.connectedCallback();

     

       227
       +
       		this.loadRecordings();

     

       228
       +
       		// Refresh every 10 seconds

     

       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       +
       	}

     

       231
       +
       

     

       232
       +
       	override disconnectedCallback() {

     

       233
       +
       		super.disconnectedCallback();

     

       234
       +
       		if (this.refreshInterval) {

     

       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       +
       		}

     

       237
       +
       	}

     

       238
       +
       

     

       239
       +
       	private async loadRecordings() {

     

       240
       +
       		if (this.loadingInProgress) return;

     

       241
       +
       

     

       242
       +
       		this.loadingInProgress = true;

     

       243
       +
       

     

       244
       +
       		try {

     

       245
       +
       			// Build URL with optional section_id parameter

     

       246
       +
       			const url = new URL(

     

       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       +
       				window.location.origin,

     

       249
       +
       			);

     

       250
       +
       			if (this.sectionId !== null) {

     

       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       +
       			}

     

       253
       +
       

     

       254
       +
       			const response = await fetch(url.toString());

     

       255
       +
       

     

       256
       +
       			if (!response.ok) {

     

       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       +
       			}

     

       259
       +
       

     

       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       +
       			this.recordings = data.recordings;

     

       262
       +
       			this.userVote = data.user_vote;

     

       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       +
       

     

       266
       +
       			// Calculate time remaining for first recording

     

       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       +
       				const now = Date.now() / 1000;

     

       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       +
       

     

       273
       +
       				if (remaining > 0) {

     

       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       +
       				} else {

     

       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       +
       				}

     

       280
       +
       			}

     

       281
       +
       

     

       282
       +
       			this.error = null;

     

       283
       +
       		} catch (error) {

     

       284
       +
       			this.error =

     

       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       +
       		} finally {

     

       287
       +
       			this.loadingInProgress = false;

     

       288
       +
       		}

     

       289
       +
       	}

     

       290
       +
       

     

       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       +
       		try {

     

       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       +
       				method: "POST",

     

       295
       +
       			});

     

       296
       +
       

     

       297
       +
       			if (!response.ok) {

     

       298
       +
       				throw new Error("Failed to vote");

     

       299
       +
       			}

     

       300
       +
       

     

       301
       +
       			const data = await response.json();

     

       302
       +
       

     

       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       +
       			if (data.winning_recording_id) {

     

       305
       +
       				window.location.reload();

     

       306
       +
       			} else {

     

       307
       +
       				// Just reload recordings to show updated votes

     

       308
       +
       				await this.loadRecordings();

     

       309
       +
       			}

     

       310
       +
       		} catch (error) {

     

       311
       +
       			this.error =

     

       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       +
       		}

     

       314
       +
       	}

     

       315
       +
       

     

       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       +
       			return;

     

       319
       +
       		}

     

       320
       +
       

     

       321
       +
       		try {

     

       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       +
       				method: "DELETE",

     

       324
       +
       			});

     

       325
       +
       

     

       326
       +
       			if (!response.ok) {

     

       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       +
       			}

     

       329
       +
       

     

       330
       +
       			await this.loadRecordings();

     

       331
       +
       		} catch (error) {

     

       332
       +
       			this.error =

     

       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       +
       		}

     

       335
       +
       	}

     

       336
       +
       

     

       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       +
       		const now = Date.now() / 1000;

     

       339
       +
       		const diff = now - timestamp;

     

       340
       +
       

     

       341
       +
       		if (diff < 60) return "just now";

     

       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       +
       	}

     

       346
       +
       

     

       347
       +
       	override render() {

     

       348
       +
       		return html`

     

       349
       +
             <div class="container">

     

       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       +
               <p class="info">

     

       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       +
               </p>

     

       354
       +
       

     

       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       +
       

     

       357
       +
               ${

     

       358
       +
       					this.recordings.length > 0

     

       359
       +
       						? html`

     

       360
       +
                   <div class="stats">

     

       361
       +
                     <div class="stat">

     

       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       +
                     </div>

     

       365
       +
                     <div class="stat">

     

       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       +
                     </div>

     

       369
       +
                     <div class="stat">

     

       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       +
                     </div>

     

       373
       +
                   </div>

     

       374
       +
       

     

       375
       +
                   <div class="recordings-list">

     

       376
       +
                     ${this.recordings.map(

     

       377
       +
       								(recording) => html`

     

       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       +
                         <div class="recording-header">

     

       380
       +
                           <div class="recording-info">

     

       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       +
                             <div class="recording-meta">

     

       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       +
                             </div>

     

       385
       +
                           </div>

     

       386
       +
       

     

       387
       +
                           <div class="vote-section">

     

       388
       +
                             ${

     

       389
       +
       												this.winningRecordingId === recording.id

     

       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       +
       													: ""

     

       392
       +
       											}

     

       393
       +
                             

     

       394
       +
                             <div class="vote-count">

     

       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       +
                             </div>

     

       397
       +
       

     

       398
       +
                             <button

     

       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       +
                             >

     

       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       +
                             </button>

     

       405
       +
       

     

       406
       +
                             <button

     

       407
       +
                               class="delete-button"

     

       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       +
                               title="Delete recording"

     

       410
       +
                             >

     

       411
       +
                               🗑️

     

       412
       +
                             </button>

     

       413
       +
                           </div>

     

       414
       +
                         </div>

     

       415
       +
       

     

       416
       +
                         <div class="audio-player">

     

       417
       +
                           <audio controls preload="none">

     

       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       +
                           </audio>

     

       420
       +
                         </div>

     

       421
       +
                       </div>

     

       422
       +
                     `,

     

       423
       +
       							)}

     

       424
       +
                   </div>

     

       425
       +
                 `

     

       426
       +
       						: html`

     

       427
       +
                   <div class="empty-state">

     

       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       +
                   </div>

     

       431
       +
                 `

     

       432
       +
       				}

     

       433
       +
             </div>

     

       434
       +
           `;

     

       435
       +
       	}

     

       436
       +
       }

+2 -2

src/components/transcription.ts

···

       565
        
       

     

       566
        
       	async checkHealth() {

     

       567
        
       		try {

     

       568
       -
       			const response = await fetch("/api/transcriptions/health");

     

       569
        
       			if (response.ok) {

     

       570
        
       				const data = await response.json();

     

       571
       -
       				this.serviceAvailable = data.available;

     

       572
        
       			} else {

     

       573
        
       				this.serviceAvailable = false;

     

       574
        
       			}

···

       565
        
       

     

       566
        
       	async checkHealth() {

     

       567
        
       		try {

     

       568
       +
       			const response = await fetch("/api/health");

     

       569
        
       			if (response.ok) {

     

       570
        
       				const data = await response.json();

     

       571
       +
       				this.serviceAvailable = data.status === "healthy";

     

       572
        
       			} else {

     

       573
        
       				this.serviceAvailable = false;

     

       574
        
       			}

+74 -1

src/db/schema.ts

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
       -
       export const db = new Database("thistle.db");

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
       

     

       5
        
       // Schema version tracking

     

       6
        
       db.run(`

     
···

       219
        
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       220
        
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       221
        
           `,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       222
        
       	},

     

       223
        
       ];

     

       224

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
       +
       // Use test database when NODE_ENV is test

     

       4
       +
       const dbPath =

     

       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
       +
       export const db = new Database(dbPath);

     

       7
       +
       

     

       8
       +
       console.log(`[Database] Using database: ${dbPath}`);

     

       9
        
       

     

       10
        
       // Schema version tracking

     

       11
        
       db.run(`

     
···

       224
        
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       225
        
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       226
        
           `,

     

       227
       +
       	},

     

       228
       +
       	{

     

       229
       +
       		version: 2,

     

       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       +
       		sql: `

     

       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       +
       

     

       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       +
       

     

       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       +
       				class_id TEXT NOT NULL,

     

       242
       +
       				section_number TEXT NOT NULL,

     

       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       +
       			);

     

       247
       +
       

     

       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       +
       

     

       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       +
       

     

       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       +
       		`,

     

       255
       +
       	},

     

       256
       +
       	{

     

       257
       +
       		version: 3,

     

       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       259
       +
       		sql: `

     

       260
       +
       			-- Add vote count to transcriptions

     

       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       +
       

     

       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       +
       

     

       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       +
       			);

     

       276
       +
       

     

       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       +
       		`,

     

       280
       +
       	},

     

       281
       +
       	{

     

       282
       +
       		version: 4,

     

       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
       +
       		sql: `

     

       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       +
       			-- Defaults to created_at for existing records

     

       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       +
       			

     

       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       +
       

     

       292
       +
       			-- Create index for ordering by recording date

     

       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       +
       		`,

     

       295
        
       	},

     

       296
        
       ];

     

       297

+3 -1

src/index.test.README.md

···

       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       58
        
       ### Transcription Endpoints

     

       59
       -
       - `GET /api/transcriptions/health` - Check transcription service health

     

       60
        
       - `GET /api/transcriptions` - List user transcriptions

     

       61
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       62
        
       - `GET /api/transcriptions/:id` - Get transcription details

···

       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
        
       

     

       58
       +
       ### Health Endpoint

     

       59
       +
       - `GET /api/health` - Check service health (database, whisper, storage)

     

       60
       +
       

     

       61
        
       ### Transcription Endpoints

     

       0
        
       
     

       62
        
       - `GET /api/transcriptions` - List user transcriptions

     

       63
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       64
        
       - `GET /api/transcriptions/:id` - Get transcription details

+353 -747

src/index.test.ts

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       9
       -
       import db from "./db/schema";

     

       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
        
       

     

       12
       -
       // Test server URL - uses port 3001 for testing to avoid conflicts

     

       13
        
       const TEST_PORT = 3001;

     

       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       0
        
       
     

       15
        
       

     

       16
       -
       // Check if server is available

     

       17
       -
       let serverAvailable = false;

     

       18
        
       

     

       19
        
       beforeAll(async () => {

     

       0
        
       
     

       20
        
       	try {

     

       21
       -
       		const response = await fetch(`${BASE_URL}/api/transcriptions/health`, {

     

       22
       -
       			signal: AbortSignal.timeout(1000),

     

       23
       -
       		});

     

       24
       -
       		serverAvailable = response.ok || response.status === 404;

     

       25
        
       	} catch {

     

       26
       -
       		console.warn(

     

       27
       -
       			`\n⚠️  Test server not running on port ${TEST_PORT}. Start it with:\n   PORT=${TEST_PORT} bun run src/index.ts\n   Then run tests in another terminal.\n`,

     

       28
       -
       		);

     

       29
       -
       		serverAvailable = false;

     

       30
        
       	}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       31
        
       });

     

       32
        
       

     

       33
        
       // Test user credentials

     
···

       81
        
       	});

     

       82
        
       }

     

       83
        
       

     

       84
       -
       // Cleanup helpers

     

       85
       -
       function cleanupTestData() {

     

       86
       -
       	// Delete test users and their related data (cascade will handle most of it)

     

       87
       -
       	// Include 'newemail%' to catch users whose emails were updated during tests

     

       88
       -
       	db.run(

     

       89
       -
       		"DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       90
       -
       	);

     

       91
       -
       	db.run(

     

       92
       -
       		"DELETE FROM passkeys WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       93
       -
       	);

     

       94
       -
       	db.run(

     

       95
       -
       		"DELETE FROM transcriptions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       96
       -
       	);

     

       97
       -
       	db.run(

     

       98
       -
       		"DELETE FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%'",

     

       99
       -
       	);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       100
        
       

     

       101
       -
       	// Clear ALL rate limit data to prevent accumulation across tests

     

       102
       -
       	// (IP-based rate limits don't contain test/admin in the key)

     

       103
       -
       	db.run("DELETE FROM rate_limit_attempts");

     

       104
       -
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       105
        
       

     

       106
       -
       beforeEach(() => {

     

       107
       -
       	if (serverAvailable) {

     

       108
       -
       		cleanupTestData();

     

       109
        
       	}

     

       110
       -
       });

     

       111
        
       

     

       112
       -
       afterAll(() => {

     

       113
       -
       	if (serverAvailable) {

     

       114
       -
       		cleanupTestData();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       115
        
       	}

     

       116
       -
       });

     

       117
        
       

     

       118
       -
       // Helper to skip tests if server is not available

     

       119
       -
       function serverTest(name: string, fn: () => void | Promise<void>) {

     

       120
       -
       	test(name, async () => {

     

       121
       -
       		if (!serverAvailable) {

     

       122
       -
       			console.log(`⏭️  Skipping: ${name} (server not running)`);

     

       123
       -
       			return;

     

       124
       -
       		}

     

       125
       -
       		await fn();

     

       126
       -
       	});

     

       127
        
       }

     

       128
        
       

     

       0
        
       
     

       0
        
       
     

       129
        
       describe("API Endpoints - Authentication", () => {

     

       130
        
       	describe("POST /api/auth/register", () => {

     

       131
       -
       		serverTest("should register a new user successfully", async () => {

     

       132
        
       			const hashedPassword = await clientHashPassword(

     

       133
        
       				TEST_USER.email,

     

       134
        
       				TEST_USER.password,

     
···

       144
        
       				}),

     

       145
        
       			});

     

       146
        
       

     

       147
       -
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       148
        
       			const data = await response.json();

     

       149
        
       			expect(data.user).toBeDefined();

     

       150
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       151
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       152
        
       		});

     

       153
        
       

     

       154
       -
       		serverTest("should reject registration with missing email", async () => {

     

       155
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       156
        
       				method: "POST",

     

       157
        
       				headers: { "Content-Type": "application/json" },

     
···

       165
        
       			expect(data.error).toBe("Email and password required");

     

       166
        
       		});

     

       167
        
       

     

       168
       -
       		serverTest(

     

       169
       -
       			"should reject registration with invalid password format",

     

       170
       -
       			async () => {

     

       171
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       172
       -
       					method: "POST",

     

       173
       -
       					headers: { "Content-Type": "application/json" },

     

       174
       -
       					body: JSON.stringify({

     

       175
       -
       						email: TEST_USER.email,

     

       176
       -
       						password: "short",

     

       177
       -
       					}),

     

       178
       -
       				});

     

       179
       -
       

     

       180
       -
       				expect(response.status).toBe(400);

     

       181
       -
       				const data = await response.json();

     

       182
       -
       				expect(data.error).toBe("Invalid password format");

     

       183
       -
       			},

     

       184
       -
       		);

     

       185
       -
       

     

       186
       -
       		serverTest("should reject duplicate email registration", async () => {

     

       187
       -
       			const hashedPassword = await clientHashPassword(

     

       188
       -
       				TEST_USER.email,

     

       189
       -
       				TEST_USER.password,

     

       190
       -
       			);

     

       191
       -
       

     

       192
       -
       			// First registration

     

       193
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       194
       -
       				method: "POST",

     

       195
       -
       				headers: { "Content-Type": "application/json" },

     

       196
       -
       				body: JSON.stringify({

     

       197
       -
       					email: TEST_USER.email,

     

       198
       -
       					password: hashedPassword,

     

       199
       -
       					name: TEST_USER.name,

     

       200
       -
       				}),

     

       201
       -
       			});

     

       202
       -
       

     

       203
       -
       			// Duplicate registration

     

       204
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       205
        
       				method: "POST",

     

       206
        
       				headers: { "Content-Type": "application/json" },

     

       207
        
       				body: JSON.stringify({

     

       208
        
       					email: TEST_USER.email,

     

       209
       -
       					password: hashedPassword,

     

       210
       -
       					name: TEST_USER.name,

     

       211
        
       				}),

     

       212
        
       			});

     

       213
        
       

     

       214
        
       			expect(response.status).toBe(400);

     

       215
        
       			const data = await response.json();

     

       216
       -
       			expect(data.error).toBe("Email already registered");

     

       217
        
       		});

     

       218
        
       

     

       219
       -
       		serverTest("should enforce rate limiting on registration", async () => {

     

       220
       -
       			const hashedPassword = await clientHashPassword(

     

       221
       -
       				"test@example.com",

     

       222
       -
       				"password",

     

       223
       -
       			);

     

       224
       -
       

     

       225
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       226
       -
       			let rateLimitHit = false;

     

       227
       -
       			for (let i = 0; i < 10; i++) {

     

       228
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       229
       -
       					method: "POST",

     

       230
       -
       					headers: { "Content-Type": "application/json" },

     

       231
       -
       					body: JSON.stringify({

     

       232
       -
       						email: `test${i}@example.com`,

     

       233
       -
       						password: hashedPassword,

     

       234
       -
       					}),

     

       235
       -
       				});

     

       236
       -
       

     

       237
       -
       				if (response.status === 429) {

     

       238
       -
       					rateLimitHit = true;

     

       239
       -
       					break;

     

       240
       -
       				}

     

       241
       -
       			}

     

       242
       -
       

     

       243
       -
       			// Verify that rate limiting was triggered

     

       244
       -
       			expect(rateLimitHit).toBe(true);

     

       245
       -
       		});

     

       246
       -
       	});

     

       247
       -
       

     

       248
       -
       	describe("POST /api/auth/login", () => {

     

       249
       -
       		serverTest("should login successfully with valid credentials", async () => {

     

       250
       -
       			// Register user first

     

       251
        
       			const hashedPassword = await clientHashPassword(

     

       252
        
       				TEST_USER.email,

     

       253
        
       				TEST_USER.password,

     

       254
        
       			);

     

       0
        
       
     

       0
        
       
     

       255
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       256
        
       				method: "POST",

     

       257
        
       				headers: { "Content-Type": "application/json" },

     
···

       262
        
       				}),

     

       263
        
       			});

     

       264
        
       

     

       265
       -
       			// Login

     

       266
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       267
        
       				method: "POST",

     

       268
        
       				headers: { "Content-Type": "application/json" },

     

       269
        
       				body: JSON.stringify({

     

       270
        
       					email: TEST_USER.email,

     

       271
        
       					password: hashedPassword,

     

       0
        
       
     

       272
        
       				}),

     

       273
        
       			});

     

       274
        
       

     

       275
       -
       			expect(response.status).toBe(200);

     

       276
        
       			const data = await response.json();

     

       277
       -
       			expect(data.user).toBeDefined();

     

       278
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       279
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       280
        
       		});

     

       281
        
       

     

       282
       -
       		serverTest("should reject login with invalid credentials", async () => {

     

       283
       -
       			// Register user first

     

       284
        
       			const hashedPassword = await clientHashPassword(

     

       285
       -
       				TEST_USER.email,

     

       286
       -
       				TEST_USER.password,

     

       287
        
       			);

     

       0
        
       
     

       0
        
       
     

       288
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       289
        
       				method: "POST",

     

       290
        
       				headers: { "Content-Type": "application/json" },

     

       291
        
       				body: JSON.stringify({

     

       292
       -
       					email: TEST_USER.email,

     

       293
        
       					password: hashedPassword,

     

       294
        
       				}),

     

       295
        
       			});

     

       296
        
       

     

       297
       -
       			// Login with wrong password

     

       298
       -
       			const wrongPassword = await clientHashPassword(

     

       299
       -
       				TEST_USER.email,

     

       300
       -
       				"WrongPassword123!",

     

       301
       -
       			);

     

       302
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       303
       -
       				method: "POST",

     

       304
       -
       				headers: { "Content-Type": "application/json" },

     

       305
       -
       				body: JSON.stringify({

     

       306
       -
       					email: TEST_USER.email,

     

       307
       -
       					password: wrongPassword,

     

       308
       -
       				}),

     

       309
       -
       			});

     

       310
       -
       

     

       311
       -
       			expect(response.status).toBe(401);

     

       312
       -
       			const data = await response.json();

     

       313
       -
       			expect(data.error).toBe("Invalid email or password");

     

       314
       -
       		});

     

       315
       -
       

     

       316
       -
       		serverTest("should reject login with missing fields", async () => {

     

       317
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       318
       -
       				method: "POST",

     

       319
       -
       				headers: { "Content-Type": "application/json" },

     

       320
       -
       				body: JSON.stringify({

     

       321
       -
       					email: TEST_USER.email,

     

       322
       -
       				}),

     

       323
       -
       			});

     

       324
       -
       

     

       325
       -
       			expect(response.status).toBe(400);

     

       326
       -
       			const data = await response.json();

     

       327
       -
       			expect(data.error).toBe("Email and password required");

     

       328
       -
       		});

     

       329
       -
       

     

       330
       -
       		serverTest("should enforce rate limiting on login attempts", async () => {

     

       331
       -
       			const hashedPassword = await clientHashPassword(

     

       332
       -
       				TEST_USER.email,

     

       333
       -
       				TEST_USER.password,

     

       334
       -
       			);

     

       335
       -
       

     

       336
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       337
        
       			let rateLimitHit = false;

     

       338
       -
       			for (let i = 0; i < 11; i++) {

     

       339
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       340
        
       					method: "POST",

     

       341
        
       					headers: { "Content-Type": "application/json" },

     

       342
        
       					body: JSON.stringify({

     

       343
       -
       						email: TEST_USER.email,

     

       344
        
       						password: hashedPassword,

     

       345
        
       					}),

     

       346
        
       				});

     
···

       356
        
       		});

     

       357
        
       	});

     

       358
        
       

     

       359
       -
       	describe("POST /api/auth/logout", () => {

     

       360
       -
       		serverTest("should logout successfully", async () => {

     

       361
        
       			// Register and login

     

       362
       -
       			const hashedPassword = await clientHashPassword(

     

       363
       -
       				TEST_USER.email,

     

       364
       -
       				TEST_USER.password,

     

       365
       -
       			);

     

       366
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
       -
       				method: "POST",

     

       368
       -
       				headers: { "Content-Type": "application/json" },

     

       369
       -
       				body: JSON.stringify({

     

       370
       -
       					email: TEST_USER.email,

     

       371
       -
       					password: hashedPassword,

     

       372
       -
       				}),

     

       373
       -
       			});

     

       374
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       375
       -
       

     

       376
       -
       			// Logout

     

       377
       -
       			const response = await authRequest(

     

       378
       -
       				`${BASE_URL}/api/auth/logout`,

     

       379
       -
       				sessionCookie,

     

       380
       -
       				{

     

       381
       -
       					method: "POST",

     

       382
       -
       				},

     

       383
       -
       			);

     

       384
       -
       

     

       385
       -
       			expect(response.status).toBe(200);

     

       386
       -
       			const data = await response.json();

     

       387
       -
       			expect(data.success).toBe(true);

     

       388
       -
       

     

       389
       -
       			// Verify cookie is cleared

     

       390
       -
       			const setCookie = response.headers.get("set-cookie");

     

       391
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       392
       -
       		});

     

       393
       -
       

     

       394
       -
       		serverTest("should logout even without valid session", async () => {

     

       395
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       396
       -
       				method: "POST",

     

       397
       -
       			});

     

       398
       -
       

     

       399
       -
       			expect(response.status).toBe(200);

     

       400
       -
       			const data = await response.json();

     

       401
       -
       			expect(data.success).toBe(true);

     

       402
       -
       		});

     

       403
       -
       	});

     

       404
       -
       

     

       405
       -
       	describe("GET /api/auth/me", () => {

     

       406
       -
       		serverTest(

     

       407
       -
       			"should return current user info when authenticated",

     

       408
       -
       			async () => {

     

       409
       -
       				// Register user

     

       410
       -
       				const hashedPassword = await clientHashPassword(

     

       411
       -
       					TEST_USER.email,

     

       412
       -
       					TEST_USER.password,

     

       413
       -
       				);

     

       414
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       415
       -
       					method: "POST",

     

       416
       -
       					headers: { "Content-Type": "application/json" },

     

       417
       -
       					body: JSON.stringify({

     

       418
       -
       						email: TEST_USER.email,

     

       419
       -
       						password: hashedPassword,

     

       420
       -
       						name: TEST_USER.name,

     

       421
       -
       					}),

     

       422
       -
       				});

     

       423
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       -
       

     

       425
       -
       				// Get current user

     

       426
       -
       				const response = await authRequest(

     

       427
       -
       					`${BASE_URL}/api/auth/me`,

     

       428
       -
       					sessionCookie,

     

       429
       -
       				);

     

       430
       -
       

     

       431
       -
       				expect(response.status).toBe(200);

     

       432
       -
       				const data = await response.json();

     

       433
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       434
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       435
       -
       				expect(data.role).toBeDefined();

     

       436
       -
       			},

     

       437
       -
       		);

     

       438
       -
       

     

       439
       -
       		serverTest("should return 401 when not authenticated", async () => {

     

       440
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       441
       -
       

     

       442
       -
       			expect(response.status).toBe(401);

     

       443
       -
       			const data = await response.json();

     

       444
       -
       			expect(data.error).toBe("Not authenticated");

     

       445
       -
       		});

     

       446
       -
       

     

       447
       -
       		serverTest("should return 401 with invalid session", async () => {

     

       448
       -
       			const response = await authRequest(

     

       449
       -
       				`${BASE_URL}/api/auth/me`,

     

       450
       -
       				"invalid-session",

     

       451
       -
       			);

     

       452
       -
       

     

       453
       -
       			expect(response.status).toBe(401);

     

       454
       -
       			const data = await response.json();

     

       455
       -
       			expect(data.error).toBe("Invalid session");

     

       456
       -
       		});

     

       457
       -
       	});

     

       458
       -
       });

     

       459
       -
       

     

       460
       -
       describe("API Endpoints - Session Management", () => {

     

       461
       -
       	describe("GET /api/sessions", () => {

     

       462
       -
       		serverTest("should return user sessions", async () => {

     

       463
       -
       			// Register user

     

       464
       -
       			const hashedPassword = await clientHashPassword(

     

       465
       -
       				TEST_USER.email,

     

       466
       -
       				TEST_USER.password,

     

       467
       -
       			);

     

       468
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       469
       -
       				method: "POST",

     

       470
       -
       				headers: { "Content-Type": "application/json" },

     

       471
       -
       				body: JSON.stringify({

     

       472
       -
       					email: TEST_USER.email,

     

       473
       -
       					password: hashedPassword,

     

       474
       -
       				}),

     

       475
       -
       			});

     

       476
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       477
       -
       

     

       478
       -
       			// Get sessions

     

       479
       -
       			const response = await authRequest(

     

       480
       -
       				`${BASE_URL}/api/sessions`,

     

       481
       -
       				sessionCookie,

     

       482
       -
       			);

     

       483
       -
       

     

       484
       -
       			expect(response.status).toBe(200);

     

       485
       -
       			const data = await response.json();

     

       486
       -
       			expect(data.sessions).toBeDefined();

     

       487
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       488
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       489
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       490
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       491
       -
       		});

     

       492
       -
       

     

       493
       -
       		serverTest("should require authentication", async () => {

     

       494
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       495
       -
       

     

       496
       -
       			expect(response.status).toBe(401);

     

       497
       -
       		});

     

       498
       -
       	});

     

       499
       -
       

     

       500
       -
       	describe("DELETE /api/sessions", () => {

     

       501
       -
       		serverTest("should delete specific session", async () => {

     

       502
       -
       			// Register user and create multiple sessions

     

       503
       -
       			const hashedPassword = await clientHashPassword(

     

       504
       -
       				TEST_USER.email,

     

       505
       -
       				TEST_USER.password,

     

       506
       -
       			);

     

       507
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       508
       -
       				method: "POST",

     

       509
       -
       				headers: { "Content-Type": "application/json" },

     

       510
       -
       				body: JSON.stringify({

     

       511
       -
       					email: TEST_USER.email,

     

       512
       -
       					password: hashedPassword,

     

       513
       -
       				}),

     

       514
       -
       			});

     

       515
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       516
       -
       

     

       517
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       518
       -
       				method: "POST",

     

       519
       -
       				headers: { "Content-Type": "application/json" },

     

       520
       -
       				body: JSON.stringify({

     

       521
       -
       					email: TEST_USER.email,

     

       522
       -
       					password: hashedPassword,

     

       523
       -
       				}),

     

       524
       -
       			});

     

       525
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       526
       -
       

     

       527
       -
       			// Get sessions list

     

       528
       -
       			const sessionsResponse = await authRequest(

     

       529
       -
       				`${BASE_URL}/api/sessions`,

     

       530
       -
       				session1Cookie,

     

       531
       -
       			);

     

       532
       -
       			const sessionsData = await sessionsResponse.json();

     

       533
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       534
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       535
       -
       			)?.id;

     

       536
       -
       

     

       537
       -
       			// Delete session 2

     

       538
       -
       			const response = await authRequest(

     

       539
       -
       				`${BASE_URL}/api/sessions`,

     

       540
       -
       				session1Cookie,

     

       541
       -
       				{

     

       542
       -
       					method: "DELETE",

     

       543
       -
       					headers: { "Content-Type": "application/json" },

     

       544
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       545
       -
       				},

     

       546
       -
       			);

     

       547
       -
       

     

       548
       -
       			expect(response.status).toBe(200);

     

       549
       -
       			const data = await response.json();

     

       550
       -
       			expect(data.success).toBe(true);

     

       551
       -
       

     

       552
       -
       			// Verify session 2 is deleted

     

       553
       -
       			const verifyResponse = await authRequest(

     

       554
       -
       				`${BASE_URL}/api/auth/me`,

     

       555
       -
       				session2Cookie,

     

       556
       -
       			);

     

       557
       -
       			expect(verifyResponse.status).toBe(401);

     

       558
       -
       		});

     

       559
       -
       

     

       560
       -
       		serverTest("should not delete another user's session", async () => {

     

       561
       -
       			// Register two users

     

       562
       -
       			const hashedPassword1 = await clientHashPassword(

     

       563
       -
       				TEST_USER.email,

     

       564
       -
       				TEST_USER.password,

     

       565
       -
       			);

     

       566
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       567
       -
       				method: "POST",

     

       568
       -
       				headers: { "Content-Type": "application/json" },

     

       569
       -
       				body: JSON.stringify({

     

       570
       -
       					email: TEST_USER.email,

     

       571
       -
       					password: hashedPassword1,

     

       572
       -
       				}),

     

       573
       -
       			});

     

       574
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       575
       -
       

     

       576
       -
       			const hashedPassword2 = await clientHashPassword(

     

       577
       -
       				TEST_USER_2.email,

     

       578
       -
       				TEST_USER_2.password,

     

       579
       -
       			);

     

       580
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       581
       -
       				method: "POST",

     

       582
       -
       				headers: { "Content-Type": "application/json" },

     

       583
       -
       				body: JSON.stringify({

     

       584
       -
       					email: TEST_USER_2.email,

     

       585
       -
       					password: hashedPassword2,

     

       586
       -
       				}),

     

       587
       -
       			});

     

       588
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       589
       -
       

     

       590
       -
       			// Try to delete user2's session using user1's credentials

     

       591
       -
       			const response = await authRequest(

     

       592
       -
       				`${BASE_URL}/api/sessions`,

     

       593
       -
       				user1Cookie,

     

       594
       -
       				{

     

       595
       -
       					method: "DELETE",

     

       596
       -
       					headers: { "Content-Type": "application/json" },

     

       597
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       598
       -
       				},

     

       599
       -
       			);

     

       600
       -
       

     

       601
       -
       			expect(response.status).toBe(404);

     

       602
       -
       		});

     

       603
       -
       

     

       604
       -
       		serverTest("should not delete current session", async () => {

     

       605
       -
       			// Register user

     

       606
       -
       			const hashedPassword = await clientHashPassword(

     

       607
       -
       				TEST_USER.email,

     

       608
       -
       				TEST_USER.password,

     

       609
       -
       			);

     

       610
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       611
       -
       				method: "POST",

     

       612
       -
       				headers: { "Content-Type": "application/json" },

     

       613
       -
       				body: JSON.stringify({

     

       614
       -
       					email: TEST_USER.email,

     

       615
       -
       					password: hashedPassword,

     

       616
       -
       				}),

     

       617
       -
       			});

     

       618
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       619
        
       

     

       620
        
       			// Try to delete own current session

     

       621
        
       			const response = await authRequest(

     
···

       637
        
       

     

       638
        
       describe("API Endpoints - User Management", () => {

     

       639
        
       	describe("DELETE /api/user", () => {

     

       640
       -
       		serverTest("should delete user account", async () => {

     

       641
       -
       			// Register user

     

       642
       -
       			const hashedPassword = await clientHashPassword(

     

       643
       -
       				TEST_USER.email,

     

       644
       -
       				TEST_USER.password,

     

       645
       -
       			);

     

       646
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       647
       -
       				method: "POST",

     

       648
       -
       				headers: { "Content-Type": "application/json" },

     

       649
       -
       				body: JSON.stringify({

     

       650
       -
       					email: TEST_USER.email,

     

       651
       -
       					password: hashedPassword,

     

       652
       -
       				}),

     

       653
       -
       			});

     

       654
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       655
        
       

     

       656
        
       			// Delete account

     

       657
        
       			const response = await authRequest(

     
···

       662
        
       				},

     

       663
        
       			);

     

       664
        
       

     

       665
       -
       			expect(response.status).toBe(200);

     

       666
       -
       			const data = await response.json();

     

       667
       -
       			expect(data.success).toBe(true);

     

       668
        
       

     

       669
        
       			// Verify user is deleted

     

       670
        
       			const verifyResponse = await authRequest(

     
···

       674
        
       			expect(verifyResponse.status).toBe(401);

     

       675
        
       		});

     

       676
        
       

     

       677
       -
       		serverTest("should require authentication", async () => {

     

       678
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       679
        
       				method: "DELETE",

     

       680
        
       			});

     
···

       684
        
       	});

     

       685
        
       

     

       686
        
       	describe("PUT /api/user/email", () => {

     

       687
       -
       		serverTest("should update user email", async () => {

     

       688
       -
       			// Register user

     

       689
       -
       			const hashedPassword = await clientHashPassword(

     

       690
       -
       				TEST_USER.email,

     

       691
       -
       				TEST_USER.password,

     

       692
       -
       			);

     

       693
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       694
       -
       				method: "POST",

     

       695
       -
       				headers: { "Content-Type": "application/json" },

     

       696
       -
       				body: JSON.stringify({

     

       697
       -
       					email: TEST_USER.email,

     

       698
       -
       					password: hashedPassword,

     

       699
       -
       				}),

     

       700
       -
       			});

     

       701
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       702
        
       

     

       703
       -
       			// Update email

     

       704
        
       			const newEmail = "newemail@example.com";

     

       705
        
       			const response = await authRequest(

     

       706
        
       				`${BASE_URL}/api/user/email`,

     
···

       716
        
       			const data = await response.json();

     

       717
        
       			expect(data.success).toBe(true);

     

       718
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       719
        
       			// Verify email updated

     

       720
        
       			const meResponse = await authRequest(

     

       721
        
       				`${BASE_URL}/api/auth/me`,

     
···

       725
        
       			expect(meData.email).toBe(newEmail);

     

       726
        
       		});

     

       727
        
       

     

       728
       -
       		serverTest("should reject duplicate email", async () => {

     

       729
        
       			// Register two users

     

       730
       -
       			const hashedPassword1 = await clientHashPassword(

     

       731
       -
       				TEST_USER.email,

     

       732
       -
       				TEST_USER.password,

     

       733
       -
       			);

     

       734
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       735
       -
       				method: "POST",

     

       736
       -
       				headers: { "Content-Type": "application/json" },

     

       737
       -
       				body: JSON.stringify({

     

       738
       -
       					email: TEST_USER.email,

     

       739
       -
       					password: hashedPassword1,

     

       740
       -
       				}),

     

       741
       -
       			});

     

       742
       -
       

     

       743
       -
       			const hashedPassword2 = await clientHashPassword(

     

       744
       -
       				TEST_USER_2.email,

     

       745
       -
       				TEST_USER_2.password,

     

       746
       -
       			);

     

       747
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       748
       -
       				method: "POST",

     

       749
       -
       				headers: { "Content-Type": "application/json" },

     

       750
       -
       				body: JSON.stringify({

     

       751
       -
       					email: TEST_USER_2.email,

     

       752
       -
       					password: hashedPassword2,

     

       753
       -
       				}),

     

       754
       -
       			});

     

       755
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       756
        
       

     

       757
        
       			// Try to update user2's email to user1's email

     

       758
        
       			const response = await authRequest(

     
···

       765
        
       				},

     

       766
        
       			);

     

       767
        
       

     

       768
       -
       			expect(response.status).toBe(400);

     

       769
        
       			const data = await response.json();

     

       770
        
       			expect(data.error).toBe("Email already in use");

     

       771
        
       		});

     

       772
        
       	});

     

       773
        
       

     

       774
        
       	describe("PUT /api/user/password", () => {

     

       775
       -
       		serverTest("should update user password", async () => {

     

       776
       -
       			// Register user

     

       777
       -
       			const hashedPassword = await clientHashPassword(

     

       778
       -
       				TEST_USER.email,

     

       779
       -
       				TEST_USER.password,

     

       780
       -
       			);

     

       781
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       782
       -
       				method: "POST",

     

       783
       -
       				headers: { "Content-Type": "application/json" },

     

       784
       -
       				body: JSON.stringify({

     

       785
       -
       					email: TEST_USER.email,

     

       786
       -
       					password: hashedPassword,

     

       787
       -
       				}),

     

       788
       -
       			});

     

       789
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       790
        
       

     

       791
        
       			// Update password

     

       792
        
       			const newPassword = await clientHashPassword(

     
···

       819
        
       			expect(loginResponse.status).toBe(200);

     

       820
        
       		});

     

       821
        
       

     

       822
       -
       		serverTest("should reject invalid password format", async () => {

     

       823
       -
       			// Register user

     

       824
       -
       			const hashedPassword = await clientHashPassword(

     

       825
       -
       				TEST_USER.email,

     

       826
       -
       				TEST_USER.password,

     

       827
       -
       			);

     

       828
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       829
       -
       				method: "POST",

     

       830
       -
       				headers: { "Content-Type": "application/json" },

     

       831
       -
       				body: JSON.stringify({

     

       832
       -
       					email: TEST_USER.email,

     

       833
       -
       					password: hashedPassword,

     

       834
       -
       				}),

     

       835
       -
       			});

     

       836
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       837
        
       

     

       838
        
       			// Try to update with invalid format

     

       839
        
       			const response = await authRequest(

     
···

       853
        
       	});

     

       854
        
       

     

       855
        
       	describe("PUT /api/user/name", () => {

     

       856
       -
       		serverTest("should update user name", async () => {

     

       857
       -
       			// Register user

     

       858
       -
       			const hashedPassword = await clientHashPassword(

     

       859
       -
       				TEST_USER.email,

     

       860
       -
       				TEST_USER.password,

     

       861
       -
       			);

     

       862
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       863
       -
       				method: "POST",

     

       864
       -
       				headers: { "Content-Type": "application/json" },

     

       865
       -
       				body: JSON.stringify({

     

       866
       -
       					email: TEST_USER.email,

     

       867
       -
       					password: hashedPassword,

     

       868
       -
       					name: TEST_USER.name,

     

       869
       -
       				}),

     

       870
       -
       			});

     

       871
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       872
        
       

     

       873
        
       			// Update name

     

       874
        
       			const newName = "Updated Name";

     
···

       883
        
       			);

     

       884
        
       

     

       885
        
       			expect(response.status).toBe(200);

     

       886
       -
       			const data = await response.json();

     

       887
       -
       			expect(data.success).toBe(true);

     

       888
        
       

     

       889
        
       			// Verify name updated

     

       890
        
       			const meResponse = await authRequest(

     
···

       895
        
       			expect(meData.name).toBe(newName);

     

       896
        
       		});

     

       897
        
       

     

       898
       -
       		serverTest("should reject missing name", async () => {

     

       899
       -
       			// Register user

     

       900
       -
       			const hashedPassword = await clientHashPassword(

     

       901
       -
       				TEST_USER.email,

     

       902
       -
       				TEST_USER.password,

     

       903
       -
       			);

     

       904
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       905
       -
       				method: "POST",

     

       906
       -
       				headers: { "Content-Type": "application/json" },

     

       907
       -
       				body: JSON.stringify({

     

       908
       -
       					email: TEST_USER.email,

     

       909
       -
       					password: hashedPassword,

     

       910
       -
       				}),

     

       911
       -
       			});

     

       912
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       913
        
       

     

       914
        
       			const response = await authRequest(

     

       915
        
       				`${BASE_URL}/api/user/name`,

     
···

       926
        
       	});

     

       927
        
       

     

       928
        
       	describe("PUT /api/user/avatar", () => {

     

       929
       -
       		serverTest("should update user avatar", async () => {

     

       930
       -
       			// Register user

     

       931
       -
       			const hashedPassword = await clientHashPassword(

     

       932
       -
       				TEST_USER.email,

     

       933
       -
       				TEST_USER.password,

     

       934
       -
       			);

     

       935
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       936
       -
       				method: "POST",

     

       937
       -
       				headers: { "Content-Type": "application/json" },

     

       938
       -
       				body: JSON.stringify({

     

       939
       -
       					email: TEST_USER.email,

     

       940
       -
       					password: hashedPassword,

     

       941
       -
       				}),

     

       942
       -
       			});

     

       943
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       944
        
       

     

       945
        
       			// Update avatar

     

       946
        
       			const newAvatar = "👨‍💻";

     
···

       969
        
       	});

     

       970
        
       });

     

       971
        
       

     

       972
       -
       describe("API Endpoints - Transcriptions", () => {

     

       973
       -
       	describe("GET /api/transcriptions/health", () => {

     

       974
       -
       		serverTest(

     

       975
       -
       			"should return transcription service health status",

     

       976
       -
       			async () => {

     

       977
       -
       				const response = await fetch(`${BASE_URL}/api/transcriptions/health`);

     

       978
        
       

     

       979
       -
       				expect(response.status).toBe(200);

     

       980
       -
       				const data = await response.json();

     

       981
       -
       				expect(data).toHaveProperty("available");

     

       982
       -
       				expect(typeof data.available).toBe("boolean");

     

       983
       -
       			},

     

       984
       -
       		);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       985
        
       	});

     

       0
        
       
     

       986
        
       

     

       0
        
       
     

       987
        
       	describe("GET /api/transcriptions", () => {

     

       988
       -
       		serverTest("should return user transcriptions", async () => {

     

       989
       -
       			// Register user

     

       990
       -
       			const hashedPassword = await clientHashPassword(

     

       991
       -
       				TEST_USER.email,

     

       992
       -
       				TEST_USER.password,

     

       993
       -
       			);

     

       994
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       995
       -
       				method: "POST",

     

       996
       -
       				headers: { "Content-Type": "application/json" },

     

       997
       -
       				body: JSON.stringify({

     

       998
       -
       					email: TEST_USER.email,

     

       999
       -
       					password: hashedPassword,

     

       1000
       -
       				}),

     

       1001
       -
       			});

     

       1002
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1003
        
       

     

       1004
        
       			// Get transcriptions

     

       1005
        
       			const response = await authRequest(

     
···

       1013
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       1014
        
       		});

     

       1015
        
       

     

       1016
       -
       		serverTest("should require authentication", async () => {

     

       1017
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       1018
        
       

     

       1019
        
       			expect(response.status).toBe(401);

     
···

       1021
        
       	});

     

       1022
        
       

     

       1023
        
       	describe("POST /api/transcriptions", () => {

     

       1024
       -
       		serverTest("should upload audio file and start transcription", async () => {

     

       1025
       -
       			// Register user

     

       1026
       -
       			const hashedPassword = await clientHashPassword(

     

       1027
       -
       				TEST_USER.email,

     

       1028
       -
       				TEST_USER.password,

     

       1029
       -
       			);

     

       1030
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1031
       -
       				method: "POST",

     

       1032
       -
       				headers: { "Content-Type": "application/json" },

     

       1033
       -
       				body: JSON.stringify({

     

       1034
       -
       					email: TEST_USER.email,

     

       1035
       -
       					password: hashedPassword,

     

       1036
       -
       				}),

     

       1037
       -
       			});

     

       1038
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1039
        
       

     

       1040
        
       			// Create a test audio file

     

       1041
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1053
        
       				},

     

       1054
        
       			);

     

       1055
        
       

     

       1056
       -
       			expect(response.status).toBe(200);

     

       1057
        
       			const data = await response.json();

     

       1058
        
       			expect(data.id).toBeDefined();

     

       1059
        
       			expect(data.message).toContain("Upload successful");

     

       1060
        
       		});

     

       1061
        
       

     

       1062
       -
       		serverTest("should reject non-audio files", async () => {

     

       1063
       -
       			// Register user

     

       1064
       -
       			const hashedPassword = await clientHashPassword(

     

       1065
       -
       				TEST_USER.email,

     

       1066
       -
       				TEST_USER.password,

     

       1067
       -
       			);

     

       1068
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1069
       -
       				method: "POST",

     

       1070
       -
       				headers: { "Content-Type": "application/json" },

     

       1071
       -
       				body: JSON.stringify({

     

       1072
       -
       					email: TEST_USER.email,

     

       1073
       -
       					password: hashedPassword,

     

       1074
       -
       				}),

     

       1075
       -
       			});

     

       1076
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1077
        
       

     

       1078
        
       			// Try to upload non-audio file

     

       1079
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1092
        
       			expect(response.status).toBe(400);

     

       1093
        
       		});

     

       1094
        
       

     

       1095
       -
       		serverTest("should reject files exceeding size limit", async () => {

     

       1096
       -
       			// Register user

     

       1097
       -
       			const hashedPassword = await clientHashPassword(

     

       1098
       -
       				TEST_USER.email,

     

       1099
       -
       				TEST_USER.password,

     

       1100
       -
       			);

     

       1101
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1102
       -
       				method: "POST",

     

       1103
       -
       				headers: { "Content-Type": "application/json" },

     

       1104
       -
       				body: JSON.stringify({

     

       1105
       -
       					email: TEST_USER.email,

     

       1106
       -
       					password: hashedPassword,

     

       1107
       -
       				}),

     

       1108
       -
       			});

     

       1109
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1110
        
       

     

       1111
        
       			// Create a file larger than 100MB (the actual limit)

     

       1112
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1129
        
       			expect(data.error).toContain("File size must be less than");

     

       1130
        
       		});

     

       1131
        
       

     

       1132
       -
       		serverTest("should require authentication", async () => {

     

       1133
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       1134
        
       			const formData = new FormData();

     

       1135
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       1150
        
       	let userId: number;

     

       1151
        
       

     

       1152
        
       	beforeEach(async () => {

     

       1153
       -
       		if (!serverAvailable) return;

     

       1154
       -
       

     

       1155
        
       		// Create admin user

     

       1156
       -
       		const adminHash = await clientHashPassword(

     

       1157
       -
       			TEST_ADMIN.email,

     

       1158
       -
       			TEST_ADMIN.password,

     

       1159
       -
       		);

     

       1160
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1161
       -
       			method: "POST",

     

       1162
       -
       			headers: { "Content-Type": "application/json" },

     

       1163
       -
       			body: JSON.stringify({

     

       1164
       -
       				email: TEST_ADMIN.email,

     

       1165
       -
       				password: adminHash,

     

       1166
       -
       				name: TEST_ADMIN.name,

     

       1167
       -
       			}),

     

       1168
       -
       		});

     

       1169
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       1170
        
       

     

       1171
        
       		// Manually set admin role in database

     

       0
        
       
     

       1172
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1173
        
       			TEST_ADMIN.email,

     

       1174
        
       		]);

     

       1175
        
       

     

       1176
        
       		// Create regular user

     

       1177
       -
       		const userHash = await clientHashPassword(

     

       1178
       -
       			TEST_USER.email,

     

       1179
       -
       			TEST_USER.password,

     

       1180
       -
       		);

     

       1181
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1182
       -
       			method: "POST",

     

       1183
       -
       			headers: { "Content-Type": "application/json" },

     

       1184
       -
       			body: JSON.stringify({

     

       1185
       -
       				email: TEST_USER.email,

     

       1186
       -
       				password: userHash,

     

       1187
       -
       				name: TEST_USER.name,

     

       1188
       -
       			}),

     

       1189
       -
       		});

     

       1190
       -
       		userCookie = extractSessionCookie(userResponse);

     

       1191
        
       

     

       1192
        
       		// Get user ID

     

       1193
        
       		const userIdResult = db

     

       1194
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1195
        
       			.get(TEST_USER.email);

     

       1196
        
       		userId = userIdResult?.id;

     

       0
        
       
     

       0
        
       
     

       1197
        
       	});

     

       1198
        
       

     

       1199
        
       	describe("GET /api/admin/users", () => {

     

       1200
       -
       		serverTest("should return all users for admin", async () => {

     

       1201
        
       			const response = await authRequest(

     

       1202
        
       				`${BASE_URL}/api/admin/users`,

     

       1203
        
       				adminCookie,

     
···

       1209
        
       			expect(data.length).toBeGreaterThan(0);

     

       1210
        
       		});

     

       1211
        
       

     

       1212
       -
       		serverTest("should reject non-admin users", async () => {

     

       1213
        
       			const response = await authRequest(

     

       1214
        
       				`${BASE_URL}/api/admin/users`,

     

       1215
        
       				userCookie,

     
···

       1218
        
       			expect(response.status).toBe(403);

     

       1219
        
       		});

     

       1220
        
       

     

       1221
       -
       		serverTest("should require authentication", async () => {

     

       1222
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       1223
        
       

     

       1224
        
       			expect(response.status).toBe(401);

     
···

       1226
        
       	});

     

       1227
        
       

     

       1228
        
       	describe("GET /api/admin/transcriptions", () => {

     

       1229
       -
       		serverTest("should return all transcriptions for admin", async () => {

     

       1230
        
       			const response = await authRequest(

     

       1231
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1232
        
       				adminCookie,

     
···

       1237
        
       			expect(Array.isArray(data)).toBe(true);

     

       1238
        
       		});

     

       1239
        
       

     

       1240
       -
       		serverTest("should reject non-admin users", async () => {

     

       1241
        
       			const response = await authRequest(

     

       1242
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1243
        
       				userCookie,

     
···

       1248
        
       	});

     

       1249
        
       

     

       1250
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       1251
       -
       		serverTest("should delete user as admin", async () => {

     

       1252
        
       			const response = await authRequest(

     

       1253
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1254
        
       				adminCookie,

     
···

       1257
        
       				},

     

       1258
        
       			);

     

       1259
        
       

     

       1260
       -
       			expect(response.status).toBe(200);

     

       1261
       -
       			const data = await response.json();

     

       1262
       -
       			expect(data.success).toBe(true);

     

       1263
        
       

     

       1264
        
       			// Verify user is deleted

     

       1265
        
       			const verifyResponse = await authRequest(

     
···

       1269
        
       			expect(verifyResponse.status).toBe(401);

     

       1270
        
       		});

     

       1271
        
       

     

       1272
       -
       		serverTest("should reject non-admin users", async () => {

     

       1273
        
       			const response = await authRequest(

     

       1274
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1275
        
       				userCookie,

     
···

       1283
        
       	});

     

       1284
        
       

     

       1285
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       1286
       -
       		serverTest("should update user role as admin", async () => {

     

       1287
        
       			const response = await authRequest(

     

       1288
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1289
        
       				adminCookie,

     
···

       1295
        
       			);

     

       1296
        
       

     

       1297
        
       			expect(response.status).toBe(200);

     

       1298
       -
       			const data = await response.json();

     

       1299
       -
       			expect(data.success).toBe(true);

     

       1300
        
       

     

       1301
        
       			// Verify role updated

     

       1302
        
       			const meResponse = await authRequest(

     
···

       1307
        
       			expect(meData.role).toBe("admin");

     

       1308
        
       		});

     

       1309
        
       

     

       1310
       -
       		serverTest("should reject invalid roles", async () => {

     

       1311
        
       			const response = await authRequest(

     

       1312
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1313
        
       				adminCookie,

     
···

       1323
        
       	});

     

       1324
        
       

     

       1325
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       1326
       -
       		serverTest("should return user details for admin", async () => {

     

       1327
        
       			const response = await authRequest(

     

       1328
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1329
        
       				adminCookie,

     
···

       1337
        
       			expect(data).toHaveProperty("sessions");

     

       1338
        
       		});

     

       1339
        
       

     

       1340
       -
       		serverTest("should reject non-admin users", async () => {

     

       1341
        
       			const response = await authRequest(

     

       1342
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1343
        
       				userCookie,

     
···

       1348
        
       	});

     

       1349
        
       

     

       1350
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       1351
       -
       		serverTest("should update user name as admin", async () => {

     

       1352
        
       			const newName = "Admin Updated Name";

     

       1353
        
       			const response = await authRequest(

     

       1354
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       1365
        
       			expect(data.success).toBe(true);

     

       1366
        
       		});

     

       1367
        
       

     

       1368
       -
       		serverTest("should reject empty names", async () => {

     

       1369
        
       			const response = await authRequest(

     

       1370
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       1371
        
       				adminCookie,

     
···

       1381
        
       	});

     

       1382
        
       

     

       1383
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1384
       -
       		serverTest("should update user email as admin", async () => {

     

       1385
        
       			const newEmail = "newemail@admin.com";

     

       1386
        
       			const response = await authRequest(

     

       1387
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1398
        
       			expect(data.success).toBe(true);

     

       1399
        
       		});

     

       1400
        
       

     

       1401
       -
       		serverTest("should reject duplicate emails", async () => {

     

       1402
        
       			const response = await authRequest(

     

       1403
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1404
        
       				adminCookie,

     
···

       1409
        
       				},

     

       1410
        
       			);

     

       1411
        
       

     

       1412
       -
       			expect(response.status).toBe(400);

     

       1413
        
       			const data = await response.json();

     

       1414
        
       			expect(data.error).toBe("Email already in use");

     

       1415
        
       		});

     

       1416
        
       	});

     

       1417
        
       

     

       1418
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1419
       -
       		serverTest("should return user sessions as admin", async () => {

     

       1420
        
       			const response = await authRequest(

     

       1421
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1422
        
       				adminCookie,

     
···

       1429
        
       	});

     

       1430
        
       

     

       1431
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1432
       -
       		serverTest("should delete all user sessions as admin", async () => {

     

       1433
        
       			const response = await authRequest(

     

       1434
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1435
        
       				adminCookie,

     
···

       1438
        
       				},

     

       1439
        
       			);

     

       1440
        
       

     

       1441
       -
       			expect(response.status).toBe(200);

     

       1442
       -
       			const data = await response.json();

     

       1443
       -
       			expect(data.success).toBe(true);

     

       1444
        
       

     

       1445
        
       			// Verify sessions are deleted

     

       1446
        
       			const verifyResponse = await authRequest(

     
···

       1456
        
       	let sessionCookie: string;

     

       1457
        
       

     

       1458
        
       	beforeEach(async () => {

     

       1459
       -
       		if (!serverAvailable) return;

     

       1460
       -
       

     

       1461
       -
       		// Register user

     

       1462
       -
       		const hashedPassword = await clientHashPassword(

     

       1463
       -
       			TEST_USER.email,

     

       1464
       -
       			TEST_USER.password,

     

       1465
       -
       		);

     

       1466
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1467
       -
       			method: "POST",

     

       1468
       -
       			headers: { "Content-Type": "application/json" },

     

       1469
       -
       			body: JSON.stringify({

     

       1470
       -
       				email: TEST_USER.email,

     

       1471
       -
       				password: hashedPassword,

     

       1472
       -
       			}),

     

       1473
       -
       		});

     

       1474
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1475
        
       	});

     

       1476
        
       

     

       1477
        
       	describe("GET /api/passkeys", () => {

     

       1478
       -
       		serverTest("should return user passkeys", async () => {

     

       1479
        
       			const response = await authRequest(

     

       1480
        
       				`${BASE_URL}/api/passkeys`,

     

       1481
        
       				sessionCookie,

     
···

       1487
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1488
        
       		});

     

       1489
        
       

     

       1490
       -
       		serverTest("should require authentication", async () => {

     

       1491
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1492
        
       

     

       1493
        
       			expect(response.status).toBe(401);

     
···

       1495
        
       	});

     

       1496
        
       

     

       1497
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1498
       -
       		serverTest(

     

       1499
       -
       			"should return registration options for authenticated user",

     

       1500
       -
       			async () => {

     

       1501
       -
       				const response = await authRequest(

     

       1502
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1503
       -
       					sessionCookie,

     

       1504
       -
       					{

     

       1505
       -
       						method: "POST",

     

       1506
       -
       					},

     

       1507
       -
       				);

     

       1508
        
       

     

       1509
       -
       				expect(response.status).toBe(200);

     

       1510
       -
       				const data = await response.json();

     

       1511
       -
       				expect(data).toHaveProperty("challenge");

     

       1512
       -
       				expect(data).toHaveProperty("rp");

     

       1513
       -
       				expect(data).toHaveProperty("user");

     

       1514
       -
       			},

     

       1515
       -
       		);

     

       1516
        
       

     

       1517
       -
       		serverTest("should require authentication", async () => {

     

       1518
        
       			const response = await fetch(

     

       1519
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1520
        
       				{

     
···

       1527
        
       	});

     

       1528
        
       

     

       1529
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1530
       -
       		serverTest("should return authentication options for email", async () => {

     

       1531
        
       			const response = await fetch(

     

       1532
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1533
        
       				{

     
···

       1542
        
       			expect(data).toHaveProperty("challenge");

     

       1543
        
       		});

     

       1544
        
       

     

       1545
       -
       		serverTest("should handle non-existent email", async () => {

     

       1546
        
       			const response = await fetch(

     

       1547
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1548
        
       				{

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       9
       +
       import type { Subprocess } from "bun";

     

       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
        
       

     

       12
       +
       // Test server configuration

     

       13
        
       const TEST_PORT = 3001;

     

       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       15
       +
       const TEST_DB_PATH = "./thistle.test.db";

     

       16
        
       

     

       17
       +
       // Test server process

     

       18
       +
       let serverProcess: Subprocess | null = null;

     

       19
        
       

     

       20
        
       beforeAll(async () => {

     

       21
       +
       	// Clean up any existing test database

     

       22
        
       	try {

     

       23
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       24
        
       	} catch {

     

       25
       +
       		// Ignore if doesn't exist

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       26
        
       	}

     

       27
       +
       

     

       28
       +
       	// Start test server as subprocess

     

       29
       +
       	serverProcess = Bun.spawn(["bun", "run", "src/index.ts"], {

     

       30
       +
       		env: {

     

       31
       +
       			...process.env,

     

       32
       +
       			NODE_ENV: "test",

     

       33
       +
       			PORT: TEST_PORT.toString(),

     

       34
       +
       			SKIP_EMAILS: "true",

     

       35
       +
       			SKIP_POLAR_SYNC: "true",

     

       36
       +
       			// Dummy env vars to pass startup validation (won't be used due to SKIP_EMAILS/SKIP_POLAR_SYNC)

     

       37
       +
       			MAILCHANNELS_API_KEY: "test-key",

     

       38
       +
       			DKIM_PRIVATE_KEY: "test-key",

     

       39
       +
       			LLM_API_KEY: "test-key",

     

       40
       +
       			LLM_API_BASE_URL: "https://test.com",

     

       41
       +
       			LLM_MODEL: "test-model",

     

       42
       +
       			POLAR_ACCESS_TOKEN: "test-token",

     

       43
       +
       			POLAR_ORGANIZATION_ID: "test-org",

     

       44
       +
       			POLAR_PRODUCT_ID: "test-product",

     

       45
       +
       			POLAR_SUCCESS_URL: "http://localhost:3001/success",

     

       46
       +
       			POLAR_WEBHOOK_SECRET: "test-webhook-secret",

     

       47
       +
       			ORIGIN: "http://localhost:3001",

     

       48
       +
       		},

     

       49
       +
       		stdout: "pipe",

     

       50
       +
       		stderr: "pipe",

     

       51
       +
       	});

     

       52
       +
       

     

       53
       +
       	// Log server output for debugging

     

       54
       +
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       +
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       +
       	const decoder = new TextDecoder();

     

       57
       +
       

     

       58
       +
       	(async () => {

     

       59
       +
       		try {

     

       60
       +
       			while (true) {

     

       61
       +
       				const { value, done } = await stdoutReader.read();

     

       62
       +
       				if (done) break;

     

       63
       +
       				const text = decoder.decode(value);

     

       64
       +
       				console.log("[SERVER OUT]", text.trim());

     

       65
       +
       			}

     

       66
       +
       		} catch {}

     

       67
       +
       	})();

     

       68
       +
       

     

       69
       +
       	(async () => {

     

       70
       +
       		try {

     

       71
       +
       			while (true) {

     

       72
       +
       				const { value, done } = await stderrReader.read();

     

       73
       +
       				if (done) break;

     

       74
       +
       				const text = decoder.decode(value);

     

       75
       +
       				console.error("[SERVER ERR]", text.trim());

     

       76
       +
       			}

     

       77
       +
       		} catch {}

     

       78
       +
       	})();

     

       79
       +
       

     

       80
       +
       	// Wait for server to be ready

     

       81
       +
       	let retries = 30;

     

       82
       +
       	let ready = false;

     

       83
       +
       	while (retries > 0 && !ready) {

     

       84
       +
       		try {

     

       85
       +
       			const response = await fetch(`${BASE_URL}/api/health`, {

     

       86
       +
       				signal: AbortSignal.timeout(1000),

     

       87
       +
       			});

     

       88
       +
       			if (response.ok) {

     

       89
       +
       				ready = true;

     

       90
       +
       				break;

     

       91
       +
       			}

     

       92
       +
       		} catch {

     

       93
       +
       			// Server not ready yet

     

       94
       +
       		}

     

       95
       +
       		await new Promise((resolve) => setTimeout(resolve, 500));

     

       96
       +
       		retries--;

     

       97
       +
       	}

     

       98
       +
       

     

       99
       +
       	if (!ready) {

     

       100
       +
       		throw new Error("Test server failed to start within 15 seconds");

     

       101
       +
       	}

     

       102
       +
       

     

       103
       +
       	console.log(`✓ Test server running on port ${TEST_PORT}`);

     

       104
       +
       });

     

       105
       +
       

     

       106
       +
       afterAll(async () => {

     

       107
       +
       	// Kill test server

     

       108
       +
       	if (serverProcess) {

     

       109
       +
       		serverProcess.kill();

     

       110
       +
       		await new Promise((resolve) => setTimeout(resolve, 1000));

     

       111
       +
       	}

     

       112
       +
       

     

       113
       +
       	// Clean up test database

     

       114
       +
       	try {

     

       115
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       116
       +
       	} catch {

     

       117
       +
       		// Ignore if doesn't exist

     

       118
       +
       	}

     

       119
       +
       

     

       120
       +
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       +
       });

     

       122
       +
       

     

       123
       +
       // Clear database between each test

     

       124
       +
       beforeEach(async () => {

     

       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       +
       

     

       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       +
       	db.run("DELETE FROM classes");

     

       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       +
       

     

       142
       +
       	db.close();

     

       143
        
       });

     

       144
        
       

     

       145
        
       // Test user credentials

     
···

       193
        
       	});

     

       194
        
       }

     

       195
        
       

     

       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       +
       async function registerAndLogin(user: {

     

       198
       +
       	email: string;

     

       199
       +
       	password: string;

     

       200
       +
       	name?: string;

     

       201
       +
       }): Promise<string> {

     

       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       +
       

     

       204
       +
       	// Register the user

     

       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       +
       		method: "POST",

     

       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       +
       		body: JSON.stringify({

     

       209
       +
       			email: user.email,

     

       210
       +
       			password: hashedPassword,

     

       211
       +
       			name: user.name || "Test User",

     

       212
       +
       		}),

     

       213
       +
       	});

     

       214
       +
       

     

       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       +
       		const error = await registerResponse.json();

     

       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       +
       	}

     

       219
       +
       

     

       220
       +
       	const registerData = await registerResponse.json();

     

       221
       +
       	const userId = registerData.user.id;

     

       222
       +
       

     

       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       +
       	db.close();

     

       227
        
       

     

       228
       +
       	// Now login to get a session

     

       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       +
       		method: "POST",

     

       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       +
       		body: JSON.stringify({

     

       233
       +
       			email: user.email,

     

       234
       +
       			password: hashedPassword,

     

       235
       +
       		}),

     

       236
       +
       	});

     

       237
        
       

     

       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       +
       		const error = await loginResponse.json();

     

       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       241
        
       	}

     

       0
        
       
     

       242
        
       

     

       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       +
       }

     

       245
       +
       

     

       246
       +
       // Helper to add active subscription to a user

     

       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       +
       	const user = db

     

       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       +
       		.get(userEmail) as { id: number };

     

       252
       +
       	if (!user) {

     

       253
       +
       		db.close();

     

       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       255
        
       	}

     

       0
        
       
     

       256
        
       

     

       257
       +
       	db.run(

     

       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       +
       	);

     

       261
       +
       	db.close();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       262
        
       }

     

       263
        
       

     

       264
       +
       // All tests run against a fresh database, no cleanup needed

     

       265
       +
       

     

       266
        
       describe("API Endpoints - Authentication", () => {

     

       267
        
       	describe("POST /api/auth/register", () => {

     

       268
       +
       		test("should register a new user successfully", async () => {

     

       269
        
       			const hashedPassword = await clientHashPassword(

     

       270
        
       				TEST_USER.email,

     

       271
        
       				TEST_USER.password,

     
···

       281
        
       				}),

     

       282
        
       			});

     

       283
        
       

     

       284
       +
       			if (response.status !== 201) {

     

       285
       +
       				const error = await response.json();

     

       286
       +
       				console.error("Registration failed:", response.status, error);

     

       287
       +
       			}

     

       288
       +
       

     

       289
       +
       			expect(response.status).toBe(201);

     

       290
       +
       

     

       291
        
       			const data = await response.json();

     

       292
        
       			expect(data.user).toBeDefined();

     

       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       295
        
       		});

     

       296
        
       

     

       297
       +
       		test("should reject registration with missing email", async () => {

     

       298
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       299
        
       				method: "POST",

     

       300
        
       				headers: { "Content-Type": "application/json" },

     
···

       308
        
       			expect(data.error).toBe("Email and password required");

     

       309
        
       		});

     

       310
        
       

     

       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       313
        
       				method: "POST",

     

       314
        
       				headers: { "Content-Type": "application/json" },

     

       315
        
       				body: JSON.stringify({

     

       316
        
       					email: TEST_USER.email,

     

       317
       +
       					password: "short",

     

       0
        
       
     

       318
        
       				}),

     

       319
        
       			});

     

       320
        
       

     

       321
        
       			expect(response.status).toBe(400);

     

       322
        
       			const data = await response.json();

     

       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       324
        
       		});

     

       325
        
       

     

       326
       +
       		test("should reject duplicate email registration", async () => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       327
        
       			const hashedPassword = await clientHashPassword(

     

       328
        
       				TEST_USER.email,

     

       329
        
       				TEST_USER.password,

     

       330
        
       			);

     

       331
       +
       

     

       332
       +
       			// First registration

     

       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       334
        
       				method: "POST",

     

       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       340
        
       				}),

     

       341
        
       			});

     

       342
        
       

     

       343
       +
       			// Duplicate registration

     

       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       345
        
       				method: "POST",

     

       346
        
       				headers: { "Content-Type": "application/json" },

     

       347
        
       				body: JSON.stringify({

     

       348
        
       					email: TEST_USER.email,

     

       349
        
       					password: hashedPassword,

     

       350
       +
       					name: TEST_USER.name,

     

       351
        
       				}),

     

       352
        
       			});

     

       353
        
       

     

       354
       +
       			expect(response.status).toBe(409);

     

       355
        
       			const data = await response.json();

     

       356
       +
       			expect(data.error).toBe("Email already registered");

     

       0
        
       
     

       0
        
       
     

       357
        
       		});

     

       358
        
       

     

       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       0
        
       
     

       360
        
       			const hashedPassword = await clientHashPassword(

     

       361
       +
       				"ratelimit@example.com",

     

       362
       +
       				"password",

     

       363
        
       			);

     

       364
       +
       

     

       365
       +
       			// First registration succeeds

     

       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
        
       				method: "POST",

     

       368
        
       				headers: { "Content-Type": "application/json" },

     

       369
        
       				body: JSON.stringify({

     

       370
       +
       					email: "ratelimit@example.com",

     

       371
        
       					password: hashedPassword,

     

       372
        
       				}),

     

       373
        
       			});

     

       374
        
       

     

       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       377
        
       			let rateLimitHit = false;

     

       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       380
        
       					method: "POST",

     

       381
        
       					headers: { "Content-Type": "application/json" },

     

       382
        
       					body: JSON.stringify({

     

       383
       +
       						email: "ratelimit@example.com",

     

       384
        
       						password: hashedPassword,

     

       385
        
       					}),

     

       386
        
       				});

     
···

       396
        
       		});

     

       397
        
       	});

     

       398
        
       

     

       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       401
        
       			// Register and login

     

       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       403
        
       

     

       404
        
       			// Try to delete own current session

     

       405
        
       			const response = await authRequest(

     
···

       421
        
       

     

       422
        
       describe("API Endpoints - User Management", () => {

     

       423
        
       	describe("DELETE /api/user", () => {

     

       424
       +
       		test("should delete user account", async () => {

     

       425
       +
       			// Register and login

     

       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       427
        
       

     

       428
        
       			// Delete account

     

       429
        
       			const response = await authRequest(

     
···

       434
        
       				},

     

       435
        
       			);

     

       436
        
       

     

       437
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       438
        
       

     

       439
        
       			// Verify user is deleted

     

       440
        
       			const verifyResponse = await authRequest(

     
···

       444
        
       			expect(verifyResponse.status).toBe(401);

     

       445
        
       		});

     

       446
        
       

     

       447
       +
       		test("should require authentication", async () => {

     

       448
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       449
        
       				method: "DELETE",

     

       450
        
       			});

     
···

       454
        
       	});

     

       455
        
       

     

       456
        
       	describe("PUT /api/user/email", () => {

     

       457
       +
       		test("should update user email", async () => {

     

       458
       +
       			// Register and login

     

       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       460
        
       

     

       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       462
        
       			const newEmail = "newemail@example.com";

     

       463
        
       			const response = await authRequest(

     

       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       474
        
       			const data = await response.json();

     

       475
        
       			expect(data.success).toBe(true);

     

       476
        
       

     

       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       +
       			const tokenData = db

     

       480
       +
       				.query(

     

       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       +
       				)

     

       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       +
       				tokenData.new_email,

     

       486
       +
       				tokenData.user_id,

     

       487
       +
       			]);

     

       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       +
       				tokenData.user_id,

     

       490
       +
       			]);

     

       491
       +
       			db.close();

     

       492
       +
       

     

       493
        
       			// Verify email updated

     

       494
        
       			const meResponse = await authRequest(

     

       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       499
        
       			expect(meData.email).toBe(newEmail);

     

       500
        
       		});

     

       501
        
       

     

       502
       +
       		test("should reject duplicate email", async () => {

     

       503
        
       			// Register two users

     

       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       506
        
       

     

       507
        
       			// Try to update user2's email to user1's email

     

       508
        
       			const response = await authRequest(

     
···

       515
        
       				},

     

       516
        
       			);

     

       517
        
       

     

       518
       +
       			expect(response.status).toBe(409);

     

       519
        
       			const data = await response.json();

     

       520
        
       			expect(data.error).toBe("Email already in use");

     

       521
        
       		});

     

       522
        
       	});

     

       523
        
       

     

       524
        
       	describe("PUT /api/user/password", () => {

     

       525
       +
       		test("should update user password", async () => {

     

       526
       +
       			// Register and login

     

       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       528
        
       

     

       529
        
       			// Update password

     

       530
        
       			const newPassword = await clientHashPassword(

     
···

       557
        
       			expect(loginResponse.status).toBe(200);

     

       558
        
       		});

     

       559
        
       

     

       560
       +
       		test("should reject invalid password format", async () => {

     

       561
       +
       			// Register and login

     

       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       563
        
       

     

       564
        
       			// Try to update with invalid format

     

       565
        
       			const response = await authRequest(

     
···

       579
        
       	});

     

       580
        
       

     

       581
        
       	describe("PUT /api/user/name", () => {

     

       582
       +
       		test("should update user name", async () => {

     

       583
       +
       			// Register and login

     

       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       585
        
       

     

       586
        
       			// Update name

     

       587
        
       			const newName = "Updated Name";

     
···

       596
        
       			);

     

       597
        
       

     

       598
        
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       599
        
       

     

       600
        
       			// Verify name updated

     

       601
        
       			const meResponse = await authRequest(

     
···

       606
        
       			expect(meData.name).toBe(newName);

     

       607
        
       		});

     

       608
        
       

     

       609
       +
       		test("should reject missing name", async () => {

     

       610
       +
       			// Register and login

     

       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       612
        
       

     

       613
        
       			const response = await authRequest(

     

       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       625
        
       	});

     

       626
        
       

     

       627
        
       	describe("PUT /api/user/avatar", () => {

     

       628
       +
       		test("should update user avatar", async () => {

     

       629
       +
       			// Register and login

     

       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       631
        
       

     

       632
        
       			// Update avatar

     

       633
        
       			const newAvatar = "👨‍💻";

     
···

       656
        
       	});

     

       657
        
       });

     

       658
        
       

     

       659
       +
       describe("API Endpoints - Health", () => {

     

       660
       +
       	describe("GET /api/health", () => {

     

       661
       +
       		test("should return service health status with details", async () => {

     

       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       0
        
       
     

       0
        
       
     

       663
        
       

     

       664
       +
       			expect(response.status).toBe(200);

     

       665
       +
       			const data = await response.json();

     

       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       +
       		});

     

       673
        
       	});

     

       674
       +
       });

     

       675
        
       

     

       676
       +
       describe("API Endpoints - Transcriptions", () => {

     

       677
        
       	describe("GET /api/transcriptions", () => {

     

       678
       +
       		test("should return user transcriptions", async () => {

     

       679
       +
       			// Register and login

     

       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       +
       

     

       682
       +
       			// Add subscription

     

       683
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       684
        
       

     

       685
        
       			// Get transcriptions

     

       686
        
       			const response = await authRequest(

     
···

       694
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       695
        
       		});

     

       696
        
       

     

       697
       +
       		test("should require authentication", async () => {

     

       698
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       699
        
       

     

       700
        
       			expect(response.status).toBe(401);

     
···

       702
        
       	});

     

       703
        
       

     

       704
        
       	describe("POST /api/transcriptions", () => {

     

       705
       +
       		test("should upload audio file and start transcription", async () => {

     

       706
       +
       			// Register and login

     

       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       +
       

     

       709
       +
       			// Add subscription

     

       710
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       711
        
       

     

       712
        
       			// Create a test audio file

     

       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       725
        
       				},

     

       726
        
       			);

     

       727
        
       

     

       728
       +
       			expect(response.status).toBe(201);

     

       729
        
       			const data = await response.json();

     

       730
        
       			expect(data.id).toBeDefined();

     

       731
        
       			expect(data.message).toContain("Upload successful");

     

       732
        
       		});

     

       733
        
       

     

       734
       +
       		test("should reject non-audio files", async () => {

     

       735
       +
       			// Register and login

     

       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       +
       

     

       738
       +
       			// Add subscription

     

       739
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       740
        
       

     

       741
        
       			// Try to upload non-audio file

     

       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       755
        
       			expect(response.status).toBe(400);

     

       756
        
       		});

     

       757
        
       

     

       758
       +
       		test("should reject files exceeding size limit", async () => {

     

       759
       +
       			// Register and login

     

       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       +
       

     

       762
       +
       			// Add subscription

     

       763
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       764
        
       

     

       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       783
        
       			expect(data.error).toContain("File size must be less than");

     

       784
        
       		});

     

       785
        
       

     

       786
       +
       		test("should require authentication", async () => {

     

       787
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       788
        
       			const formData = new FormData();

     

       789
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       804
        
       	let userId: number;

     

       805
        
       

     

       806
        
       	beforeEach(async () => {

     

       0
        
       
     

       0
        
       
     

       807
        
       		// Create admin user

     

       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       809
        
       

     

       810
        
       		// Manually set admin role in database

     

       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       813
        
       			TEST_ADMIN.email,

     

       814
        
       		]);

     

       815
        
       

     

       816
        
       		// Create regular user

     

       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       818
        
       

     

       819
        
       		// Get user ID

     

       820
        
       		const userIdResult = db

     

       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       822
        
       			.get(TEST_USER.email);

     

       823
        
       		userId = userIdResult?.id;

     

       824
       +
       

     

       825
       +
       		db.close();

     

       826
        
       	});

     

       827
        
       

     

       828
        
       	describe("GET /api/admin/users", () => {

     

       829
       +
       		test("should return all users for admin", async () => {

     

       830
        
       			const response = await authRequest(

     

       831
        
       				`${BASE_URL}/api/admin/users`,

     

       832
        
       				adminCookie,

     
···

       838
        
       			expect(data.length).toBeGreaterThan(0);

     

       839
        
       		});

     

       840
        
       

     

       841
       +
       		test("should reject non-admin users", async () => {

     

       842
        
       			const response = await authRequest(

     

       843
        
       				`${BASE_URL}/api/admin/users`,

     

       844
        
       				userCookie,

     
···

       847
        
       			expect(response.status).toBe(403);

     

       848
        
       		});

     

       849
        
       

     

       850
       +
       		test("should require authentication", async () => {

     

       851
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       852
        
       

     

       853
        
       			expect(response.status).toBe(401);

     
···

       855
        
       	});

     

       856
        
       

     

       857
        
       	describe("GET /api/admin/transcriptions", () => {

     

       858
       +
       		test("should return all transcriptions for admin", async () => {

     

       859
        
       			const response = await authRequest(

     

       860
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       861
        
       				adminCookie,

     
···

       866
        
       			expect(Array.isArray(data)).toBe(true);

     

       867
        
       		});

     

       868
        
       

     

       869
       +
       		test("should reject non-admin users", async () => {

     

       870
        
       			const response = await authRequest(

     

       871
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       872
        
       				userCookie,

     
···

       877
        
       	});

     

       878
        
       

     

       879
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       880
       +
       		test("should delete user as admin", async () => {

     

       881
        
       			const response = await authRequest(

     

       882
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       883
        
       				adminCookie,

     
···

       886
        
       				},

     

       887
        
       			);

     

       888
        
       

     

       889
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       890
        
       

     

       891
        
       			// Verify user is deleted

     

       892
        
       			const verifyResponse = await authRequest(

     
···

       896
        
       			expect(verifyResponse.status).toBe(401);

     

       897
        
       		});

     

       898
        
       

     

       899
       +
       		test("should reject non-admin users", async () => {

     

       900
        
       			const response = await authRequest(

     

       901
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       902
        
       				userCookie,

     
···

       910
        
       	});

     

       911
        
       

     

       912
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       913
       +
       		test("should update user role as admin", async () => {

     

       914
        
       			const response = await authRequest(

     

       915
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       916
        
       				adminCookie,

     
···

       922
        
       			);

     

       923
        
       

     

       924
        
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       925
        
       

     

       926
        
       			// Verify role updated

     

       927
        
       			const meResponse = await authRequest(

     
···

       932
        
       			expect(meData.role).toBe("admin");

     

       933
        
       		});

     

       934
        
       

     

       935
       +
       		test("should reject invalid roles", async () => {

     

       936
        
       			const response = await authRequest(

     

       937
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       938
        
       				adminCookie,

     
···

       948
        
       	});

     

       949
        
       

     

       950
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       951
       +
       		test("should return user details for admin", async () => {

     

       952
        
       			const response = await authRequest(

     

       953
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       954
        
       				adminCookie,

     
···

       962
        
       			expect(data).toHaveProperty("sessions");

     

       963
        
       		});

     

       964
        
       

     

       965
       +
       		test("should reject non-admin users", async () => {

     

       966
        
       			const response = await authRequest(

     

       967
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       968
        
       				userCookie,

     
···

       973
        
       	});

     

       974
        
       

     

       975
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       976
       +
       		test("should update user name as admin", async () => {

     

       977
        
       			const newName = "Admin Updated Name";

     

       978
        
       			const response = await authRequest(

     

       979
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       990
        
       			expect(data.success).toBe(true);

     

       991
        
       		});

     

       992
        
       

     

       993
       +
       		test("should reject empty names", async () => {

     

       994
        
       			const response = await authRequest(

     

       995
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       996
        
       				adminCookie,

     
···

       1006
        
       	});

     

       1007
        
       

     

       1008
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1009
       +
       		test("should update user email as admin", async () => {

     

       1010
        
       			const newEmail = "newemail@admin.com";

     

       1011
        
       			const response = await authRequest(

     

       1012
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1023
        
       			expect(data.success).toBe(true);

     

       1024
        
       		});

     

       1025
        
       

     

       1026
       +
       		test("should reject duplicate emails", async () => {

     

       1027
        
       			const response = await authRequest(

     

       1028
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1029
        
       				adminCookie,

     
···

       1034
        
       				},

     

       1035
        
       			);

     

       1036
        
       

     

       1037
       +
       			expect(response.status).toBe(409);

     

       1038
        
       			const data = await response.json();

     

       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1040
        
       		});

     

       1041
        
       	});

     

       1042
        
       

     

       1043
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1044
       +
       		test("should return user sessions as admin", async () => {

     

       1045
        
       			const response = await authRequest(

     

       1046
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1047
        
       				adminCookie,

     
···

       1054
        
       	});

     

       1055
        
       

     

       1056
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1057
       +
       		test("should delete all user sessions as admin", async () => {

     

       1058
        
       			const response = await authRequest(

     

       1059
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1060
        
       				adminCookie,

     
···

       1063
        
       				},

     

       1064
        
       			);

     

       1065
        
       

     

       1066
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       1067
        
       

     

       1068
        
       			// Verify sessions are deleted

     

       1069
        
       			const verifyResponse = await authRequest(

     
···

       1079
        
       	let sessionCookie: string;

     

       1080
        
       

     

       1081
        
       	beforeEach(async () => {

     

       1082
       +
       		// Register and login

     

       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1084
        
       	});

     

       1085
        
       

     

       1086
        
       	describe("GET /api/passkeys", () => {

     

       1087
       +
       		test("should return user passkeys", async () => {

     

       1088
        
       			const response = await authRequest(

     

       1089
        
       				`${BASE_URL}/api/passkeys`,

     

       1090
        
       				sessionCookie,

     
···

       1096
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1097
        
       		});

     

       1098
        
       

     

       1099
       +
       		test("should require authentication", async () => {

     

       1100
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1101
        
       

     

       1102
        
       			expect(response.status).toBe(401);

     
···

       1104
        
       	});

     

       1105
        
       

     

       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       +
       			const response = await authRequest(

     

       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       +
       				sessionCookie,

     

       1111
       +
       				{

     

       1112
       +
       					method: "POST",

     

       1113
       +
       				},

     

       1114
       +
       			);

     

       0
        
       
     

       0
        
       
     

       1115
        
       

     

       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       +
       			const data = await response.json();

     

       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       +
       		});

     

       0
        
       
     

       1122
        
       

     

       1123
       +
       		test("should require authentication", async () => {

     

       1124
        
       			const response = await fetch(

     

       1125
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1126
        
       				{

     
···

       1133
        
       	});

     

       1134
        
       

     

       1135
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1136
       +
       		test("should return authentication options for email", async () => {

     

       1137
        
       			const response = await fetch(

     

       1138
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1139
        
       				{

     
···

       1148
        
       			expect(data).toHaveProperty("challenge");

     

       1149
        
       		});

     

       1150
        
       

     

       1151
       +
       		test("should handle non-existent email", async () => {

     

       1152
        
       			const response = await fetch(

     

       1153
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1154
        
       				{

+877 -409

src/index.ts

···

       48
        
       	getClassById,

     

       49
        
       	getClassesForUser,

     

       50
        
       	getClassMembers,

     

       0
        
       
     

       0
        
       
     

       51
        
       	getMeetingTimesForClass,

     

       52
        
       	getTranscriptionsForClass,

     

       0
        
       
     

       53
        
       	isUserEnrolledInClass,

     

       54
        
       	joinClass,

     

       55
        
       	removeUserFromClass,

     

       56
        
       	searchClassesByCourseCode,

     

       57
        
       	toggleClassArchive,

     

       58
        
       	updateMeetingTime,

     

       0
        
       
     

       59
        
       } from "./lib/classes";

     

       60
        
       import { sendEmail } from "./lib/email";

     

       61
        
       import {

     
···

       88
        
       	WhisperServiceManager,

     

       89
        
       } from "./lib/transcription";

     

       90
        
       import {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       91
        
       	validateClassId,

     

       92
        
       	validateCourseCode,

     

       93
        
       	validateCourseName,

     
···

       135
        
       		console.warn(

     

       136
        
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       137
        
       		);

     

       138
       -
       		console.warn(

     

       139
       -
       			"[Startup] Set ORIGIN in production for correct email links",

     

       140
       -
       		);

     

       141
        
       	}

     

       142
        
       

     

       143
        
       	console.log("[Startup] Environment variable validation passed");

     
···

       175
        
       	userId: number,

     

       176
        
       	email: string,

     

       177
        
       ): Promise<void> {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       178
        
       	try {

     

       179
        
       		const { polar } = await import("./lib/polar");

     

       180
        
       

     
···

       294
        
       	5 * 60 * 1000,

     

       295
        
       );

     

       296
        
       

     

       297
       -
       // Clean up stale files daily

     

       298
        
       const fileCleanupInterval = setInterval(

     

       299
        
       	() => whisperService.cleanupStaleFiles(),

     

       300
       -
       	24 * 60 * 60 * 1000,

     

       301
        
       );

     

       302
        
       

     

       303
        
       const server = Bun.serve({

     

       304
       -
       	port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       305
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       306
        
       	routes: {

     

       307
        
       		"/": indexHTML,

     
···

       394
        
       							email_verification_required: true,

     

       395
        
       							verification_code_sent_at: sentAt,

     

       396
        
       						},

     

       397
       -
       						{ status: 200 },

     

       398
        
       					);

     

       399
        
       				} catch (err: unknown) {

     

       400
        
       					const error = err as { message?: string };

     

       401
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       402
        
       						return Response.json(

     

       403
        
       							{ error: "Email already registered" },

     

       404
       -
       							{ status: 400 },

     

       405
        
       						);

     

       406
        
       					}

     

       407
        
       					console.error("[Auth] Registration error:", err);

     
···

       641
        
       						}),

     

       642
        
       					});

     

       643
        
       

     

       644
       -
       					return Response.json({ success: true, message: "Verification email sent" });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       645
        
       				} catch (error) {

     

       646
        
       					return handleError(error);

     

       647
        
       				}

     
···

       829
        
       					await updateUserPassword(userId, password);

     

       830
        
       					consumePasswordResetToken(token);

     

       831
        
       

     

       832
       -
       					return Response.json({ success: true, message: "Password reset successfully" });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       833
        
       				} catch (error) {

     

       834
        
       					console.error("[Email] Reset password error:", error);

     

       835
        
       					return Response.json(

     
···

       858
        
       		},

     

       859
        
       		"/api/auth/me": {

     

       860
        
       			GET: (req) => {

     

       861
       -
       				const sessionId = getSessionFromRequest(req);

     

       862
       -
       				if (!sessionId) {

     

       863
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       864
       -
       				}

     

       865
       -
       				const user = getUserBySession(sessionId);

     

       866
       -
       				if (!user) {

     

       867
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       868
       -
       				}

     

       869
        
       

     

       870
       -
       				// Check subscription status

     

       871
       -
       				const subscription = db

     

       872
       -
       					.query<{ status: string }, [number]>(

     

       873
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       874
       -
       					)

     

       875
       -
       					.get(user.id);

     

       876
        
       

     

       877
       -
       				// Get notification preferences

     

       878
       -
       				const prefs = db

     

       879
       -
       					.query<{ email_notifications_enabled: number }, [number]>(

     

       880
       -
       						"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       881
       -
       					)

     

       882
       -
       					.get(user.id);

     

       883
        
       

     

       884
       -
       				return Response.json({

     

       885
       -
       					email: user.email,

     

       886
       -
       					name: user.name,

     

       887
       -
       					avatar: user.avatar,

     

       888
       -
       					created_at: user.created_at,

     

       889
       -
       					role: user.role,

     

       890
       -
       					has_subscription: !!subscription,

     

       891
       -
       					email_verified: isEmailVerified(user.id),

     

       892
       -
       					email_notifications_enabled: prefs?.email_notifications_enabled === 1,

     

       893
       -
       				});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       894
        
       			},

     

       895
        
       		},

     

       896
        
       		"/api/passkeys/register/options": {

     
···

       898
        
       				try {

     

       899
        
       					const user = requireAuth(req);

     

       900
        
       

     

       901
       -
       					const rateLimitError = enforceRateLimit(req, "passkey-register-options", {

     

       902
       -
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       903
       -
       					});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       904
        
       					if (rateLimitError) return rateLimitError;

     

       905
        
       

     

       906
        
       					const options = await createRegistrationOptions(user);

     
···

       915
        
       				try {

     

       916
        
       					const _user = requireAuth(req);

     

       917
        
       

     

       918
       -
       					const rateLimitError = enforceRateLimit(req, "passkey-register-verify", {

     

       919
       -
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       920
       -
       					});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       921
        
       					if (rateLimitError) return rateLimitError;

     

       922
        
       

     

       923
        
       					const body = await req.json();

     
···

       1048
        
       					}

     

       1049
        
       

     

       1050
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       1051
       -
       					return Response.json({ success: true });

     

       1052
        
       				} catch (err) {

     

       1053
        
       					return handleError(err);

     

       1054
        
       				}

     
···

       1064
        
       

     

       1065
        
       					const passkeyId = req.params.id;

     

       1066
        
       					deletePasskey(passkeyId, user.id);

     

       1067
       -
       					return Response.json({ success: true });

     

       1068
        
       				} catch (err) {

     

       1069
        
       					return handleError(err);

     

       1070
        
       				}

     
···

       1072
        
       		},

     

       1073
        
       		"/api/sessions": {

     

       1074
        
       			GET: (req) => {

     

       1075
       -
       				const sessionId = getSessionFromRequest(req);

     

       1076
       -
       				if (!sessionId) {

     

       1077
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1078
       -
       				}

     

       1079
       -
       				const user = getUserBySession(sessionId);

     

       1080
       -
       				if (!user) {

     

       1081
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1082
        
       				}

     

       1083
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       1084
       -
       				return Response.json({

     

       1085
       -
       					sessions: sessions.map((s) => ({

     

       1086
       -
       						id: s.id,

     

       1087
       -
       						ip_address: s.ip_address,

     

       1088
       -
       						user_agent: s.user_agent,

     

       1089
       -
       						created_at: s.created_at,

     

       1090
       -
       						expires_at: s.expires_at,

     

       1091
       -
       						is_current: s.id === sessionId,

     

       1092
       -
       					})),

     

       1093
       -
       				});

     

       1094
        
       			},

     

       1095
        
       			DELETE: async (req) => {

     

       1096
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       1097
       -
       				if (!currentSessionId) {

     

       1098
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1099
       -
       				}

     

       1100
       -
       				const user = getUserBySession(currentSessionId);

     

       1101
       -
       				if (!user) {

     

       1102
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1103
       -
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1104
        
       

     

       1105
       -
       				const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1106
       -
       					ip: { max: 20, windowSeconds: 60 * 60 },

     

       1107
       -
       				});

     

       1108
       -
       				if (rateLimitError) return rateLimitError;

     

       1109
        
       

     

       1110
       -
       				const body = await req.json();

     

       1111
       -
       				const targetSessionId = body.sessionId;

     

       1112
       -
       				if (!targetSessionId) {

     

       1113
       -
       					return Response.json(

     

       1114
       -
       						{ error: "Session ID required" },

     

       1115
       -
       						{ status: 400 },

     

       1116
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1117
        
       				}

     

       1118
       -
       				// Prevent deleting current session

     

       1119
       -
       				if (targetSessionId === currentSessionId) {

     

       1120
       -
       					return Response.json(

     

       1121
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       1122
       -
       						{ status: 400 },

     

       1123
       -
       					);

     

       1124
       -
       				}

     

       1125
       -
       				// Verify the session belongs to the user

     

       1126
       -
       				const targetSession = getSession(targetSessionId);

     

       1127
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       1128
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       1129
       -
       				}

     

       1130
       -
       				deleteSession(targetSessionId);

     

       1131
       -
       				return Response.json({ success: true });

     

       1132
        
       			},

     

       1133
        
       		},

     

       1134
        
       		"/api/user": {

     

       1135
        
       			DELETE: async (req) => {

     

       1136
       -
       				const sessionId = getSessionFromRequest(req);

     

       1137
       -
       				if (!sessionId) {

     

       1138
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1139
       -
       				}

     

       1140
       -
       				const user = getUserBySession(sessionId);

     

       1141
       -
       				if (!user) {

     

       1142
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1143
       -
       				}

     

       1144
        
       

     

       1145
       -
       				// Rate limiting

     

       1146
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1147
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       1148
       -
       				});

     

       1149
       -
       				if (rateLimitError) return rateLimitError;

     

       1150
        
       

     

       1151
       -
       				await deleteUser(user.id);

     

       1152
       -
       				return Response.json(

     

       1153
       -
       					{ success: true },

     

       1154
       -
       					{

     

       1155
        
       						headers: {

     

       1156
        
       							"Set-Cookie":

     

       1157
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       1158
        
       						},

     

       1159
       -
       					},

     

       1160
       -
       				);

     

       0
        
       
     

       0
        
       
     

       1161
        
       			},

     

       1162
        
       		},

     

       1163
        
       		"/api/user/email": {

     

       1164
        
       			PUT: async (req) => {

     

       1165
       -
       				const sessionId = getSessionFromRequest(req);

     

       1166
       -
       				if (!sessionId) {

     

       1167
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1168
       -
       				}

     

       1169
       -
       				const user = getUserBySession(sessionId);

     

       1170
       -
       				if (!user) {

     

       1171
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1172
       -
       				}

     

       1173
        
       

     

       1174
       -
       				// Rate limiting

     

       1175
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1176
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1177
       -
       				});

     

       1178
       -
       				if (rateLimitError) return rateLimitError;

     

       1179
        
       

     

       1180
       -
       				const body = await req.json();

     

       1181
       -
       				const { email } = body;

     

       1182
       -
       				if (!email) {

     

       1183
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1184
       -
       				}

     

       1185
        
       

     

       1186
       -
       				// Check if email is already in use

     

       1187
       -
       				const existingUser = getUserByEmail(email);

     

       1188
       -
       				if (existingUser) {

     

       1189
       -
       					return Response.json(

     

       1190
       -
       						{ error: "Email already in use" },

     

       1191
       -
       						{ status: 400 },

     

       1192
       -
       					);

     

       1193
       -
       				}

     

       1194
        
       

     

       1195
       -
       				try {

     

       1196
       -
       					// Create email change token

     

       1197
       -
       					const token = createEmailChangeToken(user.id, email);

     

       1198
        
       

     

       1199
       -
       					// Send verification email to the CURRENT address

     

       1200
       -
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1201
       -
       					const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1202
        
       

     

       1203
       -
       					await sendEmail({

     

       1204
       -
       						to: user.email,

     

       1205
       -
       						subject: "Verify your email change",

     

       1206
       -
       						html: emailChangeTemplate({

     

       1207
       -
       							name: user.name,

     

       1208
       -
       							currentEmail: user.email,

     

       1209
       -
       							newEmail: email,

     

       1210
       -
       							verifyLink: verifyUrl,

     

       1211
       -
       						}),

     

       1212
       -
       					});

     

       1213
        
       

     

       1214
       -
       					return Response.json({

     

       1215
       -
       						success: true,

     

       1216
       -
       						message: `Verification email sent to ${user.email}`,

     

       1217
       -
       						pendingEmail: email,

     

       1218
       -
       					});

     

       1219
       -
       				} catch (error) {

     

       1220
       -
       					console.error(

     

       1221
       -
       						"[Email] Failed to send email change verification:",

     

       1222
       -
       						error,

     

       1223
       -
       					);

     

       1224
       -
       					return Response.json(

     

       1225
       -
       						{ error: "Failed to send verification email" },

     

       1226
       -
       						{ status: 500 },

     

       1227
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1228
        
       				}

     

       1229
        
       			},

     

       1230
        
       		},

     
···

       1272
        
       		},

     

       1273
        
       		"/api/user/password": {

     

       1274
        
       			PUT: async (req) => {

     

       1275
       -
       				const sessionId = getSessionFromRequest(req);

     

       1276
       -
       				if (!sessionId) {

     

       1277
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1278
       -
       				}

     

       1279
       -
       				const user = getUserBySession(sessionId);

     

       1280
       -
       				if (!user) {

     

       1281
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1282
       -
       				}

     

       1283
        
       

     

       1284
       -
       				// Rate limiting

     

       1285
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1286
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1287
       -
       				});

     

       1288
       -
       				if (rateLimitError) return rateLimitError;

     

       1289
        
       

     

       1290
       -
       				const body = await req.json();

     

       1291
       -
       				const { password } = body;

     

       1292
       -
       				if (!password) {

     

       1293
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       1294
       -
       				}

     

       1295
       -
       				// Validate password format (client-side hashed PBKDF2)

     

       1296
       -
       				const passwordValidation = validatePasswordHash(password);

     

       1297
       -
       				if (!passwordValidation.valid) {

     

       1298
       -
       					return Response.json(

     

       1299
       -
       						{ error: passwordValidation.error },

     

       1300
       -
       						{ status: 400 },

     

       1301
       -
       					);

     

       1302
       -
       				}

     

       1303
       -
       				try {

     

       1304
       -
       					await updateUserPassword(user.id, password);

     

       1305
       -
       					return Response.json({ success: true });

     

       1306
       -
       				} catch {

     

       1307
       -
       					return Response.json(

     

       1308
       -
       						{ error: "Failed to update password" },

     

       1309
       -
       						{ status: 500 },

     

       1310
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1311
        
       				}

     

       1312
        
       			},

     

       1313
        
       		},

     

       1314
        
       		"/api/user/name": {

     

       1315
        
       			PUT: async (req) => {

     

       1316
       -
       				const sessionId = getSessionFromRequest(req);

     

       1317
       -
       				if (!sessionId) {

     

       1318
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1319
       -
       				}

     

       1320
       -
       				const user = getUserBySession(sessionId);

     

       1321
       -
       				if (!user) {

     

       1322
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1323
       -
       				}

     

       1324
        
       

     

       1325
       -
       				const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1326
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1327
       -
       				});

     

       1328
       -
       				if (rateLimitError) return rateLimitError;

     

       1329
        
       

     

       1330
       -
       				const body = await req.json();

     

       1331
       -
       				const { name } = body;

     

       1332
       -
       				if (!name) {

     

       1333
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       1334
       -
       				}

     

       1335
       -
       				try {

     

       1336
       -
       					updateUserName(user.id, name);

     

       1337
       -
       					return Response.json({ success: true });

     

       1338
       -
       				} catch {

     

       1339
       -
       					return Response.json(

     

       1340
       -
       						{ error: "Failed to update name" },

     

       1341
       -
       						{ status: 500 },

     

       1342
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1343
        
       				}

     

       1344
        
       			},

     

       1345
        
       		},

     

       1346
        
       		"/api/user/avatar": {

     

       1347
        
       			PUT: async (req) => {

     

       1348
       -
       				const sessionId = getSessionFromRequest(req);

     

       1349
       -
       				if (!sessionId) {

     

       1350
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1351
       -
       				}

     

       1352
       -
       				const user = getUserBySession(sessionId);

     

       1353
       -
       				if (!user) {

     

       1354
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1355
       -
       				}

     

       1356
        
       

     

       1357
       -
       				const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1358
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1359
       -
       				});

     

       1360
       -
       				if (rateLimitError) return rateLimitError;

     

       1361
        
       

     

       1362
       -
       				const body = await req.json();

     

       1363
       -
       				const { avatar } = body;

     

       1364
       -
       				if (!avatar) {

     

       1365
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1366
       -
       				}

     

       1367
       -
       				try {

     

       1368
       -
       					updateUserAvatar(user.id, avatar);

     

       1369
       -
       					return Response.json({ success: true });

     

       1370
       -
       				} catch {

     

       1371
       -
       					return Response.json(

     

       1372
       -
       						{ error: "Failed to update avatar" },

     

       1373
       -
       						{ status: 500 },

     

       1374
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1375
        
       				}

     

       1376
        
       			},

     

       1377
        
       		},

     

       1378
        
       		"/api/user/notifications": {

     

       1379
        
       			PUT: async (req) => {

     

       1380
       -
       				const sessionId = getSessionFromRequest(req);

     

       1381
       -
       				if (!sessionId) {

     

       1382
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1383
       -
       				}

     

       1384
       -
       				const user = getUserBySession(sessionId);

     

       1385
       -
       				if (!user) {

     

       1386
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1387
       -
       				}

     

       1388
        
       

     

       1389
       -
       				const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1390
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1391
       -
       				});

     

       1392
       -
       				if (rateLimitError) return rateLimitError;

     

       1393
        
       

     

       1394
       -
       				const body = await req.json();

     

       1395
       -
       				const { email_notifications_enabled } = body;

     

       1396
       -
       				if (typeof email_notifications_enabled !== "boolean") {

     

       1397
       -
       					return Response.json(

     

       1398
       -
       						{ error: "email_notifications_enabled must be a boolean" },

     

       1399
       -
       						{ status: 400 },

     

       1400
       -
       					);

     

       1401
       -
       				}

     

       1402
       -
       				try {

     

       1403
       -
       					db.run(

     

       1404
       -
       						"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1405
       -
       						[email_notifications_enabled ? 1 : 0, user.id],

     

       1406
       -
       					);

     

       1407
       -
       					return Response.json({ success: true });

     

       1408
       -
       				} catch {

     

       1409
       -
       					return Response.json(

     

       1410
       -
       						{ error: "Failed to update notification settings" },

     

       1411
       -
       						{ status: 500 },

     

       1412
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1413
        
       				}

     

       1414
        
       			},

     

       1415
        
       		},

     

       1416
        
       		"/api/billing/checkout": {

     

       1417
        
       			POST: async (req) => {

     

       1418
       -
       				const sessionId = getSessionFromRequest(req);

     

       1419
       -
       				if (!sessionId) {

     

       1420
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1421
       -
       				}

     

       1422
       -
       				const user = getUserBySession(sessionId);

     

       1423
       -
       				if (!user) {

     

       1424
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1425
       -
       				}

     

       1426
       -
       

     

       1427
        
       				try {

     

       0
        
       
     

       0
        
       
     

       1428
        
       					const { polar } = await import("./lib/polar");

     

       1429
        
       

     

       1430
        
       					// Validated at startup

     
···

       1443
        
       					});

     

       1444
        
       

     

       1445
        
       					return Response.json({ url: checkout.url });

     

       1446
       -
       				} catch (error) {

     

       1447
       -
       					console.error("Failed to create checkout:", error);

     

       1448
       -
       					return Response.json(

     

       1449
       -
       						{ error: "Failed to create checkout session" },

     

       1450
       -
       						{ status: 500 },

     

       1451
       -
       					);

     

       1452
        
       				}

     

       1453
        
       			},

     

       1454
        
       		},

     

       1455
        
       		"/api/billing/subscription": {

     

       1456
        
       			GET: async (req) => {

     

       1457
       -
       				const sessionId = getSessionFromRequest(req);

     

       1458
       -
       				if (!sessionId) {

     

       1459
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1460
       -
       				}

     

       1461
       -
       				const user = getUserBySession(sessionId);

     

       1462
       -
       				if (!user) {

     

       1463
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1464
       -
       				}

     

       1465
        
       

     

       1466
       -
       				try {

     

       1467
        
       					// Get subscription from database

     

       1468
        
       					const subscription = db

     

       1469
        
       						.query<

     
···

       1486
        
       					}

     

       1487
        
       

     

       1488
        
       					return Response.json({ subscription });

     

       1489
       -
       				} catch (error) {

     

       1490
       -
       					console.error("Failed to fetch subscription:", error);

     

       1491
       -
       					return Response.json(

     

       1492
       -
       						{ error: "Failed to fetch subscription" },

     

       1493
       -
       						{ status: 500 },

     

       1494
       -
       					);

     

       1495
        
       				}

     

       1496
        
       			},

     

       1497
        
       		},

     

       1498
        
       		"/api/billing/portal": {

     

       1499
        
       			POST: async (req) => {

     

       1500
       -
       				const sessionId = getSessionFromRequest(req);

     

       1501
       -
       				if (!sessionId) {

     

       1502
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1503
       -
       				}

     

       1504
       -
       				const user = getUserBySession(sessionId);

     

       1505
       -
       				if (!user) {

     

       1506
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1507
       -
       				}

     

       1508
        
       

     

       1509
       -
       				try {

     

       1510
        
       					const { polar } = await import("./lib/polar");

     

       1511
        
       

     

       1512
        
       					// Get subscription to find customer ID

     
···

       1534
        
       					});

     

       1535
        
       

     

       1536
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1537
       -
       				} catch (error) {

     

       1538
       -
       					console.error("Failed to create portal session:", error);

     

       1539
       -
       					return Response.json(

     

       1540
       -
       						{ error: "Failed to create portal session" },

     

       1541
       -
       						{ status: 500 },

     

       1542
       -
       					);

     

       1543
        
       				}

     

       1544
        
       			},

     

       1545
        
       		},

     

       1546
        
       		"/api/webhooks/polar": {

     

       1547
        
       			POST: async (req) => {

     

       1548
       -
       				try {

     

       1549
       -
       					const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1550
        
       

     

       1551
       -
       					// Get raw body as string

     

       1552
       -
       					const rawBody = await req.text();

     

       1553
       -
       					const headers = Object.fromEntries(req.headers.entries());

     

       1554
        
       

     

       1555
       -
       					// Validate webhook signature (validated at startup)

     

       1556
       -
       					const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1557
       -
       					const event = validateEvent(rawBody, headers, webhookSecret);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1558
        
       

     

       1559
       -
       					console.log(`[Webhook] Received event: ${event.type}`);

     

       1560
        
       

     

       1561
       -
       					// Handle different event types

     

       0
        
       
     

       1562
        
       					switch (event.type) {

     

       1563
        
       						case "subscription.updated": {

     

       1564
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       1619
        
       

     

       1620
        
       					return Response.json({ received: true });

     

       1621
        
       				} catch (error) {

     

       1622
       -
       					console.error("[Webhook] Error processing webhook:", error);

     

       1623
       -
       					return Response.json(

     

       1624
       -
       						{ error: "Webhook processing failed" },

     

       1625
       -
       						{ status: 400 },

     

       1626
       -
       					);

     

       1627
        
       				}

     

       1628
        
       			},

     

       1629
        
       		},

     
···

       1669
        
       

     

       1670
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1671
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1672
       -
       						return Response.json(

     

       1673
       -
       							{ error: "Transcription not found" },

     

       1674
       -
       							{ status: 404 },

     

       1675
       -
       						);

     

       1676
        
       					}

     

       1677
        
       

     

       1678
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1797
        
       				}

     

       1798
        
       			},

     

       1799
        
       		},

     

       1800
       -
       		"/api/transcriptions/health": {

     

       1801
        
       			GET: async () => {

     

       1802
        
       				const health = {

     

       1803
        
       					status: "healthy",

     
···

       1836
        
       

     

       1837
        
       				// Check storage (uploads and transcripts directories)

     

       1838
        
       				try {

     

       1839
       -
       					const uploadsDir = Bun.file("./uploads");

     

       1840
       -
       					const transcriptsDir = Bun.file("./transcripts");

     

       1841
       -
       					const uploadsExists = await uploadsDir.exists();

     

       1842
       -
       					const transcriptsExists = await transcriptsDir.exists();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1843
        
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1844
        
       					if (!health.services.storage) {

     

       1845
        
       						health.status = "unhealthy";

     
···

       1907
        
       

     

       1908
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1909
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1910
       -
       						return Response.json(

     

       1911
       -
       							{ error: "Transcription not found" },

     

       1912
       -
       							{ status: 404 },

     

       1913
       -
       						);

     

       1914
        
       					}

     

       1915
        
       

     

       1916
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1926
        
       					if (transcription.status !== "completed") {

     

       1927
        
       						return Response.json(

     

       1928
        
       							{ error: "Transcription not completed yet" },

     

       1929
       -
       							{ status: 400 },

     

       1930
        
       						);

     

       1931
        
       					}

     

       1932
        
       

     
···

       2015
        
       

     

       2016
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       2017
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       2018
       -
       						return Response.json(

     

       2019
       -
       							{ error: "Transcription not found" },

     

       2020
       -
       							{ status: 404 },

     

       2021
       -
       						);

     

       2022
        
       					}

     

       2023
        
       

     

       2024
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       2090
        
       				}

     

       2091
        
       			},

     

       2092
        
       		},

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2093
        
       		"/api/transcriptions": {

     

       2094
        
       			GET: async (req) => {

     

       2095
        
       				try {

     
···

       2190
        
       						const { encodeCursor } = await import("./lib/cursor");

     

       2191
        
       						const last = transcriptions[transcriptions.length - 1];

     

       2192
        
       						if (last) {

     

       2193
       -
       							nextCursor = encodeCursor([

     

       2194
       -
       								last.created_at.toString(),

     

       2195
       -
       								last.id,

     

       2196
       -
       							]);

     

       2197
        
       						}

     

       2198
        
       					}

     

       2199
        
       

     
···

       2235
        
       					const formData = await req.formData();

     

       2236
        
       					const file = formData.get("audio") as File;

     

       2237
        
       					const classId = formData.get("class_id") as string | null;

     

       2238
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       0
        
       
     

       2239
        
       						| string

     

       2240
        
       						| null;

     

       2241
        
       

     
···

       2304
        
       					const uploadDir = "./uploads";

     

       2305
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       2306
        
       

     

       2307
       -
       					// Create database record

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2308
        
       					db.run(

     

       2309
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       2310
        
       						[

     

       2311
        
       							transcriptionId,

     

       2312
        
       							user.id,

     

       2313
        
       							classId,

     

       2314
       -
       							meetingTimeId,

     

       0
        
       
     

       2315
        
       							filename,

     

       2316
        
       							file.name,

     

       2317
        
       							"pending",

     

       0
        
       
     

       2318
        
       						],

     

       2319
        
       					);

     

       2320
        
       

     

       2321
        
       					// Don't auto-start transcription - admin will select recordings

     

       2322
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       2323
        
       

     

       2324
       -
       					return Response.json({

     

       2325
       -
       						id: transcriptionId,

     

       2326
       -
       						message: "Upload successful",

     

       2327
       -
       					});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2328
        
       				} catch (error) {

     

       2329
        
       					return handleError(error);

     

       2330
        
       				}

     
···

       2396
        
       					requireAdmin(req);

     

       2397
        
       					const id = req.params.id;

     

       2398
        
       					deleteWaitlistEntry(id);

     

       2399
       -
       					return Response.json({ success: true });

     

       2400
        
       				} catch (error) {

     

       2401
        
       					return handleError(error);

     

       2402
        
       				}

     
···

       2408
        
       					requireAdmin(req);

     

       2409
        
       					const transcriptionId = req.params.id;

     

       2410
        
       					deleteTranscription(transcriptionId);

     

       2411
       -
       					return Response.json({ success: true });

     

       2412
        
       				} catch (error) {

     

       2413
        
       					return handleError(error);

     

       2414
        
       				}

     
···

       2423
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2424
        
       					}

     

       2425
        
       					await deleteUser(userId);

     

       2426
       -
       					return Response.json({ success: true });

     

       2427
        
       				} catch (error) {

     

       2428
        
       					return handleError(error);

     

       2429
        
       				}

     
···

       2673
        
       

     

       2674
        
       					const { passkeyId } = req.params;

     

       2675
        
       					deletePasskey(passkeyId, userId);

     

       2676
       -
       					return Response.json({ success: true });

     

       2677
        
       				} catch (error) {

     

       2678
        
       					return handleError(error);

     

       2679
        
       				}

     
···

       2739
        
       					if (existing) {

     

       2740
        
       						return Response.json(

     

       2741
        
       							{ error: "Email already in use" },

     

       2742
       -
       							{ status: 400 },

     

       2743
        
       						);

     

       2744
        
       					}

     

       2745
        
       

     
···

       2824
        
       					}

     

       2825
        
       

     

       2826
        
       					deleteAllUserSessions(userId);

     

       2827
       -
       					return Response.json({ success: true });

     

       2828
        
       				} catch (error) {

     

       2829
        
       					return handleError(error);

     

       2830
        
       				}

     
···

       2849
        
       						);

     

       2850
        
       					}

     

       2851
        
       

     

       2852
       -
       					return Response.json({ success: true });

     

       2853
        
       				} catch (error) {

     

       2854
        
       					return handleError(error);

     

       2855
        
       				}

     
···

       2926
        
       						cursor,

     

       2927
        
       					);

     

       2928
        
       

     

       2929
       -
       					// For admin, return flat array. For users, group by semester/year

     

       2930
       -
       					if (user.role === "admin") {

     

       2931
       -
       						return Response.json(result.data);

     

       2932
       -
       					}

     

       2933
       -
       

     

       2934
       -
       					// Group by semester/year for regular users

     

       2935
        
       					const grouped: Record<

     

       2936
        
       						string,

     

       2937
        
       						Array<{

     
···

       3030
        
       						semester,

     

       3031
        
       						year,

     

       3032
        
       						meeting_times,

     

       0
        
       
     

       3033
        
       					});

     

       3034
        
       

     

       3035
       -
       					return Response.json(newClass);

     

       3036
        
       				} catch (error) {

     

       3037
        
       					return handleError(error);

     

       3038
        
       				}

     
···

       3059
        
       						.all(user.id)

     

       3060
        
       						.map((row) => row.class_id);

     

       3061
        
       

     

       3062
       -
       					// Add is_enrolled flag to each class

     

       3063
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       3064
        
       						...cls,

     

       3065
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       0
        
       
     

       3066
        
       					}));

     

       3067
        
       

     

       3068
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       3077
        
       					const user = requireAuth(req);

     

       3078
        
       					const body = await req.json();

     

       3079
        
       					const classId = body.class_id;

     

       0
        
       
     

       3080
        
       

     

       3081
        
       					const classIdValidation = validateClassId(classId);

     

       3082
        
       					if (!classIdValidation.valid) {

     
···

       3086
        
       						);

     

       3087
        
       					}

     

       3088
        
       

     

       3089
       -
       					const result = joinClass(classId, user.id);

     

       3090
        
       

     

       3091
        
       					if (!result.success) {

     

       3092
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       3093
        
       					}

     

       3094
        
       

     

       3095
       -
       					return Response.json({ success: true });

     

       3096
        
       				} catch (error) {

     

       3097
        
       					return handleError(error);

     

       3098
        
       				}

     
···

       3168
        
       						meetingTimes || null,

     

       3169
        
       					);

     

       3170
        
       

     

       3171
       -
       					return Response.json({ success: true, id });

     

       3172
        
       				} catch (error) {

     

       3173
        
       					return handleError(error);

     

       3174
        
       				}

     
···

       3195
        
       					}

     

       3196
        
       

     

       3197
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       0
        
       
     

       3198
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       0
        
       
     

       3199
        
       

     

       3200
        
       					return Response.json({

     

       3201
        
       						class: classInfo,

     

       3202
        
       						meetingTimes,

     

       0
        
       
     

       0
        
       
     

       3203
        
       						transcriptions,

     

       3204
        
       					});

     

       3205
        
       				} catch (error) {

     
···

       3211
        
       					requireAdmin(req);

     

       3212
        
       					const classId = req.params.id;

     

       3213
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3214
        
       					deleteClass(classId);

     

       3215
       -
       					return Response.json({ success: true });

     

       3216
        
       				} catch (error) {

     

       3217
        
       					return handleError(error);

     

       3218
        
       				}

     
···

       3231
        
       							{ error: "archived must be a boolean" },

     

       3232
        
       							{ status: 400 },

     

       3233
        
       						);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3234
        
       					}

     

       3235
        
       

     

       3236
        
       					toggleClassArchive(classId, archived);

     

       3237
       -
       					return Response.json({ success: true });

     

       3238
        
       				} catch (error) {

     

       3239
        
       					return handleError(error);

     

       3240
        
       				}

     
···

       3263
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       3264
        
       					}

     

       3265
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3266
        
       					const user = getUserByEmail(email);

     

       3267
        
       					if (!user) {

     

       3268
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3269
        
       					}

     

       3270
        
       

     

       3271
        
       					enrollUserInClass(user.id, classId);

     

       3272
       -
       					return Response.json({ success: true });

     

       3273
        
       				} catch (error) {

     

       3274
        
       					return handleError(error);

     

       3275
        
       				}

     
···

       3286
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       3287
        
       					}

     

       3288
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3289
        
       					removeUserFromClass(userId, classId);

     

       3290
       -
       					return Response.json({ success: true });

     

       3291
        
       				} catch (error) {

     

       3292
        
       					return handleError(error);

     

       3293
        
       				}

     
···

       3325
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3326
        
       					}

     

       3327
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3328
        
       					const meetingTime = createMeetingTime(classId, label);

     

       3329
       -
       					return Response.json(meetingTime);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3330
        
       				} catch (error) {

     

       3331
        
       					return handleError(error);

     

       3332
        
       				}

     
···

       3344
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3345
        
       					}

     

       3346
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3347
        
       					updateMeetingTime(meetingId, label);

     

       3348
       -
       					return Response.json({ success: true });

     

       3349
        
       				} catch (error) {

     

       3350
        
       					return handleError(error);

     

       3351
        
       				}

     
···

       3355
        
       					requireAdmin(req);

     

       3356
        
       					const meetingId = req.params.id;

     

       3357
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3358
        
       					deleteMeetingTime(meetingId);

     

       3359
       -
       					return Response.json({ success: true });

     

       3360
        
       				} catch (error) {

     

       3361
        
       					return handleError(error);

     

       3362
        
       				}

     
···

       3404
        
       						transcription.filename,

     

       3405
        
       					);

     

       3406
        
       

     

       3407
       -
       					return Response.json({ success: true });

     

       3408
        
       				} catch (error) {

     

       3409
        
       					return handleError(error);

     

       3410
        
       				}

     

       3411
        
       			},

     

       3412
        
       		},

     

       3413
        
       	},

     

       3414
       -
       	development: {

     

       3415
       -
       		hmr: true,

     

       3416
       -
       		console: true,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3417
        
       	},

     

       3418
        
       });

     

       3419
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     
···

       3435
        
       	server.stop();

     

       3436
        
       

     

       3437
        
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3438
       -
       	console.log(`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`);

     

       0
        
       
     

       0
        
       
     

       3439
        
       	for (const controller of activeSSEStreams) {

     

       3440
        
       		try {

     

       3441
        
       			controller.close();

···

       48
        
       	getClassById,

     

       49
        
       	getClassesForUser,

     

       50
        
       	getClassMembers,

     

       51
       +
       	getClassSections,

     

       52
       +
       	getMeetingById,

     

       53
        
       	getMeetingTimesForClass,

     

       54
        
       	getTranscriptionsForClass,

     

       55
       +
       	getUserSection,

     

       56
        
       	isUserEnrolledInClass,

     

       57
        
       	joinClass,

     

       58
        
       	removeUserFromClass,

     

       59
        
       	searchClassesByCourseCode,

     

       60
        
       	toggleClassArchive,

     

       61
        
       	updateMeetingTime,

     

       62
       +
       	createClassSection,

     

       63
        
       } from "./lib/classes";

     

       64
        
       import { sendEmail } from "./lib/email";

     

       65
        
       import {

     
···

       92
        
       	WhisperServiceManager,

     

       93
        
       } from "./lib/transcription";

     

       94
        
       import {

     

       95
       +
       	findMatchingMeetingTime,

     

       96
       +
       	getDayName,

     

       97
       +
       } from "./lib/audio-metadata";

     

       98
       +
       import {

     

       99
       +
       	checkAutoSubmit,

     

       100
       +
       	deletePendingRecording,

     

       101
       +
       	getEnrolledUserCount,

     

       102
       +
       	getPendingRecordings,

     

       103
       +
       	getUserVoteForMeeting,

     

       104
       +
       	markAsAutoSubmitted,

     

       105
       +
       	removeVote,

     

       106
       +
       	voteForRecording,

     

       107
       +
       } from "./lib/voting";

     

       108
       +
       import {

     

       109
        
       	validateClassId,

     

       110
        
       	validateCourseCode,

     

       111
        
       	validateCourseName,

     
···

       153
        
       		console.warn(

     

       154
        
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       155
        
       		);

     

       156
       +
       		console.warn("[Startup] Set ORIGIN in production for correct email links");

     

       0
        
       
     

       0
        
       
     

       157
        
       	}

     

       158
        
       

     

       159
        
       	console.log("[Startup] Environment variable validation passed");

     
···

       191
        
       	userId: number,

     

       192
        
       	email: string,

     

       193
        
       ): Promise<void> {

     

       194
       +
       	// Skip Polar sync in test mode

     

       195
       +
       	if (

     

       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       +
       	) {

     

       199
       +
       		return;

     

       200
       +
       	}

     

       201
       +
       

     

       202
        
       	try {

     

       203
        
       		const { polar } = await import("./lib/polar");

     

       204
        
       

     
···

       318
        
       	5 * 60 * 1000,

     

       319
        
       );

     

       320
        
       

     

       321
       +
       // Clean up stale files hourly

     

       322
        
       const fileCleanupInterval = setInterval(

     

       323
        
       	() => whisperService.cleanupStaleFiles(),

     

       324
       +
       	60 * 60 * 1000, // 1 hour

     

       325
        
       );

     

       326
        
       

     

       327
        
       const server = Bun.serve({

     

       328
       +
       	port:

     

       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       +
       			? 3001

     

       331
       +
       			: process.env.PORT

     

       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       +
       				: 3000,

     

       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       335
        
       	routes: {

     

       336
        
       		"/": indexHTML,

     
···

       423
        
       							email_verification_required: true,

     

       424
        
       							verification_code_sent_at: sentAt,

     

       425
        
       						},

     

       426
       +
       						{ status: 201 },

     

       427
        
       					);

     

       428
        
       				} catch (err: unknown) {

     

       429
        
       					const error = err as { message?: string };

     

       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       431
        
       						return Response.json(

     

       432
        
       							{ error: "Email already registered" },

     

       433
       +
       							{ status: 409 },

     

       434
        
       						);

     

       435
        
       					}

     

       436
        
       					console.error("[Auth] Registration error:", err);

     
···

       670
        
       						}),

     

       671
        
       					});

     

       672
        
       

     

       673
       +
       					return Response.json({

     

       674
       +
       						success: true,

     

       675
       +
       						message: "Verification email sent",

     

       676
       +
       					});

     

       677
        
       				} catch (error) {

     

       678
        
       					return handleError(error);

     

       679
        
       				}

     
···

       861
        
       					await updateUserPassword(userId, password);

     

       862
        
       					consumePasswordResetToken(token);

     

       863
        
       

     

       864
       +
       					return Response.json({

     

       865
       +
       						success: true,

     

       866
       +
       						message: "Password reset successfully",

     

       867
       +
       					});

     

       868
        
       				} catch (error) {

     

       869
        
       					console.error("[Email] Reset password error:", error);

     

       870
        
       					return Response.json(

     
···

       893
        
       		},

     

       894
        
       		"/api/auth/me": {

     

       895
        
       			GET: (req) => {

     

       896
       +
       				try {

     

       897
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       898
        
       

     

       899
       +
       					// Check subscription status

     

       900
       +
       					const subscription = db

     

       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       +
       						)

     

       904
       +
       						.get(user.id);

     

       905
        
       

     

       906
       +
       					// Get notification preferences

     

       907
       +
       					const prefs = db

     

       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       +
       						)

     

       911
       +
       						.get(user.id);

     

       912
        
       

     

       913
       +
       					return Response.json({

     

       914
       +
       						email: user.email,

     

       915
       +
       						name: user.name,

     

       916
       +
       						avatar: user.avatar,

     

       917
       +
       						created_at: user.created_at,

     

       918
       +
       						role: user.role,

     

       919
       +
       						has_subscription: !!subscription,

     

       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       +
       						email_notifications_enabled:

     

       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       +
       					});

     

       924
       +
       				} catch (err) {

     

       925
       +
       					return handleError(err);

     

       926
       +
       				}

     

       927
        
       			},

     

       928
        
       		},

     

       929
        
       		"/api/passkeys/register/options": {

     
···

       931
        
       				try {

     

       932
        
       					const user = requireAuth(req);

     

       933
        
       

     

       934
       +
       					const rateLimitError = enforceRateLimit(

     

       935
       +
       						req,

     

       936
       +
       						"passkey-register-options",

     

       937
       +
       						{

     

       938
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       939
       +
       						},

     

       940
       +
       					);

     

       941
        
       					if (rateLimitError) return rateLimitError;

     

       942
        
       

     

       943
        
       					const options = await createRegistrationOptions(user);

     
···

       952
        
       				try {

     

       953
        
       					const _user = requireAuth(req);

     

       954
        
       

     

       955
       +
       					const rateLimitError = enforceRateLimit(

     

       956
       +
       						req,

     

       957
       +
       						"passkey-register-verify",

     

       958
       +
       						{

     

       959
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       960
       +
       						},

     

       961
       +
       					);

     

       962
        
       					if (rateLimitError) return rateLimitError;

     

       963
        
       

     

       964
        
       					const body = await req.json();

     
···

       1089
        
       					}

     

       1090
        
       

     

       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       1092
       +
       					return new Response(null, { status: 204 });

     

       1093
        
       				} catch (err) {

     

       1094
        
       					return handleError(err);

     

       1095
        
       				}

     
···

       1105
        
       

     

       1106
        
       					const passkeyId = req.params.id;

     

       1107
        
       					deletePasskey(passkeyId, user.id);

     

       1108
       +
       					return new Response(null, { status: 204 });

     

       1109
        
       				} catch (err) {

     

       1110
        
       					return handleError(err);

     

       1111
        
       				}

     
···

       1113
        
       		},

     

       1114
        
       		"/api/sessions": {

     

       1115
        
       			GET: (req) => {

     

       1116
       +
       				try {

     

       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       +
       					if (!sessionId) {

     

       1119
       +
       						return Response.json(

     

       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       +
       							{ status: 401 },

     

       1122
       +
       						);

     

       1123
       +
       					}

     

       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       +
       					if (!user) {

     

       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       +
       					}

     

       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       +
       					return Response.json({

     

       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       +
       							id: s.id,

     

       1132
       +
       							ip_address: s.ip_address,

     

       1133
       +
       							user_agent: s.user_agent,

     

       1134
       +
       							created_at: s.created_at,

     

       1135
       +
       							expires_at: s.expires_at,

     

       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       +
       						})),

     

       1138
       +
       					});

     

       1139
       +
       				} catch (err) {

     

       1140
       +
       					return handleError(err);

     

       1141
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1142
        
       			},

     

       1143
        
       			DELETE: async (req) => {

     

       1144
       +
       				try {

     

       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       +
       					if (!currentSessionId) {

     

       1147
       +
       						return Response.json(

     

       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       +
       							{ status: 401 },

     

       1150
       +
       						);

     

       1151
       +
       					}

     

       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       +
       					if (!user) {

     

       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       +
       					}

     

       1156
        
       

     

       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       +
       					});

     

       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1161
        
       

     

       1162
       +
       					const body = await req.json();

     

       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       +
       					if (!targetSessionId) {

     

       1165
       +
       						return Response.json(

     

       1166
       +
       							{ error: "Session ID required" },

     

       1167
       +
       							{ status: 400 },

     

       1168
       +
       						);

     

       1169
       +
       					}

     

       1170
       +
       					// Prevent deleting current session

     

       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       +
       						return Response.json(

     

       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       +
       							{ status: 400 },

     

       1175
       +
       						);

     

       1176
       +
       					}

     

       1177
       +
       					// Verify the session belongs to the user

     

       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       +
       					}

     

       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       +
       				} catch (err) {

     

       1185
       +
       					return handleError(err);

     

       1186
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1187
        
       			},

     

       1188
        
       		},

     

       1189
        
       		"/api/user": {

     

       1190
        
       			DELETE: async (req) => {

     

       1191
       +
       				try {

     

       1192
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1193
        
       

     

       1194
       +
       					// Rate limiting

     

       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       +
       					});

     

       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       1199
        
       

     

       1200
       +
       					await deleteUser(user.id);

     

       1201
       +
       					return new Response(null, {

     

       1202
       +
       						status: 204,

     

       0
        
       
     

       1203
        
       						headers: {

     

       1204
        
       							"Set-Cookie":

     

       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       1206
        
       						},

     

       1207
       +
       					});

     

       1208
       +
       				} catch (err) {

     

       1209
       +
       					return handleError(err);

     

       1210
       +
       				}

     

       1211
        
       			},

     

       1212
        
       		},

     

       1213
        
       		"/api/user/email": {

     

       1214
        
       			PUT: async (req) => {

     

       1215
       +
       				try {

     

       1216
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1217
        
       

     

       1218
       +
       					// Rate limiting

     

       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       +
       					});

     

       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       1223
        
       

     

       1224
       +
       					const body = await req.json();

     

       1225
       +
       					const { email } = body;

     

       1226
       +
       					if (!email) {

     

       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       +
       					}

     

       1229
        
       

     

       1230
       +
       					// Check if email is already in use

     

       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       +
       					if (existingUser) {

     

       1233
       +
       						return Response.json(

     

       1234
       +
       							{ error: "Email already in use" },

     

       1235
       +
       							{ status: 409 },

     

       1236
       +
       						);

     

       1237
       +
       					}

     

       1238
        
       

     

       1239
       +
       					try {

     

       1240
       +
       						// Create email change token

     

       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1242
        
       

     

       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1246
        
       

     

       1247
       +
       						await sendEmail({

     

       1248
       +
       							to: user.email,

     

       1249
       +
       							subject: "Verify your email change",

     

       1250
       +
       							html: emailChangeTemplate({

     

       1251
       +
       								name: user.name,

     

       1252
       +
       								currentEmail: user.email,

     

       1253
       +
       								newEmail: email,

     

       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       +
       							}),

     

       1256
       +
       						});

     

       1257
        
       

     

       1258
       +
       						return Response.json({

     

       1259
       +
       							success: true,

     

       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       +
       							pendingEmail: email,

     

       1262
       +
       						});

     

       1263
       +
       					} catch (error) {

     

       1264
       +
       						console.error(

     

       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       +
       							error,

     

       1267
       +
       						);

     

       1268
       +
       						return Response.json(

     

       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       +
       							{ status: 500 },

     

       1271
       +
       						);

     

       1272
       +
       					}

     

       1273
       +
       				} catch (err) {

     

       1274
       +
       					return handleError(err);

     

       1275
        
       				}

     

       1276
        
       			},

     

       1277
        
       		},

     
···

       1319
        
       		},

     

       1320
        
       		"/api/user/password": {

     

       1321
        
       			PUT: async (req) => {

     

       1322
       +
       				try {

     

       1323
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1324
        
       

     

       1325
       +
       					// Rate limiting

     

       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       +
       					});

     

       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       1330
        
       

     

       1331
       +
       					const body = await req.json();

     

       1332
       +
       					const { password } = body;

     

       1333
       +
       					if (!password) {

     

       1334
       +
       						return Response.json(

     

       1335
       +
       							{ error: "Password required" },

     

       1336
       +
       							{ status: 400 },

     

       1337
       +
       						);

     

       1338
       +
       					}

     

       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       +
       						return Response.json(

     

       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       +
       							{ status: 400 },

     

       1345
       +
       						);

     

       1346
       +
       					}

     

       1347
       +
       					try {

     

       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       +
       						return Response.json({ success: true });

     

       1350
       +
       					} catch {

     

       1351
       +
       						return Response.json(

     

       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       +
       							{ status: 500 },

     

       1354
       +
       						);

     

       1355
       +
       					}

     

       1356
       +
       				} catch (err) {

     

       1357
       +
       					return handleError(err);

     

       1358
        
       				}

     

       1359
        
       			},

     

       1360
        
       		},

     

       1361
        
       		"/api/user/name": {

     

       1362
        
       			PUT: async (req) => {

     

       1363
       +
       				try {

     

       1364
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1365
        
       

     

       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       +
       					});

     

       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1370
        
       

     

       1371
       +
       					const body = await req.json();

     

       1372
       +
       					const { name } = body;

     

       1373
       +
       					if (!name) {

     

       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       +
       					}

     

       1376
       +
       					try {

     

       1377
       +
       						updateUserName(user.id, name);

     

       1378
       +
       						return Response.json({ success: true });

     

       1379
       +
       					} catch {

     

       1380
       +
       						return Response.json(

     

       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       +
       							{ status: 500 },

     

       1383
       +
       						);

     

       1384
       +
       					}

     

       1385
       +
       				} catch (err) {

     

       1386
       +
       					return handleError(err);

     

       1387
        
       				}

     

       1388
        
       			},

     

       1389
        
       		},

     

       1390
        
       		"/api/user/avatar": {

     

       1391
        
       			PUT: async (req) => {

     

       1392
       +
       				try {

     

       1393
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1394
        
       

     

       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       +
       					});

     

       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1399
        
       

     

       1400
       +
       					const body = await req.json();

     

       1401
       +
       					const { avatar } = body;

     

       1402
       +
       					if (!avatar) {

     

       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       +
       					}

     

       1405
       +
       					try {

     

       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       +
       						return Response.json({ success: true });

     

       1408
       +
       					} catch {

     

       1409
       +
       						return Response.json(

     

       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       +
       							{ status: 500 },

     

       1412
       +
       						);

     

       1413
       +
       					}

     

       1414
       +
       				} catch (err) {

     

       1415
       +
       					return handleError(err);

     

       1416
        
       				}

     

       1417
        
       			},

     

       1418
        
       		},

     

       1419
        
       		"/api/user/notifications": {

     

       1420
        
       			PUT: async (req) => {

     

       1421
       +
       				try {

     

       1422
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1423
        
       

     

       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       +
       					});

     

       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       1428
        
       

     

       1429
       +
       					const body = await req.json();

     

       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       1432
       +
       						return Response.json(

     

       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       +
       							{ status: 400 },

     

       1435
       +
       						);

     

       1436
       +
       					}

     

       1437
       +
       					try {

     

       1438
       +
       						db.run(

     

       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       +
       						);

     

       1442
       +
       						return Response.json({ success: true });

     

       1443
       +
       					} catch {

     

       1444
       +
       						return Response.json(

     

       1445
       +
       							{ error: "Failed to update notification settings" },

     

       1446
       +
       							{ status: 500 },

     

       1447
       +
       						);

     

       1448
       +
       					}

     

       1449
       +
       				} catch (err) {

     

       1450
       +
       					return handleError(err);

     

       1451
        
       				}

     

       1452
        
       			},

     

       1453
        
       		},

     

       1454
        
       		"/api/billing/checkout": {

     

       1455
        
       			POST: async (req) => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1456
        
       				try {

     

       1457
       +
       					const user = requireAuth(req);

     

       1458
       +
       

     

       1459
        
       					const { polar } = await import("./lib/polar");

     

       1460
        
       

     

       1461
        
       					// Validated at startup

     
···

       1474
        
       					});

     

       1475
        
       

     

       1476
        
       					return Response.json({ url: checkout.url });

     

       1477
       +
       				} catch (err) {

     

       1478
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1479
        
       				}

     

       1480
        
       			},

     

       1481
        
       		},

     

       1482
        
       		"/api/billing/subscription": {

     

       1483
        
       			GET: async (req) => {

     

       1484
       +
       				try {

     

       1485
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1486
        
       

     

       0
        
       
     

       1487
        
       					// Get subscription from database

     

       1488
        
       					const subscription = db

     

       1489
        
       						.query<

     
···

       1506
        
       					}

     

       1507
        
       

     

       1508
        
       					return Response.json({ subscription });

     

       1509
       +
       				} catch (err) {

     

       1510
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1511
        
       				}

     

       1512
        
       			},

     

       1513
        
       		},

     

       1514
        
       		"/api/billing/portal": {

     

       1515
        
       			POST: async (req) => {

     

       1516
       +
       				try {

     

       1517
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1518
        
       

     

       0
        
       
     

       1519
        
       					const { polar } = await import("./lib/polar");

     

       1520
        
       

     

       1521
        
       					// Get subscription to find customer ID

     
···

       1543
        
       					});

     

       1544
        
       

     

       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1546
       +
       				} catch (err) {

     

       1547
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1548
        
       				}

     

       1549
        
       			},

     

       1550
        
       		},

     

       1551
        
       		"/api/webhooks/polar": {

     

       1552
        
       			POST: async (req) => {

     

       1553
       +
       				const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       0
        
       
     

       1554
        
       

     

       1555
       +
       				// Get raw body as string

     

       1556
       +
       				const rawBody = await req.text();

     

       1557
       +
       				const headers = Object.fromEntries(req.headers.entries());

     

       1558
        
       

     

       1559
       +
       				// Validate webhook signature (validated at startup)

     

       1560
       +
       				const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1561
       +
       				let event: ReturnType<typeof validateEvent>;

     

       1562
       +
       				try {

     

       1563
       +
       					event = validateEvent(rawBody, headers, webhookSecret);

     

       1564
       +
       				} catch (error) {

     

       1565
       +
       					// Validation failed - log but return generic response

     

       1566
       +
       					console.error("[Webhook] Signature validation failed:", error);

     

       1567
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1568
       +
       				}

     

       1569
        
       

     

       1570
       +
       				console.log(`[Webhook] Received event: ${event.type}`);

     

       1571
        
       

     

       1572
       +
       				// Handle different event types

     

       1573
       +
       				try {

     

       1574
        
       					switch (event.type) {

     

       1575
        
       						case "subscription.updated": {

     

       1576
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       1631
        
       

     

       1632
        
       					return Response.json({ received: true });

     

       1633
        
       				} catch (error) {

     

       1634
       +
       					// Processing failed - log with detail but return generic response

     

       1635
       +
       					console.error("[Webhook] Event processing failed:", error);

     

       1636
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       0
        
       
     

       0
        
       
     

       1637
        
       				}

     

       1638
        
       			},

     

       1639
        
       		},

     
···

       1679
        
       

     

       1680
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1681
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1683
        
       					}

     

       1684
        
       

     

       1685
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1804
        
       				}

     

       1805
        
       			},

     

       1806
        
       		},

     

       1807
       +
       		"/api/health": {

     

       1808
        
       			GET: async () => {

     

       1809
        
       				const health = {

     

       1810
        
       					status: "healthy",

     
···

       1843
        
       

     

       1844
        
       				// Check storage (uploads and transcripts directories)

     

       1845
        
       				try {

     

       1846
       +
       					const fs = await import("node:fs/promises");

     

       1847
       +
       					const uploadsExists = await fs

     

       1848
       +
       						.access("./uploads")

     

       1849
       +
       						.then(() => true)

     

       1850
       +
       						.catch(() => false);

     

       1851
       +
       					const transcriptsExists = await fs

     

       1852
       +
       						.access("./transcripts")

     

       1853
       +
       						.then(() => true)

     

       1854
       +
       						.catch(() => false);

     

       1855
        
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1856
        
       					if (!health.services.storage) {

     

       1857
        
       						health.status = "unhealthy";

     
···

       1919
        
       

     

       1920
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1921
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1923
        
       					}

     

       1924
        
       

     

       1925
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1935
        
       					if (transcription.status !== "completed") {

     

       1936
        
       						return Response.json(

     

       1937
        
       							{ error: "Transcription not completed yet" },

     

       1938
       +
       							{ status: 409 },

     

       1939
        
       						);

     

       1940
        
       					}

     

       1941
        
       

     
···

       2024
        
       

     

       2025
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       2026
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2028
        
       					}

     

       2029
        
       

     

       2030
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       2096
        
       				}

     

       2097
        
       			},

     

       2098
        
       		},

     

       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       +
       			POST: async (req) => {

     

       2101
       +
       				try {

     

       2102
       +
       					const user = requireAuth(req);

     

       2103
       +
       

     

       2104
       +
       					const formData = await req.formData();

     

       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       +
       						| string

     

       2109
       +
       						| null;

     

       2110
       +
       

     

       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       +
       

     

       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       +
       						return Response.json(

     

       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       +
       							{ status: 403 },

     

       2120
       +
       						);

     

       2121
       +
       					}

     

       2122
       +
       

     

       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       +
       

     

       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       +
       					if (fileTimestampStr) {

     

       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       +
       							console.log(

     

       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       +
       							);

     

       2133
       +
       						}

     

       2134
       +
       					}

     

       2135
       +
       

     

       2136
       +
       					if (!creationDate) {

     

       2137
       +
       						return Response.json({

     

       2138
       +
       							detected: false,

     

       2139
       +
       							meeting_time_id: null,

     

       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       +
       						});

     

       2142
       +
       					}

     

       2143
       +
       

     

       2144
       +
       					// Get meeting times for this class

     

       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       +
       

     

       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       +
       						return Response.json({

     

       2149
       +
       							detected: false,

     

       2150
       +
       							meeting_time_id: null,

     

       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       +
       						});

     

       2153
       +
       					}

     

       2154
       +
       

     

       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       +
       						creationDate,

     

       2158
       +
       						meetingTimes,

     

       2159
       +
       					);

     

       2160
       +
       

     

       2161
       +
       					if (matchedId) {

     

       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       +
       						return Response.json({

     

       2164
       +
       							detected: true,

     

       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       +
       							day: dayName,

     

       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       +
       						});

     

       2169
       +
       					}

     

       2170
       +
       

     

       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       +
       					return Response.json({

     

       2173
       +
       						detected: false,

     

       2174
       +
       						meeting_time_id: null,

     

       2175
       +
       						day: dayName,

     

       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       +
       					});

     

       2179
       +
       				} catch (error) {

     

       2180
       +
       					return handleError(error);

     

       2181
       +
       				}

     

       2182
       +
       			},

     

       2183
       +
       		},

     

       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       +
       			PATCH: async (req) => {

     

       2186
       +
       				try {

     

       2187
       +
       					const user = requireAuth(req);

     

       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       +
       

     

       2190
       +
       					const body = await req.json();

     

       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       +
       					const sectionId = body.section_id;

     

       2193
       +
       

     

       2194
       +
       					if (!meetingTimeId) {

     

       2195
       +
       						return Response.json(

     

       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       +
       							{ status: 400 },

     

       2198
       +
       						);

     

       2199
       +
       					}

     

       2200
       +
       

     

       2201
       +
       					// Verify transcription ownership

     

       2202
       +
       					const transcription = db

     

       2203
       +
       						.query<

     

       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       +
       							[string]

     

       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       +
       						.get(transcriptionId);

     

       2208
       +
       

     

       2209
       +
       					if (!transcription) {

     

       2210
       +
       						return Response.json(

     

       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       +
       							{ status: 404 },

     

       2213
       +
       						);

     

       2214
       +
       					}

     

       2215
       +
       

     

       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       +
       					}

     

       2219
       +
       

     

       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       +
       					if (transcription.class_id) {

     

       2222
       +
       						const meetingTime = db

     

       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       +
       							)

     

       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       +
       

     

       2228
       +
       						if (!meetingTime) {

     

       2229
       +
       							return Response.json(

     

       2230
       +
       								{

     

       2231
       +
       									error:

     

       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       +
       								},

     

       2234
       +
       								{ status: 400 },

     

       2235
       +
       							);

     

       2236
       +
       						}

     

       2237
       +
       					}

     

       2238
       +
       

     

       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       +
       						db.run(

     

       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       +
       						);

     

       2245
       +
       					} else {

     

       2246
       +
       						db.run(

     

       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       +
       						);

     

       2250
       +
       					}

     

       2251
       +
       

     

       2252
       +
       					return Response.json({

     

       2253
       +
       						success: true,

     

       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       +
       					});

     

       2256
       +
       				} catch (error) {

     

       2257
       +
       					return handleError(error);

     

       2258
       +
       				}

     

       2259
       +
       			},

     

       2260
       +
       		},

     

       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       2262
       +
       			GET: async (req) => {

     

       2263
       +
       				try {

     

       2264
       +
       					const user = requireAuth(req);

     

       2265
       +
       					const classId = req.params.classId;

     

       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       2267
       +
       

     

       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       +
       						return Response.json(

     

       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       +
       							{ status: 403 },

     

       2274
       +
       						);

     

       2275
       +
       					}

     

       2276
       +
       

     

       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       +
       					const url = new URL(req.url);

     

       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       +
       					const sectionFilter =

     

       2281
       +
       						sectionParam !== null

     

       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       +
       							: user.role === "admin"

     

       2284
       +
       								? null

     

       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
       +
       

     

       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       +
       						classId,

     

       2289
       +
       						meetingTimeId,

     

       2290
       +
       						sectionFilter,

     

       2291
       +
       					);

     

       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       +
       						user.id,

     

       2295
       +
       						classId,

     

       2296
       +
       						meetingTimeId,

     

       2297
       +
       					);

     

       2298
       +
       

     

       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       +
       						classId,

     

       2302
       +
       						meetingTimeId,

     

       2303
       +
       						sectionFilter,

     

       2304
       +
       					);

     

       2305
       +
       

     

       2306
       +
       					return Response.json({

     

       2307
       +
       						recordings,

     

       2308
       +
       						total_users: totalUsers,

     

       2309
       +
       						user_vote: userVote,

     

       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       +
       						winning_recording_id: winningId,

     

       2312
       +
       					});

     

       2313
       +
       				} catch (error) {

     

       2314
       +
       					return handleError(error);

     

       2315
       +
       				}

     

       2316
       +
       			},

     

       2317
       +
       		},

     

       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       +
       			POST: async (req) => {

     

       2320
       +
       				try {

     

       2321
       +
       					const user = requireAuth(req);

     

       2322
       +
       					const recordingId = req.params.id;

     

       2323
       +
       

     

       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       +
       					const recording = db

     

       2326
       +
       						.query<

     

       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       +
       							[string]

     

       2329
       +
       						>(

     

       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       2331
       +
       						)

     

       2332
       +
       						.get(recordingId);

     

       2333
       +
       

     

       2334
       +
       					if (!recording) {

     

       2335
       +
       						return Response.json(

     

       2336
       +
       							{ error: "Recording not found" },

     

       2337
       +
       							{ status: 404 },

     

       2338
       +
       						);

     

       2339
       +
       					}

     

       2340
       +
       

     

       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       +
       						return Response.json(

     

       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       +
       							{ status: 400 },

     

       2345
       +
       						);

     

       2346
       +
       					}

     

       2347
       +
       

     

       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       +
       						return Response.json(

     

       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       +
       							{ status: 403 },

     

       2353
       +
       						);

     

       2354
       +
       					}

     

       2355
       +
       

     

       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       +
       						user.id,

     

       2359
       +
       						recording.class_id,

     

       2360
       +
       						recording.meeting_time_id,

     

       2361
       +
       					);

     

       2362
       +
       					if (existingVote) {

     

       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       +
       					}

     

       2365
       +
       

     

       2366
       +
       					// Add new vote

     

       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       +
       

     

       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       +
       					const userSection =

     

       2371
       +
       						user.role === "admin"

     

       2372
       +
       							? null

     

       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       +
       

     

       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       +
       						recording.class_id,

     

       2378
       +
       						recording.meeting_time_id,

     

       2379
       +
       						userSection,

     

       2380
       +
       					);

     

       2381
       +
       					if (winningId) {

     

       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       +
       						// Start transcription

     

       2384
       +
       						const winningRecording = db

     

       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       +
       							)

     

       2388
       +
       							.get(winningId);

     

       2389
       +
       						if (winningRecording) {

     

       2390
       +
       							whisperService.startTranscription(

     

       2391
       +
       								winningId,

     

       2392
       +
       								winningRecording.filename,

     

       2393
       +
       							);

     

       2394
       +
       						}

     

       2395
       +
       					}

     

       2396
       +
       

     

       2397
       +
       					return Response.json({

     

       2398
       +
       						success,

     

       2399
       +
       						winning_recording_id: winningId,

     

       2400
       +
       					});

     

       2401
       +
       				} catch (error) {

     

       2402
       +
       					return handleError(error);

     

       2403
       +
       				}

     

       2404
       +
       			},

     

       2405
       +
       		},

     

       2406
       +
       		"/api/recordings/:id": {

     

       2407
       +
       			DELETE: async (req) => {

     

       2408
       +
       				try {

     

       2409
       +
       					const user = requireAuth(req);

     

       2410
       +
       					const recordingId = req.params.id;

     

       2411
       +
       

     

       2412
       +
       					const success = deletePendingRecording(

     

       2413
       +
       						recordingId,

     

       2414
       +
       						user.id,

     

       2415
       +
       						user.role === "admin",

     

       2416
       +
       					);

     

       2417
       +
       

     

       2418
       +
       					if (!success) {

     

       2419
       +
       						return Response.json(

     

       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       +
       							{ status: 403 },

     

       2422
       +
       						);

     

       2423
       +
       					}

     

       2424
       +
       

     

       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       +
       				} catch (error) {

     

       2427
       +
       					return handleError(error);

     

       2428
       +
       				}

     

       2429
       +
       			},

     

       2430
       +
       		},

     

       2431
        
       		"/api/transcriptions": {

     

       2432
        
       			GET: async (req) => {

     

       2433
        
       				try {

     
···

       2528
        
       						const { encodeCursor } = await import("./lib/cursor");

     

       2529
        
       						const last = transcriptions[transcriptions.length - 1];

     

       2530
        
       						if (last) {

     

       2531
       +
       							nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2532
        
       						}

     

       2533
        
       					}

     

       2534
        
       

     
···

       2570
        
       					const formData = await req.formData();

     

       2571
        
       					const file = formData.get("audio") as File;

     

       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       2575
        
       						| string

     

       2576
        
       						| null;

     

       2577
        
       

     
···

       2640
        
       					const uploadDir = "./uploads";

     

       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       2642
        
       

     

       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       +
       

     

       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       2649
        
       					db.run(

     

       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       2651
        
       						[

     

       2652
        
       							transcriptionId,

     

       2653
        
       							user.id,

     

       2654
        
       							classId,

     

       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       +
       							sectionId,

     

       2657
        
       							filename,

     

       2658
        
       							file.name,

     

       2659
        
       							"pending",

     

       2660
       +
       							recordingDate,

     

       2661
        
       						],

     

       2662
        
       					);

     

       2663
        
       

     

       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       2666
        
       

     

       2667
       +
       					return Response.json(

     

       2668
       +
       						{

     

       2669
       +
       							id: transcriptionId,

     

       2670
       +
       							message: "Upload successful",

     

       2671
       +
       						},

     

       2672
       +
       						{ status: 201 },

     

       2673
       +
       					);

     

       2674
        
       				} catch (error) {

     

       2675
        
       					return handleError(error);

     

       2676
        
       				}

     
···

       2742
        
       					requireAdmin(req);

     

       2743
        
       					const id = req.params.id;

     

       2744
        
       					deleteWaitlistEntry(id);

     

       2745
       +
       					return new Response(null, { status: 204 });

     

       2746
        
       				} catch (error) {

     

       2747
        
       					return handleError(error);

     

       2748
        
       				}

     
···

       2754
        
       					requireAdmin(req);

     

       2755
        
       					const transcriptionId = req.params.id;

     

       2756
        
       					deleteTranscription(transcriptionId);

     

       2757
       +
       					return new Response(null, { status: 204 });

     

       2758
        
       				} catch (error) {

     

       2759
        
       					return handleError(error);

     

       2760
        
       				}

     
···

       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2770
        
       					}

     

       2771
        
       					await deleteUser(userId);

     

       2772
       +
       					return new Response(null, { status: 204 });

     

       2773
        
       				} catch (error) {

     

       2774
        
       					return handleError(error);

     

       2775
        
       				}

     
···

       3019
        
       

     

       3020
        
       					const { passkeyId } = req.params;

     

       3021
        
       					deletePasskey(passkeyId, userId);

     

       3022
       +
       					return new Response(null, { status: 204 });

     

       3023
        
       				} catch (error) {

     

       3024
        
       					return handleError(error);

     

       3025
        
       				}

     
···

       3085
        
       					if (existing) {

     

       3086
        
       						return Response.json(

     

       3087
        
       							{ error: "Email already in use" },

     

       3088
       +
       							{ status: 409 },

     

       3089
        
       						);

     

       3090
        
       					}

     

       3091
        
       

     
···

       3170
        
       					}

     

       3171
        
       

     

       3172
        
       					deleteAllUserSessions(userId);

     

       3173
       +
       					return new Response(null, { status: 204 });

     

       3174
        
       				} catch (error) {

     

       3175
        
       					return handleError(error);

     

       3176
        
       				}

     
···

       3195
        
       						);

     

       3196
        
       					}

     

       3197
        
       

     

       3198
       +
       					return new Response(null, { status: 204 });

     

       3199
        
       				} catch (error) {

     

       3200
        
       					return handleError(error);

     

       3201
        
       				}

     
···

       3272
        
       						cursor,

     

       3273
        
       					);

     

       3274
        
       

     

       3275
       +
       					// Group by semester/year for all users

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3276
        
       					const grouped: Record<

     

       3277
        
       						string,

     

       3278
        
       						Array<{

     
···

       3371
        
       						semester,

     

       3372
        
       						year,

     

       3373
        
       						meeting_times,

     

       3374
       +
       						sections: body.sections,

     

       3375
        
       					});

     

       3376
        
       

     

       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       3378
        
       				} catch (error) {

     

       3379
        
       					return handleError(error);

     

       3380
        
       				}

     
···

       3401
        
       						.all(user.id)

     

       3402
        
       						.map((row) => row.class_id);

     

       3403
        
       

     

       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       3406
        
       						...cls,

     

       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       +
       						sections: getClassSections(cls.id),

     

       3409
        
       					}));

     

       3410
        
       

     

       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       3420
        
       					const user = requireAuth(req);

     

       3421
        
       					const body = await req.json();

     

       3422
        
       					const classId = body.class_id;

     

       3423
       +
       					const sectionId = body.section_id || null;

     

       3424
        
       

     

       3425
        
       					const classIdValidation = validateClassId(classId);

     

       3426
        
       					if (!classIdValidation.valid) {

     
···

       3430
        
       						);

     

       3431
        
       					}

     

       3432
        
       

     

       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       3434
        
       

     

       3435
        
       					if (!result.success) {

     

       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       3437
        
       					}

     

       3438
        
       

     

       3439
       +
       					return new Response(null, { status: 204 });

     

       3440
        
       				} catch (error) {

     

       3441
        
       					return handleError(error);

     

       3442
        
       				}

     
···

       3512
        
       						meetingTimes || null,

     

       3513
        
       					);

     

       3514
        
       

     

       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       3516
        
       				} catch (error) {

     

       3517
        
       					return handleError(error);

     

       3518
        
       				}

     
···

       3539
        
       					}

     

       3540
        
       

     

       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       +
       					const sections = getClassSections(classId);

     

       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       3545
        
       

     

       3546
        
       					return Response.json({

     

       3547
        
       						class: classInfo,

     

       3548
        
       						meetingTimes,

     

       3549
       +
       						sections,

     

       3550
       +
       						userSection,

     

       3551
        
       						transcriptions,

     

       3552
        
       					});

     

       3553
        
       				} catch (error) {

     
···

       3559
        
       					requireAdmin(req);

     

       3560
        
       					const classId = req.params.id;

     

       3561
        
       

     

       3562
       +
       					// Verify class exists

     

       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       +
       					if (!existingClass) {

     

       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       +
       					}

     

       3567
       +
       

     

       3568
        
       					deleteClass(classId);

     

       3569
       +
       					return new Response(null, { status: 204 });

     

       3570
        
       				} catch (error) {

     

       3571
        
       					return handleError(error);

     

       3572
        
       				}

     
···

       3585
        
       							{ error: "archived must be a boolean" },

     

       3586
        
       							{ status: 400 },

     

       3587
        
       						);

     

       3588
       +
       					}

     

       3589
       +
       

     

       3590
       +
       					// Verify class exists

     

       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       +
       					if (!existingClass) {

     

       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
        
       					}

     

       3595
        
       

     

       3596
        
       					toggleClassArchive(classId, archived);

     

       3597
       +
       					return new Response(null, { status: 204 });

     

       3598
        
       				} catch (error) {

     

       3599
        
       					return handleError(error);

     

       3600
        
       				}

     
···

       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       3624
        
       					}

     

       3625
        
       

     

       3626
       +
       					// Verify class exists

     

       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       +
       					if (!existingClass) {

     

       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       +
       					}

     

       3631
       +
       

     

       3632
        
       					const user = getUserByEmail(email);

     

       3633
        
       					if (!user) {

     

       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3635
        
       					}

     

       3636
        
       

     

       3637
        
       					enrollUserInClass(user.id, classId);

     

       3638
       +
       					return new Response(null, { status: 201 });

     

       3639
        
       				} catch (error) {

     

       3640
        
       					return handleError(error);

     

       3641
        
       				}

     
···

       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       3653
        
       					}

     

       3654
        
       

     

       3655
       +
       					// Verify class exists

     

       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       +
       					if (!existingClass) {

     

       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       +
       					}

     

       3660
       +
       

     

       3661
        
       					removeUserFromClass(userId, classId);

     

       3662
       +
       					return new Response(null, { status: 204 });

     

       3663
        
       				} catch (error) {

     

       3664
        
       					return handleError(error);

     

       3665
        
       				}

     
···

       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3698
        
       					}

     

       3699
        
       

     

       3700
       +
       					// Verify class exists

     

       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       +
       					if (!existingClass) {

     

       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       +
       					}

     

       3705
       +
       

     

       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       +
       				} catch (error) {

     

       3709
       +
       					return handleError(error);

     

       3710
       +
       				}

     

       3711
       +
       			},

     

       3712
       +
       		},

     

       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       +
       			POST: async (req) => {

     

       3715
       +
       				try {

     

       3716
       +
       					requireAdmin(req);

     

       3717
       +
       					const classId = req.params.id;

     

       3718
       +
       					const body = await req.json();

     

       3719
       +
       					const { section_number } = body;

     

       3720
       +
       

     

       3721
       +
       					if (!section_number) {

     

       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       +
       					}

     

       3724
       +
       

     

       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       +
       					return Response.json(section);

     

       3727
       +
       				} catch (error) {

     

       3728
       +
       					return handleError(error);

     

       3729
       +
       				}

     

       3730
       +
       			},

     

       3731
       +
       		},

     

       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       +
       			DELETE: async (req) => {

     

       3734
       +
       				try {

     

       3735
       +
       					requireAdmin(req);

     

       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       +
       

     

       3738
       +
       					// Check if any students are in this section

     

       3739
       +
       					const studentsInSection = db

     

       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       +
       						)

     

       3743
       +
       						.get(sectionId);

     

       3744
       +
       

     

       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       +
       						return Response.json(

     

       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       +
       							{ status: 400 },

     

       3749
       +
       						);

     

       3750
       +
       					}

     

       3751
       +
       

     

       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       +
       					return new Response(null, { status: 204 });

     

       3754
        
       				} catch (error) {

     

       3755
        
       					return handleError(error);

     

       3756
        
       				}

     
···

       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3769
        
       					}

     

       3770
        
       

     

       3771
       +
       					// Verify meeting exists

     

       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       +
       					if (!existingMeeting) {

     

       3774
       +
       						return Response.json(

     

       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       +
       							{ status: 404 },

     

       3777
       +
       						);

     

       3778
       +
       					}

     

       3779
       +
       

     

       3780
        
       					updateMeetingTime(meetingId, label);

     

       3781
       +
       					return new Response(null, { status: 204 });

     

       3782
        
       				} catch (error) {

     

       3783
        
       					return handleError(error);

     

       3784
        
       				}

     
···

       3788
        
       					requireAdmin(req);

     

       3789
        
       					const meetingId = req.params.id;

     

       3790
        
       

     

       3791
       +
       					// Verify meeting exists

     

       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       +
       					if (!existingMeeting) {

     

       3794
       +
       						return Response.json(

     

       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       +
       							{ status: 404 },

     

       3797
       +
       						);

     

       3798
       +
       					}

     

       3799
       +
       

     

       3800
        
       					deleteMeetingTime(meetingId);

     

       3801
       +
       					return new Response(null, { status: 204 });

     

       3802
        
       				} catch (error) {

     

       3803
        
       					return handleError(error);

     

       3804
        
       				}

     
···

       3846
        
       						transcription.filename,

     

       3847
        
       					);

     

       3848
        
       

     

       3849
       +
       					return new Response(null, { status: 204 });

     

       3850
        
       				} catch (error) {

     

       3851
        
       					return handleError(error);

     

       3852
        
       				}

     

       3853
        
       			},

     

       3854
        
       		},

     

       3855
        
       	},

     

       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       +
       	fetch(req, server) {

     

       3858
       +
       		const response = server.fetch(req);

     

       3859
       +
       

     

       3860
       +
       		// Add security headers to all responses

     

       3861
       +
       		if (response instanceof Response) {

     

       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       +
       

     

       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       +
       			headers.set(

     

       3871
       +
       				"Content-Security-Policy",

     

       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       +
       			);

     

       3874
       +
       

     

       3875
       +
       			return new Response(response.body, {

     

       3876
       +
       				status: response.status,

     

       3877
       +
       				statusText: response.statusText,

     

       3878
       +
       				headers,

     

       3879
       +
       			});

     

       3880
       +
       		}

     

       3881
       +
       

     

       3882
       +
       		return response;

     

       3883
        
       	},

     

       3884
        
       });

     

       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     
···

       3901
        
       	server.stop();

     

       3902
        
       

     

       3903
        
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3904
       +
       	console.log(

     

       3905
       +
       		`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`,

     

       3906
       +
       	);

     

       3907
        
       	for (const controller of activeSSEStreams) {

     

       3908
        
       		try {

     

       3909
        
       			controller.close();

+1 -1

src/lib/api-response-format.test.ts

···

       2
        
       

     

       3
        
       /**

     

       4
        
        * API Response Format Standards

     

       5
       -
        * 

     

       6
        
        * This test documents the standardized response formats across the API.

     

       7
        
        * All endpoints should follow these patterns for consistency.

     

       8
        
        */

···

       2
        
       

     

       3
        
       /**

     

       4
        
        * API Response Format Standards

     

       5
       +
        *

     

       6
        
        * This test documents the standardized response formats across the API.

     

       7
        
        * All endpoints should follow these patterns for consistency.

     

       8
        
        */

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       +
       

     

       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       +
       

     

       7
       +
       	// Clean up test file after tests

     

       8
       +
       	afterAll(async () => {

     

       9
       +
       		try {

     

       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       +
       				if (exists) {

     

       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       +
       				}

     

       14
       +
       			});

     

       15
       +
       		} catch {

     

       16
       +
       			// Ignore cleanup errors

     

       17
       +
       		}

     

       18
       +
       	});

     

       19
       +
       

     

       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       +
       

     

       25
       +
       		// Create the file with metadata

     

       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       +
       

     

       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       +
       

     

       30
       +
       		expect(date).not.toBeNull();

     

       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       +
       	});

     

       35
       +
       

     

       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       +
       		// Create audio file without metadata

     

       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       +
       

     

       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       +
       

     

       42
       +
       		// Should use file modification time as fallback

     

       43
       +
       		expect(date).not.toBeNull();

     

       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       +
       		// Should be very recent (within last minute)

     

       46
       +
       		const now = new Date();

     

       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       +
       	});

     

       50
       +
       

     

       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       +
       		expect(date).toBeNull();

     

       54
       +
       	});

     

       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       +
       import {

     

       3
       +
       	findMatchingMeetingTime,

     

       4
       +
       	getDayName,

     

       5
       +
       	getDayOfWeek,

     

       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       +
       } from "./audio-metadata";

     

       8
       +
       

     

       9
       +
       describe("getDayOfWeek", () => {

     

       10
       +
       	test("returns correct day number", () => {

     

       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       +
       

     

       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       +
       

     

       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       +
       	});

     

       23
       +
       });

     

       24
       +
       

     

       25
       +
       describe("getDayName", () => {

     

       26
       +
       	test("returns correct day name", () => {

     

       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       +
       	});

     

       35
       +
       });

     

       36
       +
       

     

       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       +
       	test("matches full day names", () => {

     

       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       +
       			true,

     

       43
       +
       		);

     

       44
       +
       	});

     

       45
       +
       

     

       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       +
       			true,

     

       51
       +
       		);

     

       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       +
       	});

     

       57
       +
       

     

       58
       +
       	test("is case insensitive", () => {

     

       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       +
       	});

     

       63
       +
       

     

       64
       +
       	test("does not match wrong days", () => {

     

       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       +
       	});

     

       69
       +
       

     

       70
       +
       	test("handles labels without day names", () => {

     

       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       +
       	});

     

       75
       +
       });

     

       76
       +
       

     

       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       +
       	const meetingTimes = [

     

       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       +
       	];

     

       83
       +
       

     

       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       +
       

     

       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       +
       

     

       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       +
       	});

     

       94
       +
       

     

       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       +
       		const abbrevMeetingTimes = [

     

       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       +
       		];

     

       101
       +
       

     

       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       +
       	});

     

       105
       +
       

     

       106
       +
       	test("returns null when no match found", () => {

     

       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       +
       

     

       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       +
       	});

     

       113
       +
       

     

       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       +
       	});

     

       118
       +
       

     

       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       +
       		const duplicateMeetingTimes = [

     

       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       +
       		];

     

       124
       +
       

     

       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       +
       	});

     

       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       +
       import { $ } from "bun";

     

       2
       +
       

     

       3
       +
       /**

     

       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       +
        * @param filePath Path to audio file

     

       7
       +
        * @returns Date object or null if not found

     

       8
       +
        */

     

       9
       +
       export async function extractAudioCreationDate(

     

       10
       +
       	filePath: string,

     

       11
       +
       ): Promise<Date | null> {

     

       12
       +
       	try {

     

       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       +
       		// -v quiet: suppress verbose output

     

       15
       +
       		// -print_format json: output as JSON

     

       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       +
       		const result =

     

       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       +
       

     

       20
       +
       		const metadata = JSON.parse(result);

     

       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       +
       

     

       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       +
       		const dateFields = [

     

       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       +
       			tags.date, // Common date field

     

       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       +
       			tags.year, // Year field

     

       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       +
       		];

     

       34
       +
       

     

       35
       +
       		for (const dateField of dateFields) {

     

       36
       +
       			if (dateField) {

     

       37
       +
       				const date = new Date(dateField);

     

       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       +
       					console.log(

     

       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       +
       					);

     

       42
       +
       					return date;

     

       43
       +
       				}

     

       44
       +
       			}

     

       45
       +
       		}

     

       46
       +
       

     

       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       +
       		console.log(

     

       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       +
       		);

     

       52
       +
       		const file = Bun.file(filePath);

     

       53
       +
       		const stat = await file.stat();

     

       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       +
       		console.log(

     

       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       +
       		);

     

       58
       +
       		return date;

     

       59
       +
       	} catch (error) {

     

       60
       +
       		console.error(

     

       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       +
       		);

     

       64
       +
       		return null;

     

       65
       +
       	}

     

       66
       +
       }

     

       67
       +
       

     

       68
       +
       /**

     

       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       +
        */

     

       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       +
       	return date.getDay();

     

       73
       +
       }

     

       74
       +
       

     

       75
       +
       /**

     

       76
       +
        * Gets day name from a date

     

       77
       +
        */

     

       78
       +
       export function getDayName(date: Date): string {

     

       79
       +
       	const days = [

     

       80
       +
       		"Sunday",

     

       81
       +
       		"Monday",

     

       82
       +
       		"Tuesday",

     

       83
       +
       		"Wednesday",

     

       84
       +
       		"Thursday",

     

       85
       +
       		"Friday",

     

       86
       +
       		"Saturday",

     

       87
       +
       	];

     

       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       +
       }

     

       90
       +
       

     

       91
       +
       /**

     

       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       +
        */

     

       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       +
       	label: string,

     

       97
       +
       	dayName: string,

     

       98
       +
       ): boolean {

     

       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       +
       

     

       102
       +
       	// Check for full day name

     

       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       +
       		return true;

     

       105
       +
       	}

     

       106
       +
       

     

       107
       +
       	// Check for 3-letter abbreviations

     

       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       +
       		return true;

     

       111
       +
       	}

     

       112
       +
       

     

       113
       +
       	return false;

     

       114
       +
       }

     

       115
       +
       

     

       116
       +
       /**

     

       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       +
        * @param date Date from audio metadata

     

       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       +
        */

     

       122
       +
       export function findMatchingMeetingTime(

     

       123
       +
       	date: Date,

     

       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       +
       ): string | null {

     

       126
       +
       	const dayName = getDayName(date);

     

       127
       +
       

     

       128
       +
       	// Find meeting time that matches the day

     

       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       +
       	);

     

       132
       +
       

     

       133
       +
       	if (match) {

     

       134
       +
       		console.log(

     

       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       +
       		);

     

       137
       +
       		return match.id;

     

       138
       +
       	}

     

       139
       +
       

     

       140
       +
       	console.log(

     

       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       +
       	);

     

       143
       +
       	return null;

     

       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
        
       	};

     

       131
        
       	expect(typeof result.count).toBe("number");

     

       132
        
       });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       130
        
       	};

     

       131
        
       	expect(typeof result.count).toBe("number");

     

       132
        
       });

     

       133
       +
       

     

       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       +
       	const userId = 999;

     

       136
       +
       

     

       137
       +
       	// Clean up any existing sessions for this user

     

       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       +
       

     

       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       +
       	const sessionIds: string[] = [];

     

       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       +
       		sessionIds.push(sessionId);

     

       145
       +
       	}

     

       146
       +
       

     

       147
       +
       	// Count total sessions for user

     

       148
       +
       	const sessionCount = db

     

       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       +
       		)

     

       152
       +
       		.get(userId);

     

       153
       +
       

     

       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       +
       

     

       156
       +
       	// First session should be deleted (oldest)

     

       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       +
       	expect(firstSession).toBeNull();

     

       159
       +
       

     

       160
       +
       	// Last session should exist (newest)

     

       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       +
       

     

       164
       +
       	// Cleanup

     

       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       +
       });

+26 -1

src/lib/auth.ts

···

       1
        
       import db from "../db/schema";

     

       2
        
       

     

       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       0
        
       
     

       4
        
       

     

       5
        
       export type UserRole = "user" | "admin";

     

       6
        
       

     
···

       30
        
       ): string {

     

       31
        
       	const sessionId = crypto.randomUUID();

     

       32
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       33
        
       

     

       34
        
       	db.run(

     

       35
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       759
        
       		const { encodeCursor } = require("./cursor");

     

       760
        
       		const last = users[users.length - 1];

     

       761
        
       		if (last) {

     

       762
       -
       			nextCursor = encodeCursor([last.created_at.toString(), last.id.toString()]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       763
        
       		}

     

       764
        
       	}

     

       765

···

       1
        
       import db from "../db/schema";

     

       2
        
       

     

       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       5
        
       

     

       6
        
       export type UserRole = "user" | "admin";

     

       7
        
       

     
···

       31
        
       ): string {

     

       32
        
       	const sessionId = crypto.randomUUID();

     

       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       +
       

     

       35
       +
       	// Check current session count for user

     

       36
       +
       	const sessionCount = db

     

       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       +
       		)

     

       40
       +
       		.get(userId);

     

       41
       +
       

     

       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       +
       		db.run(

     

       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       +
       				SELECT id FROM sessions 

     

       48
       +
       				WHERE user_id = ? 

     

       49
       +
       				ORDER BY created_at ASC 

     

       50
       +
       				LIMIT ?

     

       51
       +
       			)`,

     

       52
       +
       			[userId, sessionsToDelete],

     

       53
       +
       		);

     

       54
       +
       	}

     

       55
        
       

     

       56
        
       	db.run(

     

       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       781
        
       		const { encodeCursor } = require("./cursor");

     

       782
        
       		const last = users[users.length - 1];

     

       783
        
       		if (last) {

     

       784
       +
       			nextCursor = encodeCursor([

     

       785
       +
       				last.created_at.toString(),

     

       786
       +
       				last.id.toString(),

     

       787
       +
       			]);

     

       788
        
       		}

     

       789
        
       	}

     

       790

+111 -8

src/lib/classes.ts

···

       9
        
       	semester: string;

     

       10
        
       	year: number;

     

       11
        
       	archived: boolean;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
       	created_at: number;

     

       13
        
       }

     

       14
        
       

     
···

       22
        
       export interface ClassMember {

     

       23
        
       	class_id: string;

     

       24
        
       	user_id: number;

     

       0
        
       
     

       25
        
       	enrolled_at: number;

     

       26
        
       }

     

       27
        
       

     
···

       99
        
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       100
        
       

     

       101
        
       			classes = db

     

       102
       -
       				.query<ClassWithStats, [number, number, string, string, string, number]>(

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       103
        
       					`SELECT c.* FROM classes c

     

       104
        
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       105
        
       					WHERE cm.user_id = ? AND 

     
···

       201
        
       	semester: string;

     

       202
        
       	year: number;

     

       203
        
       	meeting_times?: string[];

     

       0
        
       
     

       204
        
       }): Class {

     

       205
        
       	const id = nanoid();

     

       206
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       225
        
       		}

     

       226
        
       	}

     

       227
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       228
        
       	return {

     

       229
        
       		id,

     

       230
        
       		course_code: data.course_code,

     
···

       261
        
       /**

     

       262
        
        * Enroll a user in a class

     

       263
        
        */

     

       264
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       265
        
       	const now = Math.floor(Date.now() / 1000);

     

       266
        
       	db.run(

     

       267
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       268
       -
       		[classId, userId, now],

     

       269
        
       	);

     

       270
        
       }

     

       271
        
       

     
···

       335
        
       }

     

       336
        
       

     

       337
        
       /**

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       338
        
        * Update a meeting time label

     

       339
        
        */

     

       340
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       358
        
       				id: string;

     

       359
        
       				user_id: number;

     

       360
        
       				meeting_time_id: string | null;

     

       0
        
       
     

       361
        
       				filename: string;

     

       362
        
       				original_filename: string;

     

       363
        
       				status: string;

     
···

       368
        
       			},

     

       369
        
       			[string]

     

       370
        
       		>(

     

       371
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       372
        
              FROM transcriptions

     

       373
        
              WHERE class_id = ?

     

       374
       -
              ORDER BY created_at DESC`,

     

       375
        
       		)

     

       376
        
       		.all(classId);

     

       377
        
       }

     
···

       396
        
       export function joinClass(

     

       397
        
       	classId: string,

     

       398
        
       	userId: number,

     

       0
        
       
     

       399
        
       ): { success: boolean; error?: string } {

     

       400
        
       	// Find class by ID

     

       401
        
       	const cls = db

     
···

       421
        
       		return { success: false, error: "Already enrolled in this class" };

     

       422
        
       	}

     

       423
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       424
        
       	// Enroll user

     

       425
        
       	db.query(

     

       426
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       427
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       428
        
       

     

       429
        
       	return { success: true };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       430
        
       }

     

       431
        
       

     

       432
        
       /**

···

       9
        
       	semester: string;

     

       10
        
       	year: number;

     

       11
        
       	archived: boolean;

     

       12
       +
       	section_number?: string | null;

     

       13
       +
       	created_at: number;

     

       14
       +
       }

     

       15
       +
       

     

       16
       +
       export interface ClassSection {

     

       17
       +
       	id: string;

     

       18
       +
       	class_id: string;

     

       19
       +
       	section_number: string;

     

       20
        
       	created_at: number;

     

       21
        
       }

     

       22
        
       

     
···

       30
        
       export interface ClassMember {

     

       31
        
       	class_id: string;

     

       32
        
       	user_id: number;

     

       33
       +
       	section_id: string | null;

     

       34
        
       	enrolled_at: number;

     

       35
        
       }

     

       36
        
       

     
···

       108
        
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       109
        
       

     

       110
        
       			classes = db

     

       111
       +
       				.query<

     

       112
       +
       					ClassWithStats,

     

       113
       +
       					[number, number, string, string, string, number]

     

       114
       +
       				>(

     

       115
        
       					`SELECT c.* FROM classes c

     

       116
        
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       117
        
       					WHERE cm.user_id = ? AND 

     
···

       213
        
       	semester: string;

     

       214
        
       	year: number;

     

       215
        
       	meeting_times?: string[];

     

       216
       +
       	sections?: string[];

     

       217
        
       }): Class {

     

       218
        
       	const id = nanoid();

     

       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       238
        
       		}

     

       239
        
       	}

     

       240
        
       

     

       241
       +
       	// Create sections if provided

     

       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       +
       			createClassSection(id, sectionNumber);

     

       245
       +
       		}

     

       246
       +
       	}

     

       247
       +
       

     

       248
        
       	return {

     

       249
        
       		id,

     

       250
        
       		course_code: data.course_code,

     
···

       281
        
       /**

     

       282
        
        * Enroll a user in a class

     

       283
        
        */

     

       284
       +
       export function enrollUserInClass(

     

       285
       +
       	userId: number,

     

       286
       +
       	classId: string,

     

       287
       +
       	sectionId?: string | null,

     

       288
       +
       ): void {

     

       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       290
        
       	db.run(

     

       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       293
        
       	);

     

       294
        
       }

     

       295
        
       

     
···

       359
        
       }

     

       360
        
       

     

       361
        
       /**

     

       362
       +
        * Get a single meeting time by ID

     

       363
       +
        */

     

       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       +
       	const result = db

     

       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       +
       		.get(meetingId);

     

       368
       +
       	return result ?? null;

     

       369
       +
       }

     

       370
       +
       

     

       371
       +
       /**

     

       372
        
        * Update a meeting time label

     

       373
        
        */

     

       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       392
        
       				id: string;

     

       393
        
       				user_id: number;

     

       394
        
       				meeting_time_id: string | null;

     

       395
       +
       				section_id: string | null;

     

       396
        
       				filename: string;

     

       397
        
       				original_filename: string;

     

       398
        
       				status: string;

     
···

       403
        
       			},

     

       404
        
       			[string]

     

       405
        
       		>(

     

       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       407
        
              FROM transcriptions

     

       408
        
              WHERE class_id = ?

     

       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       410
        
       		)

     

       411
        
       		.all(classId);

     

       412
        
       }

     
···

       431
        
       export function joinClass(

     

       432
        
       	classId: string,

     

       433
        
       	userId: number,

     

       434
       +
       	sectionId?: string | null,

     

       435
        
       ): { success: boolean; error?: string } {

     

       436
        
       	// Find class by ID

     

       437
        
       	const cls = db

     
···

       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       458
        
       	}

     

       459
        
       

     

       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       +
       	const sections = getClassSections(classId);

     

       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       +
       	}

     

       465
       +
       

     

       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       +
       	if (sectionId) {

     

       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       +
       		if (!section) {

     

       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       +
       		}

     

       472
       +
       	}

     

       473
       +
       

     

       474
        
       	// Enroll user

     

       475
        
       	db.query(

     

       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       478
        
       

     

       479
        
       	return { success: true };

     

       480
       +
       }

     

       481
       +
       

     

       482
       +
       /**

     

       483
       +
        * Create a section for a class

     

       484
       +
        */

     

       485
       +
       export function createClassSection(

     

       486
       +
       	classId: string,

     

       487
       +
       	sectionNumber: string,

     

       488
       +
       ): ClassSection {

     

       489
       +
       	const id = nanoid();

     

       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       +
       

     

       492
       +
       	db.run(

     

       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       +
       	);

     

       496
       +
       

     

       497
       +
       	return {

     

       498
       +
       		id,

     

       499
       +
       		class_id: classId,

     

       500
       +
       		section_number: sectionNumber,

     

       501
       +
       		created_at: now,

     

       502
       +
       	};

     

       503
       +
       }

     

       504
       +
       

     

       505
       +
       /**

     

       506
       +
        * Get all sections for a class

     

       507
       +
        */

     

       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       +
       	return db

     

       510
       +
       		.query<ClassSection, [string]>(

     

       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       +
       		)

     

       513
       +
       		.all(classId);

     

       514
       +
       }

     

       515
       +
       

     

       516
       +
       /**

     

       517
       +
        * Delete a class section

     

       518
       +
        */

     

       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       +
       }

     

       522
       +
       

     

       523
       +
       /**

     

       524
       +
        * Get user's enrolled section for a class

     

       525
       +
        */

     

       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       +
       	const result = db

     

       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       +
       		)

     

       531
       +
       		.get(classId, userId);

     

       532
       +
       	return result?.section_id ?? null;

     

       533
        
       }

     

       534
        
       

     

       535
        
       /**

+3 -3

src/lib/cursor.test.ts

···

       1
        
       import { describe, expect, test } from "bun:test";

     

       2
        
       import {

     

       3
       -
       	encodeCursor,

     

       4
        
       	decodeCursor,

     

       5
       -
       	encodeSimpleCursor,

     

       6
        
       	decodeSimpleCursor,

     

       7
        
       	encodeClassCursor,

     

       8
       -
       	decodeClassCursor,

     

       0
        
       
     

       9
        
       } from "./cursor";

     

       10
        
       

     

       11
        
       describe("Cursor encoding/decoding", () => {

···

       1
        
       import { describe, expect, test } from "bun:test";

     

       2
        
       import {

     

       3
       +
       	decodeClassCursor,

     

       4
        
       	decodeCursor,

     

       0
        
       
     

       5
        
       	decodeSimpleCursor,

     

       6
        
       	encodeClassCursor,

     

       7
       +
       	encodeCursor,

     

       8
       +
       	encodeSimpleCursor,

     

       9
        
       } from "./cursor";

     

       10
        
       

     

       11
        
       describe("Cursor encoding/decoding", () => {

+12 -9

src/lib/email-verification.test.ts

···

       27
        
       	});

     

       28
        
       

     

       29
        
       	test("creates verification token", () => {

     

       30
       -
       		const token = createEmailVerificationToken(userId);

     

       31
       -
       		expect(token).toBeDefined();

     

       32
       -
       		expect(typeof token).toBe("string");

     

       33
       -
       		expect(token.length).toBeGreaterThan(0);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       34
        
       	});

     

       35
        
       

     

       36
        
       	test("verifies valid token", () => {

     

       37
       -
       		const token = createEmailVerificationToken(userId);

     

       38
        
       		const result = verifyEmailToken(token);

     

       39
        
       

     

       40
        
       		expect(result).not.toBeNull();

     
···

       50
        
       	});

     

       51
        
       

     

       52
        
       	test("token is one-time use", () => {

     

       53
       -
       		const token = createEmailVerificationToken(userId);

     

       54
        
       

     

       55
        
       		// First use succeeds

     

       56
        
       		const firstResult = verifyEmailToken(token);

     
···

       62
        
       	});

     

       63
        
       

     

       64
        
       	test("rejects expired token", () => {

     

       65
       -
       		const token = createEmailVerificationToken(userId);

     

       66
        
       

     

       67
        
       		// Manually expire the token

     

       68
        
       		db.run(

     
···

       75
        
       	});

     

       76
        
       

     

       77
        
       	test("replaces existing token when creating new one", () => {

     

       78
       -
       		const token1 = createEmailVerificationToken(userId);

     

       79
       -
       		const token2 = createEmailVerificationToken(userId);

     

       80
        
       

     

       81
        
       		// First token should be invalidated

     

       82
        
       		expect(verifyEmailToken(token1)).toBeNull();

···

       27
        
       	});

     

       28
        
       

     

       29
        
       	test("creates verification token", () => {

     

       30
       +
       		const result = createEmailVerificationToken(userId);

     

       31
       +
       		expect(result).toBeDefined();

     

       32
       +
       		expect(typeof result).toBe("object");

     

       33
       +
       		expect(typeof result.code).toBe("string");

     

       34
       +
       		expect(typeof result.token).toBe("string");

     

       35
       +
       		expect(typeof result.sentAt).toBe("number");

     

       36
       +
       		expect(result.code.length).toBe(6);

     

       37
        
       	});

     

       38
        
       

     

       39
        
       	test("verifies valid token", () => {

     

       40
       +
       		const { token } = createEmailVerificationToken(userId);

     

       41
        
       		const result = verifyEmailToken(token);

     

       42
        
       

     

       43
        
       		expect(result).not.toBeNull();

     
···

       53
        
       	});

     

       54
        
       

     

       55
        
       	test("token is one-time use", () => {

     

       56
       +
       		const { token } = createEmailVerificationToken(userId);

     

       57
        
       

     

       58
        
       		// First use succeeds

     

       59
        
       		const firstResult = verifyEmailToken(token);

     
···

       65
        
       	});

     

       66
        
       

     

       67
        
       	test("rejects expired token", () => {

     

       68
       +
       		const { token } = createEmailVerificationToken(userId);

     

       69
        
       

     

       70
        
       		// Manually expire the token

     

       71
        
       		db.run(

     
···

       78
        
       	});

     

       79
        
       

     

       80
        
       	test("replaces existing token when creating new one", () => {

     

       81
       +
       		const { token: token1 } = createEmailVerificationToken(userId);

     

       82
       +
       		const { token: token2 } = createEmailVerificationToken(userId);

     

       83
        
       

     

       84
        
       		// First token should be invalidated

     

       85
        
       		expect(verifyEmailToken(token1)).toBeNull();

src/lib/email.ts

···

       25
        
        * Send an email via MailChannels

     

       26
        
        */

     

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       29
        
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       30
        
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

···

       25
        
        * Send an email via MailChannels

     

       26
        
        */

     

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       +
       	// Skip sending emails in test mode

     

       29
       +
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       +
       		console.log(

     

       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       +
       		);

     

       33
       +
       		return;

     

       34
       +
       	}

     

       35
       +
       

     

       36
        
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       37
        
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       38
        
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

+2 -2

src/lib/subscription-routes.test.ts

···

       29
        
       			headers: { Cookie: sessionCookie },

     

       30
        
       		});

     

       31
        
       

     

       32
       -
       		expect(response.status).toBe(500);

     

       33
        
       		const data = await response.json();

     

       34
        
       		expect(data.error).toContain("subscription");

     

       35
        
       	});

     
···

       74
        
       			body: formData,

     

       75
        
       		});

     

       76
        
       

     

       77
       -
       		expect(response.status).toBe(500);

     

       78
        
       		const data = await response.json();

     

       79
        
       		expect(data.error).toContain("subscription");

     

       80
        
       	});

···

       29
        
       			headers: { Cookie: sessionCookie },

     

       30
        
       		});

     

       31
        
       

     

       32
       +
       		expect(response.status).toBe(403);

     

       33
        
       		const data = await response.json();

     

       34
        
       		expect(data.error).toContain("subscription");

     

       35
        
       	});

     
···

       74
        
       			body: formData,

     

       75
        
       		});

     

       76
        
       

     

       77
       +
       		expect(response.status).toBe(403);

     

       78
        
       		const data = await response.json();

     

       79
        
       		expect(data.error).toContain("subscription");

     

       80
        
       	});

+227

src/lib/voting.ts

···

       1
       +
       import { nanoid } from "nanoid";

     

       2
       +
       import db from "../db/schema";

     

       3
       +
       

     

       4
       +
       /**

     

       5
       +
        * Vote for a recording

     

       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       +
        */

     

       8
       +
       export function voteForRecording(

     

       9
       +
       	transcriptionId: string,

     

       10
       +
       	userId: number,

     

       11
       +
       ): boolean {

     

       12
       +
       	try {

     

       13
       +
       		const voteId = nanoid();

     

       14
       +
       		db.run(

     

       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       +
       		);

     

       18
       +
       

     

       19
       +
       		// Increment vote count on transcription

     

       20
       +
       		db.run(

     

       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       +
       			[transcriptionId],

     

       23
       +
       		);

     

       24
       +
       

     

       25
       +
       		return true;

     

       26
       +
       	} catch (error) {

     

       27
       +
       		// Unique constraint violation means user already voted

     

       28
       +
       		if (

     

       29
       +
       			error instanceof Error &&

     

       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       +
       		) {

     

       32
       +
       			return false;

     

       33
       +
       		}

     

       34
       +
       		throw error;

     

       35
       +
       	}

     

       36
       +
       }

     

       37
       +
       

     

       38
       +
       /**

     

       39
       +
        * Remove vote for a recording

     

       40
       +
        */

     

       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       +
       	const result = db.run(

     

       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       +
       		[transcriptionId, userId],

     

       45
       +
       	);

     

       46
       +
       

     

       47
       +
       	if (result.changes > 0) {

     

       48
       +
       		// Decrement vote count on transcription

     

       49
       +
       		db.run(

     

       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       +
       			[transcriptionId],

     

       52
       +
       		);

     

       53
       +
       		return true;

     

       54
       +
       	}

     

       55
       +
       

     

       56
       +
       	return false;

     

       57
       +
       }

     

       58
       +
       

     

       59
       +
       /**

     

       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       +
        */

     

       62
       +
       export function getUserVoteForMeeting(

     

       63
       +
       	userId: number,

     

       64
       +
       	classId: string,

     

       65
       +
       	meetingTimeId: string,

     

       66
       +
       ): string | null {

     

       67
       +
       	const result = db

     

       68
       +
       		.query<

     

       69
       +
       			{ transcription_id: string },

     

       70
       +
       			[number, string, string]

     

       71
       +
       		>(

     

       72
       +
       			`SELECT rv.transcription_id 

     

       73
       +
              FROM recording_votes rv

     

       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       +
              WHERE rv.user_id = ? 

     

       76
       +
                AND t.class_id = ? 

     

       77
       +
                AND t.meeting_time_id = ?

     

       78
       +
                AND t.status = 'pending'`,

     

       79
       +
       		)

     

       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       +
       

     

       82
       +
       	return result?.transcription_id || null;

     

       83
       +
       }

     

       84
       +
       

     

       85
       +
       /**

     

       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       +
        */

     

       88
       +
       export function getPendingRecordings(

     

       89
       +
       	classId: string,

     

       90
       +
       	meetingTimeId: string,

     

       91
       +
       	sectionId?: string | null,

     

       92
       +
       ) {

     

       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       +
              FROM transcriptions

     

       96
       +
              WHERE class_id = ? 

     

       97
       +
                AND meeting_time_id = ?

     

       98
       +
                AND status = 'pending'`;

     

       99
       +
       

     

       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       +
       

     

       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       +
       	if (sectionId !== undefined) {

     

       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       +
       		params.push(sectionId);

     

       106
       +
       	}

     

       107
       +
       

     

       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       +
       

     

       110
       +
       	return db

     

       111
       +
       		.query<

     

       112
       +
       			{

     

       113
       +
       				id: string;

     

       114
       +
       				user_id: number;

     

       115
       +
       				filename: string;

     

       116
       +
       				original_filename: string;

     

       117
       +
       				vote_count: number;

     

       118
       +
       				created_at: number;

     

       119
       +
       				section_id: string | null;

     

       120
       +
       			},

     

       121
       +
       			(string | null)[]

     

       122
       +
       		>(query)

     

       123
       +
       		.all(...params);

     

       124
       +
       }

     

       125
       +
       

     

       126
       +
       /**

     

       127
       +
        * Get total enrolled users count for a class

     

       128
       +
        */

     

       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       +
       	const result = db

     

       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       +
       		)

     

       134
       +
       		.get(classId);

     

       135
       +
       

     

       136
       +
       	return result?.count || 0;

     

       137
       +
       }

     

       138
       +
       

     

       139
       +
       /**

     

       140
       +
        * Check if recording should be auto-submitted

     

       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       +
        */

     

       143
       +
       export function checkAutoSubmit(

     

       144
       +
       	classId: string,

     

       145
       +
       	meetingTimeId: string,

     

       146
       +
       	sectionId?: string | null,

     

       147
       +
       ): string | null {

     

       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       +
       

     

       150
       +
       	if (recordings.length === 0) {

     

       151
       +
       		return null;

     

       152
       +
       	}

     

       153
       +
       

     

       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       +
       

     

       157
       +
       	// Get the recording with most votes

     

       158
       +
       	const topRecording = recordings[0];

     

       159
       +
       	if (!topRecording) return null;

     

       160
       +
       

     

       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       +
       

     

       164
       +
       	// Auto-submit if:

     

       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       +
       

     

       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       +
       		console.log(

     

       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       +
       		);

     

       174
       +
       		return topRecording.id;

     

       175
       +
       	}

     

       176
       +
       

     

       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       +
       		console.log(

     

       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       +
       		);

     

       181
       +
       		return topRecording.id;

     

       182
       +
       	}

     

       183
       +
       

     

       184
       +
       	return null;

     

       185
       +
       }

     

       186
       +
       

     

       187
       +
       /**

     

       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       +
        */

     

       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       +
       	db.run(

     

       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       +
       		[transcriptionId],

     

       194
       +
       	);

     

       195
       +
       }

     

       196
       +
       

     

       197
       +
       /**

     

       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       +
        */

     

       200
       +
       export function deletePendingRecording(

     

       201
       +
       	transcriptionId: string,

     

       202
       +
       	userId: number,

     

       203
       +
       	isAdmin: boolean,

     

       204
       +
       ): boolean {

     

       205
       +
       	// Check ownership if not admin

     

       206
       +
       	if (!isAdmin) {

     

       207
       +
       		const recording = db

     

       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       +
       			)

     

       211
       +
       			.get(transcriptionId);

     

       212
       +
       

     

       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       +
       			return false;

     

       215
       +
       		}

     

       216
       +
       

     

       217
       +
       		// Only allow deleting pending recordings

     

       218
       +
       		if (recording.status !== "pending") {

     

       219
       +
       			return false;

     

       220
       +
       		}

     

       221
       +
       	}

     

       222
       +
       

     

       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       +
       

     

       226
       +
       	return true;

     

       227
       +
       }

+10

src/lib/vtt-cleaner.test.ts

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       58
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       59
        
       

     

       60
        
       	expect(result).toBe(emptyVTT);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       61
        
       });

     

       62
        
       

     

       63
        
       // AI integration test - skip by default to avoid burning credits

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       +
       

     

       59
       +
       	// Save and remove API key to avoid burning tokens

     

       60
       +
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       +
       	delete process.env.LLM_API_KEY;

     

       62
       +
       

     

       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       64
        
       

     

       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       +
       

     

       67
       +
       	// Restore original key

     

       68
       +
       	if (originalKey) {

     

       69
       +
       		process.env.LLM_API_KEY = originalKey;

     

       70
       +
       	}

     

       71
        
       });

     

       72
        
       

     

       73
        
       // AI integration test - skip by default to avoid burning credits

src/lib/vtt-cleaner.ts

···

       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
        
       	);

     

       340
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       341
        
       	// Validated at startup

     

       342
        
       	const apiKey = process.env.LLM_API_KEY as string;

     

       343
        
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

···

       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
        
       	);

     

       340
        
       

     

       341
       +
       	// Check if API key is available, return original if not

     

       342
       +
       	if (!process.env.LLM_API_KEY) {

     

       343
       +
       		console.warn("[VTTCleaner] LLM_API_KEY not set, returning original VTT");

     

       344
       +
       		return vttContent;

     

       345
       +
       	}

     

       346
       +
       

     

       347
        
       	// Validated at startup

     

       348
        
       	const apiKey = process.env.LLM_API_KEY as string;

     

       349
        
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

-1

src/pages/admin.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Admin - Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Admin - Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

+104 -89

src/pages/admin.ts

···

       1
       -
       const transcriptionsComponent = document.getElementById('transcriptions-component') as any;

     

       2
       -
       const usersComponent = document.getElementById('users-component') as any;

     

       3
       -
       const userModal = document.getElementById('user-modal') as any;

     

       4
       -
       const transcriptModal = document.getElementById('transcript-modal') as any;

     

       5
       -
       const errorMessage = document.getElementById('error-message') as HTMLElement;

     

       6
       -
       const loading = document.getElementById('loading') as HTMLElement;

     

       7
       -
       const content = document.getElementById('content') as HTMLElement;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       8
        
       

     

       9
        
       // Modal functions

     

       10
        
       function openUserModal(userId: string) {

     

       11
       -
         userModal.setAttribute('open', '');

     

       12
       -
         userModal.userId = userId;

     

       13
        
       }

     

       14
        
       

     

       15
        
       function closeUserModal() {

     

       16
       -
         userModal.removeAttribute('open');

     

       17
       -
         userModal.userId = null;

     

       18
        
       }

     

       19
        
       

     

       20
        
       function openTranscriptModal(transcriptId: string) {

     

       21
       -
         transcriptModal.setAttribute('open', '');

     

       22
       -
         transcriptModal.transcriptId = transcriptId;

     

       23
        
       }

     

       24
        
       

     

       25
        
       function closeTranscriptModal() {

     

       26
       -
         transcriptModal.removeAttribute('open');

     

       27
       -
         transcriptModal.transcriptId = null;

     

       28
        
       }

     

       29
        
       

     

       30
        
       // Listen for component events

     

       31
       -
       transcriptionsComponent?.addEventListener('open-transcription', (e: CustomEvent) => {

     

       32
       -
         openTranscriptModal(e.detail.id);

     

       33
       -
       });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       34
        
       

     

       35
       -
       usersComponent?.addEventListener('open-user', (e: CustomEvent) => {

     

       36
       -
         openUserModal(e.detail.id);

     

       37
        
       });

     

       38
        
       

     

       39
        
       // Listen for modal close events

     

       40
       -
       userModal?.addEventListener('close', closeUserModal);

     

       41
       -
       userModal?.addEventListener('user-updated', async () => {

     

       42
       -
         await loadStats();

     

       43
        
       });

     

       44
       -
       userModal?.addEventListener('click', (e: MouseEvent) => {

     

       45
       -
         if (e.target === userModal) closeUserModal();

     

       46
        
       });

     

       47
        
       

     

       48
       -
       transcriptModal?.addEventListener('close', closeTranscriptModal);

     

       49
       -
       transcriptModal?.addEventListener('transcript-deleted', async () => {

     

       50
       -
         await loadStats();

     

       51
        
       });

     

       52
       -
       transcriptModal?.addEventListener('click', (e: MouseEvent) => {

     

       53
       -
         if (e.target === transcriptModal) closeTranscriptModal();

     

       54
        
       });

     

       55
        
       

     

       56
        
       async function loadStats() {

     

       57
       -
         try {

     

       58
       -
           const [transcriptionsRes, usersRes] = await Promise.all([

     

       59
       -
             fetch('/api/admin/transcriptions'),

     

       60
       -
             fetch('/api/admin/users')

     

       61
       -
           ]);

     

       62
        
       

     

       63
       -
           if (!transcriptionsRes.ok || !usersRes.ok) {

     

       64
       -
             if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       65
       -
               window.location.href = '/';

     

       66
       -
               return;

     

       67
       -
             }

     

       68
       -
             throw new Error('Failed to load admin data');

     

       69
       -
           }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       70
        
       

     

       71
       -
           const transcriptions = await transcriptionsRes.json();

     

       72
       -
           const users = await usersRes.json();

     

       0
        
       
     

       73
        
       

     

       74
       -
           const totalUsers = document.getElementById('total-users');

     

       75
       -
           const totalTranscriptions = document.getElementById('total-transcriptions');

     

       76
       -
           const failedTranscriptions = document.getElementById('failed-transcriptions');

     

       77
       -
           

     

       78
       -
           if (totalUsers) totalUsers.textContent = users.length.toString();

     

       79
       -
           if (totalTranscriptions) totalTranscriptions.textContent = transcriptions.length.toString();

     

       80
       -
           

     

       81
       -
           const failed = transcriptions.filter((t: any) => t.status === 'failed');

     

       82
       -
           if (failedTranscriptions) failedTranscriptions.textContent = failed.length.toString();

     

       83
        
       

     

       84
       -
           loading.classList.add('hidden');

     

       85
       -
           content.classList.remove('hidden');

     

       86
       -
         } catch (error) {

     

       87
       -
           errorMessage.textContent = (error as Error).message;

     

       88
       -
           errorMessage.classList.remove('hidden');

     

       89
       -
           loading.classList.add('hidden');

     

       90
       -
         }

     

       91
        
       }

     

       92
        
       

     

       93
        
       // Tab switching

     

       94
        
       function switchTab(tabName: string) {

     

       95
       -
         document.querySelectorAll('.tab').forEach(t => {

     

       96
       -
           t.classList.remove('active');

     

       97
       -
         });

     

       98
       -
         document.querySelectorAll('.tab-content').forEach(c => {

     

       99
       -
           c.classList.remove('active');

     

       100
       -
         });

     

       101
        
       

     

       102
       -
         const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       103
       -
         const tabContent = document.getElementById(`${tabName}-tab`);

     

       104
       -
         

     

       105
       -
         if (tabButton && tabContent) {

     

       106
       -
           tabButton.classList.add('active');

     

       107
       -
           tabContent.classList.add('active');

     

       108
       -
           

     

       109
       -
           // Update URL without reloading

     

       110
       -
           const url = new URL(window.location.href);

     

       111
       -
           url.searchParams.set('tab', tabName);

     

       112
       -
           // Remove subtab param when leaving classes tab

     

       113
       -
           if (tabName !== 'classes') {

     

       114
       -
             url.searchParams.delete('subtab');

     

       115
       -
           }

     

       116
       -
           window.history.pushState({}, '', url);

     

       117
       -
         }

     

       118
        
       }

     

       119
        
       

     

       120
       -
       document.querySelectorAll('.tab').forEach(tab => {

     

       121
       -
         tab.addEventListener('click', () => {

     

       122
       -
           switchTab((tab as HTMLElement).dataset.tab || '');

     

       123
       -
         });

     

       124
        
       });

     

       125
        
       

     

       126
        
       // Check for tab query parameter on load

     

       127
        
       const params = new URLSearchParams(window.location.search);

     

       128
       -
       const initialTab = params.get('tab');

     

       129
       -
       const validTabs = ['pending', 'transcriptions', 'users', 'classes'];

     

       130
        
       

     

       131
        
       if (initialTab && validTabs.includes(initialTab)) {

     

       132
       -
         switchTab(initialTab);

     

       133
        
       }

     

       134
        
       

     

       135
        
       // Initialize

···

       1
       +
       const transcriptionsComponent = document.getElementById(

     

       2
       +
       	"transcriptions-component",

     

       3
       +
       ) as HTMLElement | null;

     

       4
       +
       const usersComponent = document.getElementById(

     

       5
       +
       	"users-component",

     

       6
       +
       ) as HTMLElement | null;

     

       7
       +
       const userModal = document.getElementById("user-modal") as HTMLElement | null;

     

       8
       +
       const transcriptModal = document.getElementById(

     

       9
       +
       	"transcript-modal",

     

       10
       +
       ) as HTMLElement | null;

     

       11
       +
       const errorMessage = document.getElementById("error-message") as HTMLElement;

     

       12
       +
       const loading = document.getElementById("loading") as HTMLElement;

     

       13
       +
       const content = document.getElementById("content") as HTMLElement;

     

       14
        
       

     

       15
        
       // Modal functions

     

       16
        
       function openUserModal(userId: string) {

     

       17
       +
       	userModal.setAttribute("open", "");

     

       18
       +
       	userModal.userId = userId;

     

       19
        
       }

     

       20
        
       

     

       21
        
       function closeUserModal() {

     

       22
       +
       	userModal.removeAttribute("open");

     

       23
       +
       	userModal.userId = null;

     

       24
        
       }

     

       25
        
       

     

       26
        
       function openTranscriptModal(transcriptId: string) {

     

       27
       +
       	transcriptModal.setAttribute("open", "");

     

       28
       +
       	transcriptModal.transcriptId = transcriptId;

     

       29
        
       }

     

       30
        
       

     

       31
        
       function closeTranscriptModal() {

     

       32
       +
       	transcriptModal.removeAttribute("open");

     

       33
       +
       	transcriptModal.transcriptId = null;

     

       34
        
       }

     

       35
        
       

     

       36
        
       // Listen for component events

     

       37
       +
       transcriptionsComponent?.addEventListener(

     

       38
       +
       	"open-transcription",

     

       39
       +
       	(e: CustomEvent) => {

     

       40
       +
       		openTranscriptModal(e.detail.id);

     

       41
       +
       	},

     

       42
       +
       );

     

       43
        
       

     

       44
       +
       usersComponent?.addEventListener("open-user", (e: CustomEvent) => {

     

       45
       +
       	openUserModal(e.detail.id);

     

       46
        
       });

     

       47
        
       

     

       48
        
       // Listen for modal close events

     

       49
       +
       userModal?.addEventListener("close", closeUserModal);

     

       50
       +
       userModal?.addEventListener("user-updated", async () => {

     

       51
       +
       	await loadStats();

     

       52
        
       });

     

       53
       +
       userModal?.addEventListener("click", (e: MouseEvent) => {

     

       54
       +
       	if (e.target === userModal) closeUserModal();

     

       55
        
       });

     

       56
        
       

     

       57
       +
       transcriptModal?.addEventListener("close", closeTranscriptModal);

     

       58
       +
       transcriptModal?.addEventListener("transcript-deleted", async () => {

     

       59
       +
       	await loadStats();

     

       60
        
       });

     

       61
       +
       transcriptModal?.addEventListener("click", (e: MouseEvent) => {

     

       62
       +
       	if (e.target === transcriptModal) closeTranscriptModal();

     

       63
        
       });

     

       64
        
       

     

       65
        
       async function loadStats() {

     

       66
       +
       	try {

     

       67
       +
       		const [transcriptionsRes, usersRes] = await Promise.all([

     

       68
       +
       			fetch("/api/admin/transcriptions"),

     

       69
       +
       			fetch("/api/admin/users"),

     

       70
       +
       		]);

     

       71
        
       

     

       72
       +
       		if (!transcriptionsRes.ok || !usersRes.ok) {

     

       73
       +
       			if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       74
       +
       				window.location.href = "/";

     

       75
       +
       				return;

     

       76
       +
       			}

     

       77
       +
       			throw new Error("Failed to load admin data");

     

       78
       +
       		}

     

       79
       +
       

     

       80
       +
       		const transcriptions = await transcriptionsRes.json();

     

       81
       +
       		const users = await usersRes.json();

     

       82
       +
       

     

       83
       +
       		const totalUsers = document.getElementById("total-users");

     

       84
       +
       		const totalTranscriptions = document.getElementById("total-transcriptions");

     

       85
       +
       		const failedTranscriptions = document.getElementById(

     

       86
       +
       			"failed-transcriptions",

     

       87
       +
       		);

     

       88
        
       

     

       89
       +
       		if (totalUsers) totalUsers.textContent = users.length.toString();

     

       90
       +
       		if (totalTranscriptions)

     

       91
       +
       			totalTranscriptions.textContent = transcriptions.length.toString();

     

       92
        
       

     

       93
       +
       		const failed = transcriptions.filter(

     

       94
       +
       			(t: { status: string }) => t.status === "failed",

     

       95
       +
       		);

     

       96
       +
       		if (failedTranscriptions)

     

       97
       +
       			failedTranscriptions.textContent = failed.length.toString();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       98
        
       

     

       99
       +
       		loading.classList.add("hidden");

     

       100
       +
       		content.classList.remove("hidden");

     

       101
       +
       	} catch (error) {

     

       102
       +
       		errorMessage.textContent = (error as Error).message;

     

       103
       +
       		errorMessage.classList.remove("hidden");

     

       104
       +
       		loading.classList.add("hidden");

     

       105
       +
       	}

     

       106
        
       }

     

       107
        
       

     

       108
        
       // Tab switching

     

       109
        
       function switchTab(tabName: string) {

     

       110
       +
       	document.querySelectorAll(".tab").forEach((t) => {

     

       111
       +
       		t.classList.remove("active");

     

       112
       +
       	});

     

       113
       +
       	document.querySelectorAll(".tab-content").forEach((c) => {

     

       114
       +
       		c.classList.remove("active");

     

       115
       +
       	});

     

       116
        
       

     

       117
       +
       	const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       118
       +
       	const tabContent = document.getElementById(`${tabName}-tab`);

     

       119
       +
       

     

       120
       +
       	if (tabButton && tabContent) {

     

       121
       +
       		tabButton.classList.add("active");

     

       122
       +
       		tabContent.classList.add("active");

     

       123
       +
       

     

       124
       +
       		// Update URL without reloading

     

       125
       +
       		const url = new URL(window.location.href);

     

       126
       +
       		url.searchParams.set("tab", tabName);

     

       127
       +
       		// Remove subtab param when leaving classes tab

     

       128
       +
       		if (tabName !== "classes") {

     

       129
       +
       			url.searchParams.delete("subtab");

     

       130
       +
       		}

     

       131
       +
       		window.history.pushState({}, "", url);

     

       132
       +
       	}

     

       133
        
       }

     

       134
        
       

     

       135
       +
       document.querySelectorAll(".tab").forEach((tab) => {

     

       136
       +
       	tab.addEventListener("click", () => {

     

       137
       +
       		switchTab((tab as HTMLElement).dataset.tab || "");

     

       138
       +
       	});

     

       139
        
       });

     

       140
        
       

     

       141
        
       // Check for tab query parameter on load

     

       142
        
       const params = new URLSearchParams(window.location.search);

     

       143
       +
       const initialTab = params.get("tab");

     

       144
       +
       const validTabs = ["pending", "transcriptions", "users", "classes"];

     

       145
        
       

     

       146
        
       if (initialTab && validTabs.includes(initialTab)) {

     

       147
       +
       	switchTab(initialTab);

     

       148
        
       }

     

       149
        
       

     

       150
        
       // Initialize

-1

src/pages/checkout.html

···

       4
        
       <head>

     

       5
        
       	<meta charset="UTF-8">

     

       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
       	<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
       	<title>Success! - Thistle</title>

     

       9
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
       	<meta charset="UTF-8">

     

       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
       	<title>Success! - Thistle</title>

     

       8
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/class.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Class - Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Class - Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/classes.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Classes - Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Classes - Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/index.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

+12 -8

src/pages/index.ts

···

       1
       -
       document.getElementById('start-btn')?.addEventListener('click', async () => {

     

       2
       -
         const authComponent = document.querySelector('auth-component') as any;

     

       3
       -
         const isLoggedIn = await authComponent.isAuthenticated();

     

       4
        
       

     

       5
       -
         if (isLoggedIn) {

     

       6
       -
           window.location.href = '/classes';

     

       7
       -
         } else {

     

       8
       -
           authComponent.openAuthModal();

     

       9
       -
         }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
       });

···

       1
       +
       document.getElementById("start-btn")?.addEventListener("click", async () => {

     

       2
       +
       	const authComponent = document.querySelector("auth-component");

     

       3
       +
       	if (!authComponent) return;

     

       4
        
       

     

       5
       +
       	const isLoggedIn = await (

     

       6
       +
       		authComponent as { isAuthenticated: () => Promise<boolean> }

     

       7
       +
       	).isAuthenticated();

     

       8
       +
       

     

       9
       +
       	if (isLoggedIn) {

     

       10
       +
       		window.location.href = "/classes";

     

       11
       +
       	} else {

     

       12
       +
       		(authComponent as { openAuthModal: () => void }).openAuthModal();

     

       13
       +
       	}

     

       14
        
       });

-1

src/pages/reset-password.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Reset Password - Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Reset Password - Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

+4 -4

src/pages/reset-password.ts

···

       1
        
       // Wait for component to be defined before setting token

     

       2
       -
       await customElements.whenDefined('reset-password-form');

     

       3
        
       

     

       4
        
       // Get token from URL and pass to component

     

       5
        
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       -
       const token = urlParams.get('token');

     

       7
       -
       const resetForm = document.getElementById('reset-form') as any;

     

       8
        
       if (resetForm) {

     

       9
       -
         resetForm.token = token;

     

       10
        
       }

···

       1
        
       // Wait for component to be defined before setting token

     

       2
       +
       await customElements.whenDefined("reset-password-form");

     

       3
        
       

     

       4
        
       // Get token from URL and pass to component

     

       5
        
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       +
       const token = urlParams.get("token");

     

       7
       +
       const resetForm = document.getElementById("reset-form");

     

       8
        
       if (resetForm) {

     

       9
       +
       	(resetForm as { token: string | null }).token = token;

     

       10
        
       }

-1

src/pages/settings.html

···

       4
        
       <head>

     

       5
        
       	<meta charset="UTF-8">

     

       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
       	<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
       	<title>Settings - Thistle</title>

     

       9
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
       	<meta charset="UTF-8">

     

       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
       	<title>Settings - Thistle</title>

     

       8
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/transcribe.html

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
        
         <title>Transcribe - Thistle</title>

     

       9
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

···

       4
        
       <head>

     

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       0
        
       
     

       7
        
         <title>Transcribe - Thistle</title>

     

       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

+64 -64

src/styles/admin.css

···

       1
        
       main {

     

       2
       -
         max-width: 80rem;

     

       3
       -
         margin: 0 auto;

     

       4
       -
         padding: 2rem;

     

       5
        
       }

     

       6
        
       

     

       7
        
       h1 {

     

       8
       -
         margin-bottom: 2rem;

     

       9
       -
         color: var(--text);

     

       10
        
       }

     

       11
        
       

     

       12
        
       .section {

     

       13
       -
         margin-bottom: 3rem;

     

       14
        
       }

     

       15
        
       

     

       16
        
       .section-title {

     

       17
       -
         font-size: 1.5rem;

     

       18
       -
         font-weight: 600;

     

       19
       -
         color: var(--text);

     

       20
       -
         margin-bottom: 1rem;

     

       21
       -
         display: flex;

     

       22
       -
         align-items: center;

     

       23
       -
         gap: 0.5rem;

     

       24
        
       }

     

       25
        
       

     

       26
        
       .tabs {

     

       27
       -
         display: flex;

     

       28
       -
         gap: 1rem;

     

       29
       -
         border-bottom: 2px solid var(--secondary);

     

       30
       -
         margin-bottom: 2rem;

     

       31
        
       }

     

       32
        
       

     

       33
        
       .tab {

     

       34
       -
         padding: 0.75rem 1.5rem;

     

       35
       -
         border: none;

     

       36
       -
         background: transparent;

     

       37
       -
         color: var(--text);

     

       38
       -
         cursor: pointer;

     

       39
       -
         font-size: 1rem;

     

       40
       -
         font-weight: 500;

     

       41
       -
         font-family: inherit;

     

       42
       -
         border-bottom: 2px solid transparent;

     

       43
       -
         margin-bottom: -2px;

     

       44
       -
         transition: all 0.2s;

     

       45
        
       }

     

       46
        
       

     

       47
        
       .tab:hover {

     

       48
       -
         color: var(--primary);

     

       49
        
       }

     

       50
        
       

     

       51
        
       .tab.active {

     

       52
       -
         color: var(--primary);

     

       53
       -
         border-bottom-color: var(--primary);

     

       54
        
       }

     

       55
        
       

     

       56
        
       .tab-content {

     

       57
       -
         display: none;

     

       58
        
       }

     

       59
        
       

     

       60
        
       .tab-content.active {

     

       61
       -
         display: block;

     

       62
        
       }

     

       63
        
       

     

       64
        
       .empty-state {

     

       65
       -
         text-align: center;

     

       66
       -
         padding: 3rem;

     

       67
       -
         color: var(--text);

     

       68
       -
         opacity: 0.6;

     

       69
        
       }

     

       70
        
       

     

       71
        
       .loading {

     

       72
       -
         text-align: center;

     

       73
       -
         padding: 3rem;

     

       74
       -
         color: var(--text);

     

       75
        
       }

     

       76
        
       

     

       77
        
       .error {

     

       78
       -
         background: #fee2e2;

     

       79
       -
         color: #991b1b;

     

       80
       -
         padding: 1rem;

     

       81
       -
         border-radius: 6px;

     

       82
       -
         margin-bottom: 1rem;

     

       83
        
       }

     

       84
        
       

     

       85
        
       .stats {

     

       86
       -
         display: grid;

     

       87
       -
         grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       -
         gap: 1rem;

     

       89
       -
         margin-bottom: 2rem;

     

       90
        
       }

     

       91
        
       

     

       92
        
       .stat-card {

     

       93
       -
         background: var(--background);

     

       94
       -
         border: 2px solid var(--secondary);

     

       95
       -
         border-radius: 8px;

     

       96
       -
         padding: 1.5rem;

     

       97
        
       }

     

       98
        
       

     

       99
        
       .stat-value {

     

       100
       -
         font-size: 2rem;

     

       101
       -
         font-weight: 700;

     

       102
       -
         color: var(--primary);

     

       103
       -
         margin-bottom: 0.25rem;

     

       104
        
       }

     

       105
        
       

     

       106
        
       .stat-label {

     

       107
       -
         color: var(--text);

     

       108
       -
         opacity: 0.7;

     

       109
       -
         font-size: 0.875rem;

     

       110
        
       }

     

       111
        
       

     

       112
        
       .timestamp {

     

       113
       -
         color: var(--text);

     

       114
       -
         opacity: 0.6;

     

       115
       -
         font-size: 0.875rem;

     

       116
        
       }

     

       117
        
       

     

       118
        
       .hidden {

     

       119
       -
         display: none;

     

       120
        
       }

···

       1
        
       main {

     

       2
       +
       	max-width: 80rem;

     

       3
       +
       	margin: 0 auto;

     

       4
       +
       	padding: 2rem;

     

       5
        
       }

     

       6
        
       

     

       7
        
       h1 {

     

       8
       +
       	margin-bottom: 2rem;

     

       9
       +
       	color: var(--text);

     

       10
        
       }

     

       11
        
       

     

       12
        
       .section {

     

       13
       +
       	margin-bottom: 3rem;

     

       14
        
       }

     

       15
        
       

     

       16
        
       .section-title {

     

       17
       +
       	font-size: 1.5rem;

     

       18
       +
       	font-weight: 600;

     

       19
       +
       	color: var(--text);

     

       20
       +
       	margin-bottom: 1rem;

     

       21
       +
       	display: flex;

     

       22
       +
       	align-items: center;

     

       23
       +
       	gap: 0.5rem;

     

       24
        
       }

     

       25
        
       

     

       26
        
       .tabs {

     

       27
       +
       	display: flex;

     

       28
       +
       	gap: 1rem;

     

       29
       +
       	border-bottom: 2px solid var(--secondary);

     

       30
       +
       	margin-bottom: 2rem;

     

       31
        
       }

     

       32
        
       

     

       33
        
       .tab {

     

       34
       +
       	padding: 0.75rem 1.5rem;

     

       35
       +
       	border: none;

     

       36
       +
       	background: transparent;

     

       37
       +
       	color: var(--text);

     

       38
       +
       	cursor: pointer;

     

       39
       +
       	font-size: 1rem;

     

       40
       +
       	font-weight: 500;

     

       41
       +
       	font-family: inherit;

     

       42
       +
       	border-bottom: 2px solid transparent;

     

       43
       +
       	margin-bottom: -2px;

     

       44
       +
       	transition: all 0.2s;

     

       45
        
       }

     

       46
        
       

     

       47
        
       .tab:hover {

     

       48
       +
       	color: var(--primary);

     

       49
        
       }

     

       50
        
       

     

       51
        
       .tab.active {

     

       52
       +
       	color: var(--primary);

     

       53
       +
       	border-bottom-color: var(--primary);

     

       54
        
       }

     

       55
        
       

     

       56
        
       .tab-content {

     

       57
       +
       	display: none;

     

       58
        
       }

     

       59
        
       

     

       60
        
       .tab-content.active {

     

       61
       +
       	display: block;

     

       62
        
       }

     

       63
        
       

     

       64
        
       .empty-state {

     

       65
       +
       	text-align: center;

     

       66
       +
       	padding: 3rem;

     

       67
       +
       	color: var(--text);

     

       68
       +
       	opacity: 0.6;

     

       69
        
       }

     

       70
        
       

     

       71
        
       .loading {

     

       72
       +
       	text-align: center;

     

       73
       +
       	padding: 3rem;

     

       74
       +
       	color: var(--text);

     

       75
        
       }

     

       76
        
       

     

       77
        
       .error {

     

       78
       +
       	background: #fee2e2;

     

       79
       +
       	color: #991b1b;

     

       80
       +
       	padding: 1rem;

     

       81
       +
       	border-radius: 6px;

     

       82
       +
       	margin-bottom: 1rem;

     

       83
        
       }

     

       84
        
       

     

       85
        
       .stats {

     

       86
       +
       	display: grid;

     

       87
       +
       	grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       +
       	gap: 1rem;

     

       89
       +
       	margin-bottom: 2rem;

     

       90
        
       }

     

       91
        
       

     

       92
        
       .stat-card {

     

       93
       +
       	background: var(--background);

     

       94
       +
       	border: 2px solid var(--secondary);

     

       95
       +
       	border-radius: 8px;

     

       96
       +
       	padding: 1.5rem;

     

       97
        
       }

     

       98
        
       

     

       99
        
       .stat-value {

     

       100
       +
       	font-size: 2rem;

     

       101
       +
       	font-weight: 700;

     

       102
       +
       	color: var(--primary);

     

       103
       +
       	margin-bottom: 0.25rem;

     

       104
        
       }

     

       105
        
       

     

       106
        
       .stat-label {

     

       107
       +
       	color: var(--text);

     

       108
       +
       	opacity: 0.7;

     

       109
       +
       	font-size: 0.875rem;

     

       110
        
       }

     

       111
        
       

     

       112
        
       .timestamp {

     

       113
       +
       	color: var(--text);

     

       114
       +
       	opacity: 0.6;

     

       115
       +
       	font-size: 0.875rem;

     

       116
        
       }

     

       117
        
       

     

       118
        
       .hidden {

     

       119
       +
       	display: none;

     

       120
        
       }

+41 -41

src/styles/index.css

···

       1
        
       .hero-title {

     

       2
       -
         font-size: 3rem;

     

       3
       -
         font-weight: 700;

     

       4
       -
         color: var(--text);

     

       5
       -
         margin-bottom: 1rem;

     

       6
        
       }

     

       7
        
       

     

       8
        
       .hero-subtitle {

     

       9
       -
         font-size: 1.25rem;

     

       10
       -
         color: var(--text);

     

       11
       -
         opacity: 0.8;

     

       12
       -
         margin-bottom: 2rem;

     

       13
        
       }

     

       14
        
       

     

       15
        
       main {

     

       16
       -
         text-align: center;

     

       17
       -
         padding: 4rem 2rem;

     

       18
        
       }

     

       19
        
       

     

       20
        
       .cta-buttons {

     

       21
       -
         display: flex;

     

       22
       -
         gap: 1rem;

     

       23
       -
         justify-content: center;

     

       24
       -
         margin-top: 2rem;

     

       25
        
       }

     

       26
        
       

     

       27
        
       .btn {

     

       28
       -
         padding: 0.75rem 1.5rem;

     

       29
       -
         border-radius: 6px;

     

       30
       -
         font-size: 1rem;

     

       31
       -
         font-weight: 500;

     

       32
       -
         cursor: pointer;

     

       33
       -
         transition: all 0.2s;

     

       34
       -
         font-family: inherit;

     

       35
       -
         border: 2px solid;

     

       36
       -
         text-decoration: none;

     

       37
       -
         display: inline-block;

     

       38
        
       }

     

       39
        
       

     

       40
        
       .btn-primary {

     

       41
       -
         background: var(--primary);

     

       42
       -
         color: white;

     

       43
       -
         border-color: var(--primary);

     

       44
        
       }

     

       45
        
       

     

       46
        
       .btn-primary:hover {

     

       47
       -
         background: transparent;

     

       48
       -
         color: var(--primary);

     

       49
        
       }

     

       50
        
       

     

       51
        
       .btn-secondary {

     

       52
       -
         background: transparent;

     

       53
       -
         color: var(--text);

     

       54
       -
         border-color: var(--secondary);

     

       55
        
       }

     

       56
        
       

     

       57
        
       .btn-secondary:hover {

     

       58
       -
         border-color: var(--primary);

     

       59
       -
         color: var(--primary);

     

       60
        
       }

     

       61
        
       

     

       62
        
       @media (max-width: 640px) {

     

       63
       -
         .hero-title {

     

       64
       -
           font-size: 2.5rem;

     

       65
       -
         }

     

       66
        
       

     

       67
       -
         .cta-buttons {

     

       68
       -
           flex-direction: column;

     

       69
       -
           align-items: center;

     

       70
       -
         }

     

       71
        
       }

···

       1
        
       .hero-title {

     

       2
       +
       	font-size: 3rem;

     

       3
       +
       	font-weight: 700;

     

       4
       +
       	color: var(--text);

     

       5
       +
       	margin-bottom: 1rem;

     

       6
        
       }

     

       7
        
       

     

       8
        
       .hero-subtitle {

     

       9
       +
       	font-size: 1.25rem;

     

       10
       +
       	color: var(--text);

     

       11
       +
       	opacity: 0.8;

     

       12
       +
       	margin-bottom: 2rem;

     

       13
        
       }

     

       14
        
       

     

       15
        
       main {

     

       16
       +
       	text-align: center;

     

       17
       +
       	padding: 4rem 2rem;

     

       18
        
       }

     

       19
        
       

     

       20
        
       .cta-buttons {

     

       21
       +
       	display: flex;

     

       22
       +
       	gap: 1rem;

     

       23
       +
       	justify-content: center;

     

       24
       +
       	margin-top: 2rem;

     

       25
        
       }

     

       26
        
       

     

       27
        
       .btn {

     

       28
       +
       	padding: 0.75rem 1.5rem;

     

       29
       +
       	border-radius: 6px;

     

       30
       +
       	font-size: 1rem;

     

       31
       +
       	font-weight: 500;

     

       32
       +
       	cursor: pointer;

     

       33
       +
       	transition: all 0.2s;

     

       34
       +
       	font-family: inherit;

     

       35
       +
       	border: 2px solid;

     

       36
       +
       	text-decoration: none;

     

       37
       +
       	display: inline-block;

     

       38
        
       }

     

       39
        
       

     

       40
        
       .btn-primary {

     

       41
       +
       	background: var(--primary);

     

       42
       +
       	color: white;

     

       43
       +
       	border-color: var(--primary);

     

       44
        
       }

     

       45
        
       

     

       46
        
       .btn-primary:hover {

     

       47
       +
       	background: transparent;

     

       48
       +
       	color: var(--primary);

     

       49
        
       }

     

       50
        
       

     

       51
        
       .btn-secondary {

     

       52
       +
       	background: transparent;

     

       53
       +
       	color: var(--text);

     

       54
       +
       	border-color: var(--secondary);

     

       55
        
       }

     

       56
        
       

     

       57
        
       .btn-secondary:hover {

     

       58
       +
       	border-color: var(--primary);

     

       59
       +
       	color: var(--primary);

     

       60
        
       }

     

       61
        
       

     

       62
        
       @media (max-width: 640px) {

     

       63
       +
       	.hero-title {

     

       64
       +
       		font-size: 2.5rem;

     

       65
       +
       	}

     

       66
        
       

     

       67
       +
       	.cta-buttons {

     

       68
       +
       		flex-direction: column;

     

       69
       +
       		align-items: center;

     

       70
       +
       	}

     

       71
        
       }

+4 -4

src/styles/reset-password.css

···

       1
        
       main {

     

       2
       -
         display: flex;

     

       3
       -
         align-items: center;

     

       4
       -
         justify-content: center;

     

       5
       -
         padding: 4rem 1rem;

     

       6
        
       }

···

       1
        
       main {

     

       2
       +
       	display: flex;

     

       3
       +
       	align-items: center;

     

       4
       +
       	justify-content: center;

     

       5
       +
       	padding: 4rem 1rem;

     

       6
        
       }

+1 -1

src/styles/settings.css

···

       1
        
       main {

     

       2
       -
         max-width: 64rem;

     

       3
        
       }

···

       1
        
       main {

     

       2
       +
       	max-width: 64rem;

     

       3
        
       }

+13 -13

src/styles/transcribe.css

···

       1
        
       .page-header {

     

       2
       -
         text-align: center;

     

       3
       -
         margin-bottom: 3rem;

     

       4
        
       }

     

       5
        
       

     

       6
        
       .page-title {

     

       7
       -
         font-size: 2.5rem;

     

       8
       -
         font-weight: 700;

     

       9
       -
         color: var(--text);

     

       10
       -
         margin-bottom: 0.5rem;

     

       11
        
       }

     

       12
        
       

     

       13
        
       .page-subtitle {

     

       14
       -
         font-size: 1.125rem;

     

       15
       -
         color: var(--text);

     

       16
       -
         opacity: 0.8;

     

       17
        
       }

     

       18
        
       

     

       19
        
       .back-link {

     

       20
       -
         color: var(--paynes-gray);

     

       21
       -
         text-decoration: none;

     

       22
       -
         font-size: 0.875rem;

     

       23
        
       }

     

       24
        
       

     

       25
        
       .mb-1 {

     

       26
       -
         margin-bottom: 1rem;

     

       27
        
       }

···

       1
        
       .page-header {

     

       2
       +
       	text-align: center;

     

       3
       +
       	margin-bottom: 3rem;

     

       4
        
       }

     

       5
        
       

     

       6
        
       .page-title {

     

       7
       +
       	font-size: 2.5rem;

     

       8
       +
       	font-weight: 700;

     

       9
       +
       	color: var(--text);

     

       10
       +
       	margin-bottom: 0.5rem;

     

       11
        
       }

     

       12
        
       

     

       13
        
       .page-subtitle {

     

       14
       +
       	font-size: 1.125rem;

     

       15
       +
       	color: var(--text);

     

       16
       +
       	opacity: 0.8;

     

       17
        
       }

     

       18
        
       

     

       19
        
       .back-link {

     

       20
       +
       	color: var(--paynes-gray);

     

       21
       +
       	text-decoration: none;

     

       22
       +
       	font-size: 0.875rem;

     

       23
        
       }

     

       24
        
       

     

       25
        
       .mb-1 {

     

       26
       +
       	margin-bottom: 1rem;

     

       27
        
       }

Compare changes