comparing 6789cc46898c1249b1d1ba807857fc162477cc61 and main on dunkirk.sh/thistle

+22 -17

.env.example

···

       3
        
       # See README for setup instructions

     

       4
        
       WHISPER_SERVICE_URL=http://localhost:8000

     

       5
        
       

     

       6
       -
       # LLM API Configuration (Required for VTT cleaning)

     

       7
        
       # Configure your LLM service endpoint and credentials

     

       8
       -
       LLM_API_KEY=your_api_key_here

     

       9
       -
       LLM_API_BASE_URL=https://api.openai.com/v1

     

       10
       -
       LLM_MODEL=gpt-4o-mini

     

       11
        
       

     

       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
        
       # In development, these default to localhost values

     
···

       17
        
       # Must match the domain where your app is hosted

     

       18
        
       # RP_ID=thistle.app

     

       19
        
       

     

       20
       -
       # Origin - full URL of your app

     

       21
        
       # Must match exactly where users access your app

     

       22
       -
       # ORIGIN=https://thistle.app

     

       0
        
       
     

       23
        
       

     

       24
       -
       # Polar.sh payment stuff

     

       0
        
       
     

       0
        
       
     

       25
        
       # Get your access token from https://polar.sh/settings (or sandbox.polar.sh for testing)

     

       26
       -
       POLAR_ACCESS_TOKEN=XXX

     

       27
        
       # Get product ID from your Polar dashboard (create a product first)

     

       28
       -
       POLAR_PRODUCT_ID=3f1ab9f9-d573-49d4-ac0a-a78bfb06c347

     

       29
        
       # Redirect URL after successful checkout (use {CHECKOUT_ID} placeholder)

     

       30
        
       POLAR_SUCCESS_URL=http://localhost:3000/checkout?checkout_id={CHECKOUT_ID}

     

       31
        
       # Webhook secret for verifying Polar webhook signatures (get from Polar dashboard)

     

       32
       -
       POLAR_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxx

     

       33
       -
       

     

       34
       -
       # Environment (set to 'production' in production)

     

       35
       -
       NODE_ENV=development

     

       36
        
       

     

       37
       -
       # Email Configuration (MailChannels)

     

       0
        
       
     

       0
        
       
     

       38
        
       # DKIM private key for email authentication (required for sending emails)

     

       39
        
       # Generate: openssl genrsa -out dkim-private.pem 2048

     

       40
        
       # Then add TXT record: mailchannels._domainkey.yourdomain.com

     

       41
       -
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       42
       -
       DKIM_DOMAIN=thistle.app

     

       43
       -
       SMTP_FROM_EMAIL=noreply@thistle.app

     

       44
        
       SMTP_FROM_NAME=Thistle

     

       0
        
       
     

       0
        
       
     

       0

···

       3
        
       # See README for setup instructions

     

       4
        
       WHISPER_SERVICE_URL=http://localhost:8000

     

       5
        
       

     

       6
       +
       # LLM API Configuration (REQUIRED for VTT cleaning)

     

       7
        
       # Configure your LLM service endpoint and credentials

     

       8
       +
       LLM_API_KEY=paste_your_api_key_here

     

       9
       +
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       +
       LLM_MODEL=moonshotai/kimi-k2-0905

     

       11
        
       

     

       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
        
       # In development, these default to localhost values

     
···

       17
        
       # Must match the domain where your app is hosted

     

       18
        
       # RP_ID=thistle.app

     

       19
        
       

     

       20
       +
       # Origin - full URL of your app (RECOMMENDED - used for email links)

     

       21
        
       # Must match exactly where users access your app

     

       22
       +
       # In production, set this to your public URL

     

       23
       +
       ORIGIN=http://localhost:3000

     

       24
        
       

     

       25
       +
       # Polar.sh Payment Configuration (REQUIRED)

     

       26
       +
       # Get your organization ID from https://polar.sh/settings

     

       27
       +
       POLAR_ORGANIZATION_ID=paste_your_org_id_here

     

       28
        
       # Get your access token from https://polar.sh/settings (or sandbox.polar.sh for testing)

     

       29
       +
       POLAR_ACCESS_TOKEN=paste_your_polar_token_here

     

       30
        
       # Get product ID from your Polar dashboard (create a product first)

     

       31
       +
       POLAR_PRODUCT_ID=paste_your_product_id_here

     

       32
        
       # Redirect URL after successful checkout (use {CHECKOUT_ID} placeholder)

     

       33
        
       POLAR_SUCCESS_URL=http://localhost:3000/checkout?checkout_id={CHECKOUT_ID}

     

       34
        
       # Webhook secret for verifying Polar webhook signatures (get from Polar dashboard)

     

       35
       +
       POLAR_WEBHOOK_SECRET=paste_your_webhook_secret_here

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       36
        
       

     

       37
       +
       # Email Configuration (REQUIRED - MailChannels)

     

       38
       +
       # API key from MailChannels dashboard

     

       39
       +
       MAILCHANNELS_API_KEY=paste_your_mailchannels_api_key_here

     

       40
        
       # DKIM private key for email authentication (required for sending emails)

     

       41
        
       # Generate: openssl genrsa -out dkim-private.pem 2048

     

       42
        
       # Then add TXT record: mailchannels._domainkey.yourdomain.com

     

       43
       +
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nPASTE_YOUR_DKIM_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       44
       +
       DKIM_DOMAIN=yourdomain.com

     

       45
       +
       SMTP_FROM_EMAIL=noreply@yourdomain.com

     

       46
        
       SMTP_FROM_NAME=Thistle

     

       47
       +
       

     

       48
       +
       # Environment (set to 'production' in production)

     

       49
       +
       NODE_ENV=development

+117

CRUSH.md

···

       6
        
       

     

       7
        
       **IMPORTANT**: Do NOT commit changes until the user explicitly asks you to commit. Always wait for user verification that changes are working correctly before making commits.

     

       8
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       9
        
       ## Project Info

     

       10
        
       

     

       11
        
       - Name: Thistle

     
···

       677
        
       

     

       678
        
       **Configuration:**

     

       679
        
       Set `WHISPER_SERVICE_URL` in `.env` (default: `http://localhost:8000`)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       680
        
       

     

       681
        
       ## Future Additions

     

       682

···

       6
        
       

     

       7
        
       **IMPORTANT**: Do NOT commit changes until the user explicitly asks you to commit. Always wait for user verification that changes are working correctly before making commits.

     

       8
        
       

     

       9
       +
       ## Environment Variables

     

       10
       +
       

     

       11
       +
       **CRITICAL**: Always use `process.env.ORIGIN` for generating URLs in emails and links, NOT hardcoded domains.

     

       12
       +
       

     

       13
       +
       - `ORIGIN` - The public URL of the application (e.g., `https://thistle.app` or `http://localhost:3000`)

     

       14
       +
       - Used for: Email verification links, password reset links, any user-facing URLs

     

       15
       +
       - Default: `http://localhost:3000` (development only)

     

       16
       +
       

     

       17
       +
       **Never hardcode domain names** like `https://thistle.app` in code - always use `process.env.ORIGIN`.

     

       18
       +
       

     

       19
        
       ## Project Info

     

       20
        
       

     

       21
        
       - Name: Thistle

     
···

       687
        
       

     

       688
        
       **Configuration:**

     

       689
        
       Set `WHISPER_SERVICE_URL` in `.env` (default: `http://localhost:8000`)

     

       690
       +
       

     

       691
       +
       ## Issue Tracking

     

       692
       +
       

     

       693
       +
       This project uses [Tangled](https://tangled.org) for issue tracking via the `tangled-cli` tool.

     

       694
       +
       

     

       695
       +
       **Installation:**

     

       696
       +
       ```bash

     

       697
       +
       cargo install --git https://tangled.org/vitorpy.com/tangled-cli

     

       698
       +
       ```

     

       699
       +
       

     

       700
       +
       **Authentication:**

     

       701
       +
       ```bash

     

       702
       +
       tangled-cli auth login

     

       703
       +
       ```

     

       704
       +
       

     

       705
       +
       **Creating issues:**

     

       706
       +
       ```bash

     

       707
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --body "Issue description"

     

       708
       +
       

     

       709
       +
       # With labels (if created in the repo):

     

       710
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --label "bug" --label "priority:high" --body "Issue description"

     

       711
       +
       ```

     

       712
       +
       

     

       713
       +
       **Listing issues:**

     

       714
       +
       ```bash

     

       715
       +
       # List all open issues

     

       716
       +
       tangled-cli issue list --repo "thistle"

     

       717
       +
       

     

       718
       +
       # List with specific state

     

       719
       +
       tangled-cli issue list --repo "thistle" --state open

     

       720
       +
       tangled-cli issue list --repo "thistle" --state closed

     

       721
       +
       

     

       722
       +
       # List by label

     

       723
       +
       tangled-cli issue list --repo "thistle" --label "priority: low"

     

       724
       +
       tangled-cli issue list --repo "thistle" --label "bug"

     

       725
       +
       

     

       726
       +
       # List by author

     

       727
       +
       tangled-cli issue list --repo "thistle" --author "username"

     

       728
       +
       

     

       729
       +
       # JSON output format

     

       730
       +
       tangled-cli issue list --repo "thistle" --format json

     

       731
       +
       ```

     

       732
       +
       

     

       733
       +
       **Showing issue details:**

     

       734
       +
       ```bash

     

       735
       +
       # Show specific issue by ID

     

       736
       +
       tangled-cli issue show <issue-id>

     

       737
       +
       

     

       738
       +
       # Show with comments

     

       739
       +
       tangled-cli issue show <issue-id> --comments

     

       740
       +
       

     

       741
       +
       # JSON format

     

       742
       +
       tangled-cli issue show <issue-id> --json

     

       743
       +
       ```

     

       744
       +
       

     

       745
       +
       **Commenting on issues:**

     

       746
       +
       ```bash

     

       747
       +
       tangled-cli issue comment <issue-id> --body "Your comment here"

     

       748
       +
       ```

     

       749
       +
       

     

       750
       +
       **Editing issues:**

     

       751
       +
       ```bash

     

       752
       +
       # Update title

     

       753
       +
       tangled-cli issue edit <issue-id> --title "New title"

     

       754
       +
       

     

       755
       +
       # Update body

     

       756
       +
       tangled-cli issue edit <issue-id> --body "New description"

     

       757
       +
       

     

       758
       +
       # Close an issue

     

       759
       +
       tangled-cli issue edit <issue-id> --state closed

     

       760
       +
       

     

       761
       +
       # Reopen an issue

     

       762
       +
       tangled-cli issue edit <issue-id> --state open

     

       763
       +
       ```

     

       764
       +
       

     

       765
       +
       **Repository commands:**

     

       766
       +
       ```bash

     

       767
       +
       # List your repositories

     

       768
       +
       tangled-cli repo list

     

       769
       +
       

     

       770
       +
       # Show repository details

     

       771
       +
       tangled-cli repo info thistle

     

       772
       +
       

     

       773
       +
       # Create a new repository

     

       774
       +
       tangled-cli repo create --name "repo-name" --description "Description"

     

       775
       +
       ```

     

       776
       +
       

     

       777
       +
       **Viewing issues by priority:**

     

       778
       +
       

     

       779
       +
       The thistle repo uses priority labels:

     

       780
       +
       - `priority: high` - Critical issues that need immediate attention

     

       781
       +
       - `priority: medium` - Important issues to address soon

     

       782
       +
       - `priority: low` - Nice-to-have improvements

     

       783
       +
       

     

       784
       +
       ```bash

     

       785
       +
       # View all low priority issues

     

       786
       +
       tangled-cli issue list --repo "thistle" --label "priority: low" --state open

     

       787
       +
       

     

       788
       +
       # View all high priority issues

     

       789
       +
       tangled-cli issue list --repo "thistle" --label "priority: high" --state open

     

       790
       +
       ```

     

       791
       +
       

     

       792
       +
       **Note:** The repo name for this project is `thistle` (resolves to `dunkirk.sh/thistle` in Tangled). Labels are supported but need to be created in the repository first.

     

       793
       +
       

     

       794
       +
       **Known Issues:**

     

       795
       +
       - The CLI may have decoding issues with some API responses (missing `createdAt` field). If `tangled-cli issue list` fails, you can access issues via the web interface at https://tangled.org/dunkirk.sh/thistle

     

       796
       +
       - For complex filtering or browsing, the web UI may be more reliable than the CLI

     

       797
        
       

     

       798
        
       ## Future Additions

     

       799

-399

index.html

···

       1
       -
       <!-- vim: setlocal noexpandtab nowrap: -->

     

       2
       -
       <!doctype html>

     

       3
       -
       <html lang="en">

     

       4
       -
       

     

       5
       -
       <head>

     

       6
       -
         <meta charset="UTF-8" />

     

       7
       -
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />

     

       8
       -
         <title>C:\KIERANK.EXE - kierank.hackclub.app</title>

     

       9
       -
         <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>

     

       10
       -
         <style>

     

       11
       -
           @import url("https://fonts.googleapis.com/css2?family=Courier+Prime:wght@400;700&display=swap");

     

       12
       -
       

     

       13
       -
           body {

     

       14
       -
             background: #008080;

     

       15
       -
             font-family: "Courier Prime", "Courier New", monospace;

     

       16
       -
             color: #000000;

     

       17
       -
             margin: 0;

     

       18
       -
             padding: 20px;

     

       19
       -
             line-height: 1.4;

     

       20
       -
             font-size: 14px;

     

       21
       -
           }

     

       22
       -
       

     

       23
       -
           .hidden {

     

       24
       -
             display: none !important;

     

       25
       -
           }

     

       26
       -
       

     

       27
       -
           .terminal {

     

       28
       -
             background: #ffffff;

     

       29
       -
             border: 2px solid #808080;

     

       30
       -
             box-shadow:

     

       31
       -
               inset -2px -2px #c0c0c0,

     

       32
       -
               inset 2px 2px #404040,

     

       33
       -
               4px 4px 0px #000000;

     

       34
       -
             max-width: 750px;

     

       35
       -
             margin: 0 auto;

     

       36
       -
             padding: 0;

     

       37
       -
           }

     

       38
       -
       

     

       39
       -
           .title-bar {

     

       40
       -
             background: linear-gradient(90deg, #000080, #1084d0);

     

       41
       -
             color: #ffffff;

     

       42
       -
             padding: 4px 8px;

     

       43
       -
             font-weight: bold;

     

       44
       -
             border-bottom: 1px solid #808080;

     

       45
       -
             font-size: 12px;

     

       46
       -
             display: flex;

     

       47
       -
             justify-content: space-between;

     

       48
       -
             align-items: center;

     

       49
       -
           }

     

       50
       -
       

     

       51
       -
           .title-buttons {

     

       52
       -
             display: flex;

     

       53
       -
             gap: 2px;

     

       54
       -
           }

     

       55
       -
       

     

       56
       -
           .title-btn {

     

       57
       -
             width: 16px;

     

       58
       -
             height: 14px;

     

       59
       -
             background: #c0c0c0;

     

       60
       -
             border: 1px outset #ffffff;

     

       61
       -
             font-size: 10px;

     

       62
       -
             line-height: 12px;

     

       63
       -
             text-align: center;

     

       64
       -
             cursor: pointer;

     

       65
       -
           }

     

       66
       -
       

     

       67
       -
           .content {

     

       68
       -
             padding: 15px;

     

       69
       -
             background: #ffffff;

     

       70
       -
           }

     

       71
       -
       

     

       72
       -
           .prompt {

     

       73
       -
             color: #000000;

     

       74
       -
             margin: 0 0 10px 0;

     

       75
       -
           }

     

       76
       -
       

     

       77
       -
           .cursor {

     

       78
       -
             background: #000000;

     

       79
       -
             color: #ffffff;

     

       80
       -
             animation: blink 1s infinite;

     

       81
       -
           }

     

       82
       -
       

     

       83
       -
           @keyframes blink {

     

       84
       -
       

     

       85
       -
             0%,

     

       86
       -
             50% {

     

       87
       -
               opacity: 1;

     

       88
       -
             }

     

       89
       -
       

     

       90
       -
             51%,

     

       91
       -
             100% {

     

       92
       -
               opacity: 0;

     

       93
       -
             }

     

       94
       -
           }

     

       95
       -
       

     

       96
       -
           /* Markdown rendered content styles */

     

       97
       -
           #readme-content h3 {

     

       98
       -
             color: #000080;

     

       99
       -
             font-size: 20px;

     

       100
       -
             margin: 15px 0 10px 0;

     

       101
       -
             border-bottom: 2px solid #c0c0c0;

     

       102
       -
             padding-bottom: 5px;

     

       103
       -
           }

     

       104
       -
       

     

       105
       -
           #readme-content h4 {

     

       106
       -
             color: #000000;

     

       107
       -
             font-size: 14px;

     

       108
       -
             margin: 20px 0 8px 0;

     

       109
       -
             text-transform: uppercase;

     

       110
       -
             background: #c0c0c0;

     

       111
       -
             padding: 4px 8px;

     

       112
       -
             display: inline-block;

     

       113
       -
           }

     

       114
       -
       

     

       115
       -
           #readme-content p {

     

       116
       -
             margin: 8px 0;

     

       117
       -
           }

     

       118
       -
       

     

       119
       -
           #readme-content ul {

     

       120
       -
             margin: 8px 0;

     

       121
       -
             padding-left: 20px;

     

       122
       -
             list-style: none;

     

       123
       -
           }

     

       124
       -
       

     

       125
       -
           #readme-content ul li {

     

       126
       -
             margin: 6px 0;

     

       127
       -
             position: relative;

     

       128
       -
           }

     

       129
       -
       

     

       130
       -
           #readme-content ul li::before {

     

       131
       -
             content: "► ";

     

       132
       -
             color: #000080;

     

       133
       -
           }

     

       134
       -
       

     

       135
       -
           #readme-content a {

     

       136
       -
             color: #000080;

     

       137
       -
             text-decoration: underline;

     

       138
       -
           }

     

       139
       -
       

     

       140
       -
           #readme-content a:hover {

     

       141
       -
             color: #0000ff;

     

       142
       -
             background: #ffffcc;

     

       143
       -
           }

     

       144
       -
       

     

       145
       -
           #readme-content code {

     

       146
       -
             background: #000080;

     

       147
       -
             color: #ffffff;

     

       148
       -
             padding: 1px 4px;

     

       149
       -
             font-family: "Courier Prime", "Courier New", monospace;

     

       150
       -
           }

     

       151
       -
       

     

       152
       -
           #readme-content pre {

     

       153
       -
             background: #000080;

     

       154
       -
             color: #cbcbcb;

     

       155
       -
             padding: 12px;

     

       156
       -
             border: 2px inset #404040;

     

       157
       -
             overflow-x: auto;

     

       158
       -
             font-size: 12px;

     

       159
       -
             line-height: 1.3;

     

       160
       -
           }

     

       161
       -
       

     

       162
       -
           #readme-content pre code {

     

       163
       -
             background: transparent;

     

       164
       -
             color: inherit;

     

       165
       -
             padding: 0;

     

       166
       -
           }

     

       167
       -
       

     

       168
       -
           #readme-content strong {

     

       169
       -
             color: #333333;

     

       170
       -
           }

     

       171
       -
       

     

       172
       -
           #readme-content em {

     

       173
       -
             color: #808080;

     

       174
       -
             font-style: italic;

     

       175
       -
           }

     

       176
       -
       

     

       177
       -
           .status-bar {

     

       178
       -
             background: #c0c0c0;

     

       179
       -
             color: #000000;

     

       180
       -
             padding: 3px 8px;

     

       181
       -
             border-top: 2px groove #ffffff;

     

       182
       -
             font-size: 11px;

     

       183
       -
             display: flex;

     

       184
       -
             justify-content: space-between;

     

       185
       -
           }

     

       186
       -
       

     

       187
       -
           .separator {

     

       188
       -
             color: #808080;

     

       189
       -
             margin: 15px 0;

     

       190
       -
             text-align: center;

     

       191
       -
           }

     

       192
       -
       

     

       193
       -
           .loading {

     

       194
       -
             text-align: center;

     

       195
       -
             padding: 20px;

     

       196
       -
             color: #808080;

     

       197
       -
           }

     

       198
       -
       

     

       199
       -
           .loading::after {

     

       200
       -
             content: "";

     

       201
       -
             animation: dots 1.5s steps(4, end) infinite;

     

       202
       -
           }

     

       203
       -
       

     

       204
       -
           @keyframes dots {

     

       205
       -
       

     

       206
       -
             0%,

     

       207
       -
             20% {

     

       208
       -
               content: "";

     

       209
       -
             }

     

       210
       -
       

     

       211
       -
             40% {

     

       212
       -
               content: ".";

     

       213
       -
             }

     

       214
       -
       

     

       215
       -
             60% {

     

       216
       -
               content: "..";

     

       217
       -
             }

     

       218
       -
       

     

       219
       -
             80%,

     

       220
       -
             100% {

     

       221
       -
               content: "...";

     

       222
       -
             }

     

       223
       -
           }

     

       224
       -
       

     

       225
       -
           .error-box {

     

       226
       -
             background: #ff0000;

     

       227
       -
             color: #ffffff;

     

       228
       -
             padding: 10px;

     

       229
       -
             border: 2px inset #800000;

     

       230
       -
             margin: 10px 0;

     

       231
       -
           }

     

       232
       -
       

     

       233
       -
           .ascii-header {

     

       234
       -
             color: #000080;

     

       235
       -
             font-size: 10px;

     

       236
       -
             line-height: 1.1;

     

       237
       -
             white-space: pre;

     

       238
       -
             margin: 10px 0 15px 0;

     

       239
       -
             text-align: center;

     

       240
       -
           }

     

       241
       -
         </style>

     

       242
       -
       </head>

     

       243
       -
       

     

       244
       -
       <body>

     

       245
       -
         <div class="terminal">

     

       246
       -
           <div class="title-bar">

     

       247
       -
             <span>C:\KIERANK.EXE - kierank.hackclub.app</span>

     

       248
       -
             <div class="title-buttons">

     

       249
       -
               <div class="title-btn">_</div>

     

       250
       -
               <div class="title-btn">□</div>

     

       251
       -
               <div class="title-btn">×</div>

     

       252
       -
             </div>

     

       253
       -
           </div>

     

       254
       -
       

     

       255
       -
           <div class="content">

     

       256
       -
             <p class="prompt">

     

       257
       -
               C:\KIERANK> README.EXE<span class="cursor"> </span>

     

       258
       -
             </p>

     

       259
       -
       

     

       260
       -
             <!-- biome-ignore format: ascii art -->

     

       261
       -
       			<pre class="ascii-header">

     

       262
       -
       ██╗ ██╗██╗███████╗██████╗ █████╗  ███╗   ██╗

     

       263
       -
       ██║ ██║██║██╔════╝██╔══██╗██╔══██╗████╗  ██║

     

       264
       -
       █████╔╝██║█████╗  ██████╔╝███████║██╔██╗ ██║

     

       265
       -
       ██╔═██╗██║██╔══╝  ██╔══██╗██╔══██║██║╚██╗██║

     

       266
       -
       ██║ ██║██║███████╗██║  ██║██║  ██║██║ ╚████║

     

       267
       -
       ╚═╝ ╚═╝╚═╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝

     

       268
       -
       			</pre>

     

       269
       -
       

     

       270
       -
             <div class="separator">

     

       271
       -
               ════════════════════════════════════════════════════

     

       272
       -
             </div>

     

       273
       -
       

     

       274
       -
             <div id="readme-content">

     

       275
       -
               <div class="loading" style="display: none">Loading README from GitHub</div>

     

       276
       -
       

     

       277
       -
               <noscript>

     

       278
       -
                 <div class="error-box">

     

       279
       -
                   JavaScript is disabled so not rendering markdown.

     

       280
       -
                 </div>

     

       281
       -
                 <p>

     

       282
       -
                   View the README on GitHub:

     

       283
       -
                   <a href="https://github.com/taciturnaxolotl/taciturnaxolotl/blob/main/README.md">

     

       284
       -
                     taciturnaxolotl/README.md

     

       285
       -
                   </a>

     

       286
       -
                 </p>

     

       287
       -
               </noscript>

     

       288
       -
             </div>

     

       289
       -
       

     

       290
       -
             <div class="separator">

     

       291
       -
               ════════════════════════════════════════════════════

     

       292
       -
             </div>

     

       293
       -
       

     

       294
       -
             <p style="font-size: 11px; color: #808080; text-align: center">

     

       295
       -
               Hosted on <a href="https://hackclub.com/nest/">Hack Club Nest</a> |

     

       296
       -
               <a href="https://github.com/taciturnaxolotl">GitHub</a> |

     

       297
       -
               <a href="https://dunkirk.sh">dunkirk.sh</a>

     

       298
       -
             </p>

     

       299
       -
           </div>

     

       300
       -
       

     

       301
       -
           <div class="status-bar">

     

       302
       -
             <span id="status">Fetching README...</span>

     

       303
       -
             <span id="time"></span>

     

       304
       -
           </div>

     

       305
       -
         </div>

     

       306
       -
       

     

       307
       -
         <script>

     

       308
       -
           const README_URL =

     

       309
       -
             "https://raw.githubusercontent.com/taciturnaxolotl/taciturnaxolotl/refs/heads/main/README.md"

     

       310
       -
       

     

       311
       -
           async function loadReadme() {

     

       312
       -
             const contentDiv = document.getElementById("readme-content");

     

       313
       -
             const statusSpan = document.getElementById("status");

     

       314
       -
             const loadingEl = contentDiv.querySelector(".loading");

     

       315
       -
       

     

       316
       -
             // Show loading

     

       317
       -
             if (loadingEl) loadingEl.classList.remove("hidden");

     

       318
       -
       

     

       319
       -
       

     

       320
       -
             try {

     

       321
       -
               const response = await fetch(README_URL);

     

       322
       -
               if (!response.ok) {

     

       323
       -
                 throw new Error(`HTTP ${response.status}`);

     

       324
       -
               }

     

       325
       -
       

     

       326
       -
               const markdown = await response.text();

     

       327
       -
       

     

       328
       -
               // Configure marked for GFM

     

       329
       -
               marked.setOptions({

     

       330
       -
                 gfm: true,

     

       331
       -
                 breaks: true,

     

       332
       -
               });

     

       333
       -
       

     

       334
       -
               contentDiv.innerHTML = marked.parse(markdown);

     

       335
       -
       

     

       336
       -
               // Strip emojis from headers

     

       337
       -
               contentDiv.querySelectorAll("h3, h4").forEach((header) => {

     

       338
       -
                 const text = header.textContent;

     

       339
       -
       

     

       340
       -
                 // Regex targets:

     

       341
       -
                 // - \p{Extended_Pictographic}: most modern emoji/pictographs

     

       342
       -
                 // - \p{Emoji_Presentation}: characters default-rendered as emoji

     

       343
       -
                 // - Variation Selector-16 (U+FE0F): emoji presentation modifier

     

       344
       -
                 // - Common symbol blocks that often carry emoji-like glyphs

     

       345
       -
                 const emojiRegex =

     

       346
       -
                   /[\p{Extended_Pictographic}\p{Emoji_Presentation}\uFE0F]|[\u2600-\u26FF\u2700-\u27BF]/gu;

     

       347
       -
       

     

       348
       -
                 // Strip emojis

     

       349
       -
                 let cleaned = text.replace(emojiRegex, "");

     

       350
       -
       

     

       351
       -
                 // Collapse multiple whitespace into single spaces

     

       352
       -
                 cleaned = cleaned.replace(/\s+/g, " ");

     

       353
       -
       

     

       354
       -
                 // Remove spaces before punctuation (e.g., "Hello !" -> "Hello!")

     

       355
       -
                 cleaned = cleaned.replace(/\s+([!?,.;:])/g, "$1");

     

       356
       -
       

     

       357
       -
                 // Trim leading/trailing whitespace

     

       358
       -
                 cleaned = cleaned.trim();

     

       359
       -
       

     

       360
       -
                 // Replace header content safely

     

       361
       -
                 header.textContent = cleaned;

     

       362
       -
               });

     

       363
       -
       

     

       364
       -
               statusSpan.textContent = "README loaded successfully";

     

       365
       -
             } catch (error) {

     

       366
       -
               contentDiv.innerHTML = `

     

       367
       -
                               <div class="error-box">

     

       368
       -
                                   ERROR: Failed to load README<br>

     

       369
       -
                                   ${error.message}

     

       370
       -
                               </div>

     

       371
       -
                               <p>Try refreshing the page or visit 

     

       372
       -
                               <a href="https://github.com/taciturnaxolotl">github.com/taciturnaxolotl</a> directly.</p>

     

       373
       -
                           `;

     

       374
       -
               statusSpan.textContent = "Error loading README";

     

       375
       -
             }

     

       376
       -
           }

     

       377
       -
       

     

       378
       -
           function updateTime() {

     

       379
       -
             const now = new Date();

     

       380
       -
             const timeStr = now.toLocaleTimeString("en-US", {

     

       381
       -
               hour: "2-digit",

     

       382
       -
               minute: "2-digit",

     

       383
       -
               hour12: true,

     

       384
       -
             });

     

       385
       -
             document.getElementById("time").textContent = timeStr;

     

       386
       -
           }

     

       387
       -
       

     

       388
       -
           // Initialize

     

       389
       -
           updateTime();

     

       390
       -
           setInterval(updateTime, 1000);

     

       391
       -
           loadReadme();

     

       392
       -
         </script>

     

       393
       -
       </body>

     

       394
       -
       

     

       395
       -
       </html>

     

       396
       -
       

     

       397
       -
       </html>

     

       398
       -
       

     

       399
       -
       </html>

+28 -28

package.json

···

       1
        
       {

     

       2
       -
         "name": "thistle",

     

       3
       -
         "module": "src/index.ts",

     

       4
       -
         "type": "module",

     

       5
       -
         "private": true,

     

       6
       -
         "scripts": {

     

       7
       -
           "dev": "bun run src/index.ts --hot",

     

       8
       -
           "clean": "rm -rf transcripts uploads thistle.db",

     

       9
       -
           "test": "bun test",

     

       10
       -
           "test:integration": "bun test src/index.test.ts",

     

       11
       -
           "ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       -
         },

     

       13
       -
         "devDependencies": {

     

       14
       -
           "@biomejs/biome": "^2.3.2",

     

       15
       -
           "@simplewebauthn/types": "^12.0.0",

     

       16
       -
           "@types/bun": "latest"

     

       17
       -
         },

     

       18
       -
         "peerDependencies": {

     

       19
       -
           "typescript": "^5"

     

       20
       -
         },

     

       21
       -
         "dependencies": {

     

       22
       -
           "@polar-sh/sdk": "^0.41.5",

     

       23
       -
           "@simplewebauthn/browser": "^13.2.2",

     

       24
       -
           "@simplewebauthn/server": "^13.2.2",

     

       25
       -
           "eventsource-client": "^1.2.0",

     

       26
       -
           "lit": "^3.3.1",

     

       27
       -
           "nanoid": "^5.1.6",

     

       28
       -
           "ua-parser-js": "^2.0.6"

     

       29
       -
         }

     

       30
        
       }

···

       1
        
       {

     

       2
       +
       	"name": "thistle",

     

       3
       +
       	"module": "src/index.ts",

     

       4
       +
       	"type": "module",

     

       5
       +
       	"private": true,

     

       6
       +
       	"scripts": {

     

       7
       +
       		"dev": "bun run src/index.ts --hot",

     

       8
       +
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       +
       		"test": "NODE_ENV=test bun test",

     

       10
       +
       		"test:integration": "NODE_ENV=test bun test src/index.test.ts",

     

       11
       +
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       +
       	},

     

       13
       +
       	"devDependencies": {

     

       14
       +
       		"@biomejs/biome": "^2.3.2",

     

       15
       +
       		"@simplewebauthn/types": "^12.0.0",

     

       16
       +
       		"@types/bun": "latest"

     

       17
       +
       	},

     

       18
       +
       	"peerDependencies": {

     

       19
       +
       		"typescript": "^5"

     

       20
       +
       	},

     

       21
       +
       	"dependencies": {

     

       22
       +
       		"@polar-sh/sdk": "^0.41.5",

     

       23
       +
       		"@simplewebauthn/browser": "^13.2.2",

     

       24
       +
       		"@simplewebauthn/server": "^13.2.2",

     

       25
       +
       		"eventsource-client": "^1.2.0",

     

       26
       +
       		"lit": "^3.3.1",

     

       27
       +
       		"nanoid": "^5.1.6",

     

       28
       +
       		"ua-parser-js": "^2.0.6"

     

       29
       +
       	}

     

       30
        
       }

+19 -1

public/favicon/site.webmanifest

···

       1
       -
       {"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       {

     

       2
       +
       	"name": "",

     

       3
       +
       	"short_name": "",

     

       4
       +
       	"icons": [

     

       5
       +
       		{

     

       6
       +
       			"src": "/android-chrome-192x192.png",

     

       7
       +
       			"sizes": "192x192",

     

       8
       +
       			"type": "image/png"

     

       9
       +
       		},

     

       10
       +
       		{

     

       11
       +
       			"src": "/android-chrome-512x512.png",

     

       12
       +
       			"sizes": "512x512",

     

       13
       +
       			"type": "image/png"

     

       14
       +
       		}

     

       15
       +
       	],

     

       16
       +
       	"theme_color": "#ffffff",

     

       17
       +
       	"background_color": "#ffffff",

     

       18
       +
       	"display": "standalone"

     

       19
       +
       }

+17

scripts/clear-rate-limits.ts

···

       1
       +
       #!/usr/bin/env bun

     

       2
       +
       

     

       3
       +
       import db from "../src/db/schema";

     

       4
       +
       

     

       5
       +
       console.log("🧹 Clearing all rate limit attempts...");

     

       6
       +
       

     

       7
       +
       const result = db.run("DELETE FROM rate_limit_attempts");

     

       8
       +
       

     

       9
       +
       const deletedCount = result.changes;

     

       10
       +
       

     

       11
       +
       if (deletedCount === 0) {

     

       12
       +
       	console.log("ℹ️  No rate limit attempts to clear");

     

       13
       +
       } else {

     

       14
       +
       	console.log(

     

       15
       +
       		`✅ Successfully cleared ${deletedCount} rate limit attempt${deletedCount === 1 ? "" : "s"}`,

     

       16
       +
       	);

     

       17
       +
       }

+39

scripts/remove-from-classes.ts

···

       1
       +
       #!/usr/bin/env bun

     

       2
       +
       

     

       3
       +
       import db from "../src/db/schema";

     

       4
       +
       

     

       5
       +
       const email = process.argv[2];

     

       6
       +
       

     

       7
       +
       if (!email) {

     

       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       +
       	process.exit(1);

     

       11
       +
       }

     

       12
       +
       

     

       13
       +
       const user = db

     

       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       +
       	)

     

       17
       +
       	.get(email);

     

       18
       +
       

     

       19
       +
       if (!user) {

     

       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       +
       	process.exit(1);

     

       22
       +
       }

     

       23
       +
       

     

       24
       +
       // Get current enrollments

     

       25
       +
       const enrollments = db

     

       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       +
       	)

     

       29
       +
       	.all(user.id);

     

       30
       +
       

     

       31
       +
       if (enrollments.length === 0) {

     

       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       +
       	process.exit(0);

     

       34
       +
       }

     

       35
       +
       

     

       36
       +
       // Remove from all classes

     

       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       +
       

     

       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+1 -1

scripts/send-test-emails.ts

···

       5
        
       

     

       6
        
       import { sendEmail } from "../src/lib/email";

     

       7
        
       import {

     

       8
       -
       	verifyEmailTemplate,

     

       9
        
       	passwordResetTemplate,

     

       10
        
       	transcriptionCompleteTemplate,

     

       0
        
       
     

       11
        
       } from "../src/lib/email-templates";

     

       12
        
       

     

       13
        
       const targetEmail = process.argv[2];

···

       5
        
       

     

       6
        
       import { sendEmail } from "../src/lib/email";

     

       7
        
       import {

     

       0
        
       
     

       8
        
       	passwordResetTemplate,

     

       9
        
       	transcriptionCompleteTemplate,

     

       10
       +
       	verifyEmailTemplate,

     

       11
        
       } from "../src/lib/email-templates";

     

       12
        
       

     

       13
        
       const targetEmail = process.argv[2];

+227 -21

src/components/admin-classes.ts

···

       12
        
       	year: number;

     

       13
        
       	archived: boolean;

     

       14
        
       	created_at: number;

     

       0
        
       
     

       0
        
       
     

       15
        
       }

     

       16
        
       

     

       17
        
       interface WaitlistEntry {

     
···

       38
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       39
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       40
        
       	@state() showModal = false;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       41
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       0
        
       
     

       42
        
       	@state() editingClass = {

     

       43
        
       		courseCode: "",

     

       44
        
       		courseName: "",

     
···

       465
        
       

     

       466
        
       	override async connectedCallback() {

     

       467
        
       		super.connectedCallback();

     

       468
       -
       		

     

       469
        
       		// Check for subtab query parameter

     

       470
        
       		const params = new URLSearchParams(window.location.search);

     

       471
        
       		const subtab = params.get("subtab");

     
···

       475
        
       			// Set default subtab in URL if on classes tab

     

       476
        
       			this.setActiveTab(this.activeTab);

     

       477
        
       		}

     

       478
       -
       		

     

       479
        
       		await this.loadData();

     

       480
        
       	}

     

       481
        
       

     
···

       508
        
       			const classesData = await classesRes.json();

     

       509
        
       			const waitlistData = await waitlistRes.json();

     

       510
        
       

     

       511
       -
       			this.classes = classesData.classes || [];

     

       0
        
       
     

       0
        
       
     

       512
        
       			this.waitlist = waitlistData.waitlist || [];

     

       513
        
       		} catch {

     

       514
        
       			this.error = "Failed to load data. Please try again.";

     
···

       524
        
       	private async handleToggleArchive(classId: string) {

     

       525
        
       		try {

     

       526
        
       			// Find the class to toggle its archived state

     

       527
       -
       			const classToToggle = this.classes.find(c => c.id === classId);

     

       528
        
       			if (!classToToggle) return;

     

       529
        
       

     

       530
        
       			const response = await fetch(`/api/classes/${classId}/archive`, {

     
···

       538
        
       			}

     

       539
        
       

     

       540
        
       			// Update local state instead of reloading

     

       541
       -
       			this.classes = this.classes.map(c => 

     

       542
       -
       				c.id === classId ? { ...c, archived: !c.archived } : c

     

       543
        
       			);

     

       544
        
       		} catch {

     

       545
        
       			this.error = "Failed to update class. Please try again.";

     
···

       660
        
       		this.showModal = true;

     

       661
        
       	}

     

       662
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       663
        
       	private getFilteredClasses() {

     

       664
        
       		if (!this.searchTerm) return this.classes;

     

       665
        
       

     
···

       710
        
       			}

     

       711
        
       

     

       712
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       0
        
       
     

       713
        
           `;

     

       714
        
       	}

     

       715
        
       

     
···

       739
        
                 <div class="classes-grid">

     

       740
        
                   ${filteredClasses.map(

     

       741
        
       							(cls) => html`

     

       742
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       743
        
                       <div class="class-header">

     

       744
        
                         <div class="class-info">

     

       745
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       747
        
                           <div class="class-meta">

     

       748
        
                             <span>👤 ${cls.professor}</span>

     

       749
        
                             <span>📅 ${cls.semester} ${cls.year}</span>

     

       0
        
       
     

       0
        
       
     

       750
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       751
        
                           </div>

     

       752
        
                         </div>

     

       753
       -
                         <div class="actions">

     

       754
       -
                           <button

     

       755
       -
                             class="btn-archive"

     

       756
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       757
       -
                           >

     

       758
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       759
       -
                           </button>

     

       760
       -
                           <button

     

       761
       -
                             class="btn-delete"

     

       762
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       763
       -
                           >

     

       764
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       765
       -
                           </button>

     

       766
       -
                         </div>

     

       767
        
                       </div>

     

       768
        
                     </div>

     

       769
        
                   `,

     
···

       774
        
           `;

     

       775
        
       	}

     

       776
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       777
        
       	private renderWaitlist() {

     

       778
        
       		return html`

     

       779
        
             ${

     
···

       859
        
       		this.meetingTimes = e.detail;

     

       860
        
       	}

     

       861
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       862
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       863
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       864
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       868
        
       		this.showModal = false;

     

       869
        
       		this.approvingEntry = null;

     

       870
        
       		this.meetingTimes = [];

     

       0
        
       
     

       871
        
       		this.editingClass = {

     

       872
        
       			courseCode: "",

     

       873
        
       			courseName: "",

     
···

       897
        
       					semester: this.editingClass.semester,

     

       898
        
       					year: this.editingClass.year,

     

       899
        
       					meeting_times: labels,

     

       0
        
       
     

       900
        
       				}),

     

       901
        
       			});

     

       902
        
       

     
···

       1012
        
                       .value=${this.meetingTimes}

     

       1013
        
                       @change=${this.handleMeetingTimesChange}

     

       1014
        
                     ></meeting-time-picker>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1015
        
                   </div>

     

       1016
        
                 </div>

     

       1017

···

       12
        
       	year: number;

     

       13
        
       	archived: boolean;

     

       14
        
       	created_at: number;

     

       15
       +
       	student_count?: number;

     

       16
       +
       	transcript_count?: number;

     

       17
        
       }

     

       18
        
       

     

       19
        
       interface WaitlistEntry {

     
···

       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       42
        
       	@state() showModal = false;

     

       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       +
       	@state() newSectionNumber = "";

     

       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       +
       	@state() sections: string[] = [];

     

       50
        
       	@state() editingClass = {

     

       51
        
       		courseCode: "",

     

       52
        
       		courseName: "",

     
···

       473
        
       

     

       474
        
       	override async connectedCallback() {

     

       475
        
       		super.connectedCallback();

     

       476
       +
       

     

       477
        
       		// Check for subtab query parameter

     

       478
        
       		const params = new URLSearchParams(window.location.search);

     

       479
        
       		const subtab = params.get("subtab");

     
···

       483
        
       			// Set default subtab in URL if on classes tab

     

       484
        
       			this.setActiveTab(this.activeTab);

     

       485
        
       		}

     

       486
       +
       

     

       487
        
       		await this.loadData();

     

       488
        
       	}

     

       489
        
       

     
···

       516
        
       			const classesData = await classesRes.json();

     

       517
        
       			const waitlistData = await waitlistRes.json();

     

       518
        
       

     

       519
       +
       			// Flatten grouped classes into array

     

       520
       +
       			const groupedClasses = classesData.classes || {};

     

       521
       +
       			this.classes = Object.values(groupedClasses).flat();

     

       522
        
       			this.waitlist = waitlistData.waitlist || [];

     

       523
        
       		} catch {

     

       524
        
       			this.error = "Failed to load data. Please try again.";

     
···

       534
        
       	private async handleToggleArchive(classId: string) {

     

       535
        
       		try {

     

       536
        
       			// Find the class to toggle its archived state

     

       537
       +
       			const classToToggle = this.classes.find((c) => c.id === classId);

     

       538
        
       			if (!classToToggle) return;

     

       539
        
       

     

       540
        
       			const response = await fetch(`/api/classes/${classId}/archive`, {

     
···

       548
        
       			}

     

       549
        
       

     

       550
        
       			// Update local state instead of reloading

     

       551
       +
       			this.classes = this.classes.map((c) =>

     

       552
       +
       				c.id === classId ? { ...c, archived: !c.archived } : c,

     

       553
        
       			);

     

       554
        
       		} catch {

     

       555
        
       			this.error = "Failed to update class. Please try again.";

     
···

       670
        
       		this.showModal = true;

     

       671
        
       	}

     

       672
        
       

     

       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       +
       		try {

     

       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       +
       			

     

       678
       +
       			const data = await response.json();

     

       679
       +
       			this.editingClassId = classId;

     

       680
       +
       			this.editingClassInfo = data.class;

     

       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       +
       			this.newSectionNumber = "";

     

       683
       +
       			this.showClassSettingsModal = true;

     

       684
       +
       		} catch {

     

       685
       +
       			this.error = "Failed to load class details";

     

       686
       +
       		}

     

       687
       +
       	}

     

       688
       +
       

     

       689
       +
       	private async handleAddSection() {

     

       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       +
       

     

       692
       +
       		try {

     

       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       +
       				method: "POST",

     

       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       +
       			});

     

       698
       +
       

     

       699
       +
       			if (!response.ok) {

     

       700
       +
       				const data = await response.json();

     

       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       +
       				return;

     

       703
       +
       			}

     

       704
       +
       

     

       705
       +
       			const newSection = await response.json();

     

       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       +
       			this.newSectionNumber = "";

     

       708
       +
       		} catch {

     

       709
       +
       			this.error = "Failed to add section";

     

       710
       +
       		}

     

       711
       +
       	}

     

       712
       +
       

     

       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       +
       		if (!this.editingClassId) return;

     

       715
       +
       

     

       716
       +
       		try {

     

       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       +
       				method: "DELETE",

     

       719
       +
       			});

     

       720
       +
       

     

       721
       +
       			if (!response.ok) {

     

       722
       +
       				const data = await response.json();

     

       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       +
       				return;

     

       725
       +
       			}

     

       726
       +
       

     

       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       +
       		} catch {

     

       729
       +
       			this.error = "Failed to delete section";

     

       730
       +
       		}

     

       731
       +
       	}

     

       732
       +
       

     

       733
       +
       	private handleCloseSectionsModal() {

     

       734
       +
       		this.showClassSettingsModal = false;

     

       735
       +
       		this.editingClassId = null;

     

       736
       +
       		this.editingClassInfo = null;

     

       737
       +
       		this.editingClassSections = [];

     

       738
       +
       		this.newSectionNumber = "";

     

       739
       +
       		this.loadData();

     

       740
       +
       	}

     

       741
       +
       

     

       742
       +
       

     

       743
        
       	private getFilteredClasses() {

     

       744
        
       		if (!this.searchTerm) return this.classes;

     

       745
        
       

     
···

       790
        
       			}

     

       791
        
       

     

       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       794
        
           `;

     

       795
        
       	}

     

       796
        
       

     
···

       820
        
                 <div class="classes-grid">

     

       821
        
                   ${filteredClasses.map(

     

       822
        
       							(cls) => html`

     

       823
       +
                     <div 

     

       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       +
                       style="cursor: pointer;"

     

       827
       +
                     >

     

       828
        
                       <div class="class-header">

     

       829
        
                         <div class="class-info">

     

       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       832
        
                           <div class="class-meta">

     

       833
        
                             <span>👤 ${cls.professor}</span>

     

       834
        
                             <span>📅 ${cls.semester} ${cls.year}</span>

     

       835
       +
                             <span>👥 ${cls.student_count || 0} students</span>

     

       836
       +
                             <span>📄 ${cls.transcript_count || 0} transcripts</span>

     

       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       838
        
                           </div>

     

       839
        
                         </div>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       840
        
                       </div>

     

       841
        
                     </div>

     

       842
        
                   `,

     
···

       847
        
           `;

     

       848
        
       	}

     

       849
        
       

     

       850
       +
       	private renderClassSettingsModal() {

     

       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       +
       

     

       853
       +
       		return html`

     

       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       +
                 <div class="modal-header">

     

       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       +
                 </div>

     

       860
       +
       

     

       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       +
                     <button

     

       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       +
                     >

     

       866
       +
                       Sections

     

       867
       +
                     </button>

     

       868
       +
                   </div>

     

       869
       +
                 </div>

     

       870
       +
       

     

       871
       +
                 <!-- Sections Tab -->

     

       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       +
                   

     

       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       +
                     <input

     

       877
       +
                       type="text"

     

       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       +
                       .value=${this.newSectionNumber}

     

       880
       +
                       @input=${(e: Event) => {

     

       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       +
       								}}

     

       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       +
       									if (e.key === "Enter") {

     

       885
       +
       										e.preventDefault();

     

       886
       +
       										this.handleAddSection();

     

       887
       +
       									}

     

       888
       +
       								}}

     

       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       +
                     />

     

       891
       +
                     <button

     

       892
       +
                       @click=${this.handleAddSection}

     

       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       +
                     >

     

       896
       +
                       Add Section

     

       897
       +
                     </button>

     

       898
       +
                   </div>

     

       899
       +
       

     

       900
       +
                   ${

     

       901
       +
       							this.editingClassSections.length === 0

     

       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       +
       								: html`

     

       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       +
                         ${this.editingClassSections.map(

     

       906
       +
       										(section) => html`

     

       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       +
                             <button

     

       910
       +
                               @click=${(e: Event) => {

     

       911
       +
       													e.stopPropagation();

     

       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       +
       												}}

     

       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       +
                             >

     

       916
       +
                               Delete

     

       917
       +
                             </button>

     

       918
       +
                           </div>

     

       919
       +
                         `,

     

       920
       +
       									)}

     

       921
       +
                       </div>

     

       922
       +
                     `

     

       923
       +
       						}

     

       924
       +
                 </div>

     

       925
       +
       

     

       926
       +
                 <!-- Actions -->

     

       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       +
                     <button

     

       930
       +
                       @click=${(e: Event) => {

     

       931
       +
       									e.stopPropagation();

     

       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       +
       									this.handleCloseSectionsModal();

     

       934
       +
       								}}

     

       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       +
                     >

     

       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       +
                     </button>

     

       939
       +
                     <button

     

       940
       +
                       @click=${(e: Event) => {

     

       941
       +
       									e.stopPropagation();

     

       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       +
       								}}

     

       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       +
                     >

     

       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       +
                     </button>

     

       948
       +
                   </div>

     

       949
       +
                   <button

     

       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       +
                   >

     

       953
       +
                     Done

     

       954
       +
                   </button>

     

       955
       +
                 </div>

     

       956
       +
       

     

       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       +
               </div>

     

       959
       +
             </div>

     

       960
       +
           `;

     

       961
       +
       	}

     

       962
       +
       

     

       963
        
       	private renderWaitlist() {

     

       964
        
       		return html`

     

       965
        
             ${

     
···

       1045
        
       		this.meetingTimes = e.detail;

     

       1046
        
       	}

     

       1047
        
       

     

       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       +
       		this.sections = value

     

       1051
       +
       			.split(",")

     

       1052
       +
       			.map((s) => s.trim())

     

       1053
       +
       			.filter((s) => s);

     

       1054
       +
       	}

     

       1055
       +
       

     

       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       1062
        
       		this.showModal = false;

     

       1063
        
       		this.approvingEntry = null;

     

       1064
        
       		this.meetingTimes = [];

     

       1065
       +
       		this.sections = [];

     

       1066
        
       		this.editingClass = {

     

       1067
        
       			courseCode: "",

     

       1068
        
       			courseName: "",

     
···

       1092
        
       					semester: this.editingClass.semester,

     

       1093
        
       					year: this.editingClass.year,

     

       1094
        
       					meeting_times: labels,

     

       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       1096
        
       				}),

     

       1097
        
       			});

     

       1098
        
       

     
···

       1208
        
                       .value=${this.meetingTimes}

     

       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       1210
        
                     ></meeting-time-picker>

     

       1211
       +
                   </div>

     

       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       +
                     <input

     

       1215
       +
                       type="text"

     

       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       +
                     />

     

       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       1221
        
                   </div>

     

       1222
        
                 </div>

     

       1223

+19 -10

src/components/admin-pending-recordings.ts

···

       246
        
       		this.isLoading = true;

     

       247
        
       		this.error = null;

     

       248
        
       

     

       249
       -
       			try {

     

       250
       -
       				// Get all classes with their transcriptions

     

       251
       -
       				const response = await fetch("/api/classes");

     

       252
       -
       				if (!response.ok) {

     

       253
       -
       					const data = await response.json();

     

       254
       -
       					throw new Error(data.error || "Failed to load classes");

     

       255
       -
       				}

     

       256
        
       

     

       257
        
       			const data = await response.json();

     

       258
        
       			const classesGrouped = data.classes || {};

     
···

       317
        
       

     

       318
        
       			this.recordings = pendingRecordings;

     

       319
        
       		} catch (err) {

     

       320
       -
       			this.error = err instanceof Error ? err.message : "Failed to load pending recordings. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       321
        
       		} finally {

     

       322
        
       			this.isLoading = false;

     

       323
        
       		}

     
···

       338
        
       			// Reload recordings

     

       339
        
       			await this.loadRecordings();

     

       340
        
       		} catch (err) {

     

       341
       -
       			this.error = err instanceof Error ? err.message : "Failed to approve recording. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       342
        
       		}

     

       343
        
       	}

     

       344
        
       

     
···

       365
        
       			// Reload recordings

     

       366
        
       			await this.loadRecordings();

     

       367
        
       		} catch (err) {

     

       368
       -
       			this.error = err instanceof Error ? err.message : "Failed to delete recording. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       369
        
       		}

     

       370
        
       	}

     

       371

···

       246
        
       		this.isLoading = true;

     

       247
        
       		this.error = null;

     

       248
        
       

     

       249
       +
       		try {

     

       250
       +
       			// Get all classes with their transcriptions

     

       251
       +
       			const response = await fetch("/api/classes");

     

       252
       +
       			if (!response.ok) {

     

       253
       +
       				const data = await response.json();

     

       254
       +
       				throw new Error(data.error || "Failed to load classes");

     

       255
       +
       			}

     

       256
        
       

     

       257
        
       			const data = await response.json();

     

       258
        
       			const classesGrouped = data.classes || {};

     
···

       317
        
       

     

       318
        
       			this.recordings = pendingRecordings;

     

       319
        
       		} catch (err) {

     

       320
       +
       			this.error =

     

       321
       +
       				err instanceof Error

     

       322
       +
       					? err.message

     

       323
       +
       					: "Failed to load pending recordings. Please try again.";

     

       324
        
       		} finally {

     

       325
        
       			this.isLoading = false;

     

       326
        
       		}

     
···

       341
        
       			// Reload recordings

     

       342
        
       			await this.loadRecordings();

     

       343
        
       		} catch (err) {

     

       344
       +
       			this.error =

     

       345
       +
       				err instanceof Error

     

       346
       +
       					? err.message

     

       347
       +
       					: "Failed to approve recording. Please try again.";

     

       348
        
       		}

     

       349
        
       	}

     

       350
        
       

     
···

       371
        
       			// Reload recordings

     

       372
        
       			await this.loadRecordings();

     

       373
        
       		} catch (err) {

     

       374
       +
       			this.error =

     

       375
       +
       				err instanceof Error

     

       376
       +
       					? err.message

     

       377
       +
       					: "Failed to delete recording. Please try again.";

     

       378
        
       		}

     

       379
        
       	}

     

       380

+10 -3

src/components/admin-transcriptions.ts

···

       194
        
       				throw new Error(data.error || "Failed to load transcriptions");

     

       195
        
       			}

     

       196
        
       

     

       197
       -
       			this.transcriptions = await response.json();

     

       0
        
       
     

       198
        
       		} catch (err) {

     

       199
       -
       			this.error = err instanceof Error ? err.message : "Failed to load transcriptions. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       200
        
       		} finally {

     

       201
        
       			this.isLoading = false;

     

       202
        
       		}

     
···

       228
        
       			await this.loadTranscriptions();

     

       229
        
       			this.dispatchEvent(new CustomEvent("transcription-deleted"));

     

       230
        
       		} catch (err) {

     

       231
       -
       			this.error = err instanceof Error ? err.message : "Failed to delete transcription. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       232
        
       		}

     

       233
        
       	}

     

       234

···

       194
        
       				throw new Error(data.error || "Failed to load transcriptions");

     

       195
        
       			}

     

       196
        
       

     

       197
       +
       			const result = await response.json();

     

       198
       +
       			this.transcriptions = result.data || result;

     

       199
        
       		} catch (err) {

     

       200
       +
       			this.error =

     

       201
       +
       				err instanceof Error

     

       202
       +
       					? err.message

     

       203
       +
       					: "Failed to load transcriptions. Please try again.";

     

       204
        
       		} finally {

     

       205
        
       			this.isLoading = false;

     

       206
        
       		}

     
···

       232
        
       			await this.loadTranscriptions();

     

       233
        
       			this.dispatchEvent(new CustomEvent("transcription-deleted"));

     

       234
        
       		} catch (err) {

     

       235
       +
       			this.error =

     

       236
       +
       				err instanceof Error

     

       237
       +
       					? err.message

     

       238
       +
       					: "Failed to delete transcription. Please try again.";

     

       239
        
       		}

     

       240
        
       	}

     

       241

+66 -31

src/components/admin-users.ts

···

       324
        
       				throw new Error(data.error || "Failed to load users");

     

       325
        
       			}

     

       326
        
       

     

       327
       -
       			this.users = await response.json();

     

       0
        
       
     

       328
        
       		} catch (err) {

     

       329
       -
       			this.error = err instanceof Error ? err.message : "Failed to load users. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       330
        
       		} finally {

     

       331
        
       			this.isLoading = false;

     

       332
        
       		}

     
···

       389
        
       				await this.loadUsers();

     

       390
        
       			}

     

       391
        
       		} catch (err) {

     

       392
       -
       			this.error = err instanceof Error ? err.message : "Failed to update user role";

     

       0
        
       
     

       393
        
       			select.value = oldRole;

     

       394
        
       		}

     

       395
        
       	}

     
···

       460
        
       			}

     

       461
        
       

     

       462
        
       			// Remove user from local array instead of reloading

     

       463
       -
       			this.users = this.users.filter(u => u.id !== userId);

     

       464
        
       			this.dispatchEvent(new CustomEvent("user-deleted"));

     

       465
        
       		} catch (err) {

     

       466
       -
       			this.error = err instanceof Error ? err.message : "Failed to delete user. Please try again.";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       467
        
       		}

     

       468
        
       	}

     

       469
        
       

     

       470
       -
       	private handleRevokeClick(userId: number, email: string, subscriptionId: string, event: Event) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       471
        
       		event.stopPropagation();

     

       472
        
       

     

       473
        
       		// If this is a different item or timeout expired, reset

     
···

       510
        
       			this.deleteState = null;

     

       511
        
       		}, 1000);

     

       512
        
       

     

       513
       -
       		this.deleteState = { id: userId, type: "revoke", clicks: newClicks, timeout };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       514
        
       	}

     

       515
        
       

     

       516
       -
       	private async performRevokeSubscription(userId: number, _email: string, subscriptionId: string) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       517
        
       		this.revokingSubscriptions.add(userId);

     

       518
        
       		this.requestUpdate();

     

       519
        
       		this.error = null;

     
···

       532
        
       

     

       533
        
       			await this.loadUsers();

     

       534
        
       		} catch (err) {

     

       535
       -
       			this.error = err instanceof Error ? err.message : "Failed to revoke subscription";

     

       0
        
       
     

       536
        
       			this.revokingSubscriptions.delete(userId);

     

       537
        
       		}

     

       538
        
       	}

     
···

       591
        
       		if (userId === 0) {

     

       592
        
       			return;

     

       593
        
       		}

     

       594
       -
       		

     

       595
        
       		// Don't open modal if clicking on delete button, revoke button, sync button, or role select

     

       596
        
       		if (

     

       597
        
       			(event.target as HTMLElement).closest(".delete-btn") ||

     
···

       616
        
       

     

       617
        
       	private get filteredUsers() {

     

       618
        
       		const query = this.searchQuery.toLowerCase();

     

       619
       -
       		

     

       620
        
       		// Filter users based on search query

     

       621
        
       		let filtered = this.users.filter(

     

       622
        
       			(u) =>

     

       623
        
       				u.email.toLowerCase().includes(query) ||

     

       624
        
       				u.name?.toLowerCase().includes(query),

     

       625
        
       		);

     

       626
       -
       		

     

       627
        
       		// Hide ghost user unless specifically searched for

     

       628
       -
       		if (!query.includes("deleted") && !query.includes("ghost") && !query.includes("system")) {

     

       629
       -
       			filtered = filtered.filter(u => u.id !== 0);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       630
        
       		}

     

       631
       -
       		

     

       632
        
       		return filtered;

     

       633
        
       	}

     

       634
        
       

     
···

       666
        
                 <div class="users-grid">

     

       667
        
                   ${filtered.map(

     

       668
        
       							(u) => html`

     

       669
       -
                     <div class="user-card ${u.id === 0 ? 'system' : ''}" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       670
        
                       <div class="card-header">

     

       671
        
                         <div class="user-info">

     

       672
        
                           <img

     
···

       679
        
                             <div class="user-email">${u.email}</div>

     

       680
        
                           </div>

     

       681
        
                         </div>

     

       682
       -
                         ${u.id === 0 

     

       683
       -
                           ? html`<span class="system-badge">System</span>` 

     

       684
       -
                           : u.role === "admin" 

     

       685
       -
                             ? html`<span class="admin-badge">Admin</span>` 

     

       686
       -
                             : ""

     

       687
       -
                         }

     

       0
        
       
     

       688
        
                       </div>

     

       689
        
       

     

       690
        
                       <div class="meta-row">

     
···

       695
        
                         <div class="meta-item">

     

       696
        
                           <div class="meta-label">Subscription</div>

     

       697
        
                           <div class="meta-value">

     

       698
       -
                             ${u.subscription_status 

     

       699
       -
                               ? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>` 

     

       700
       -
                               : html`<span class="subscription-badge none">None</span>`

     

       701
       -
                             }

     

       0
        
       
     

       702
        
                           </div>

     

       703
        
                         </div>

     

       704
        
                         <div class="meta-item">

     
···

       716
        
                       </div>

     

       717
        
       

     

       718
        
                       <div class="actions">

     

       719
       -
                         ${u.id === 0 

     

       720
       -
                           ? html`<div style="color: var(--paynes-gray); font-size: 0.875rem; padding: 0.5rem;">System account cannot be modified</div>`

     

       721
       -
                           : html`

     

       0
        
       
     

       722
        
                             <select

     

       723
        
                               class="role-select"

     

       724
        
                               .value=${u.role}

     
···

       740
        
                               ?disabled=${!u.subscription_status || !u.subscription_id || this.revokingSubscriptions.has(u.id)}

     

       741
        
                               @click=${(e: Event) => {

     

       742
        
       													if (u.subscription_id) {

     

       743
       -
       														this.handleRevokeClick(u.id, u.email, u.subscription_id, e);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       744
        
       													}

     

       745
        
       												}}

     

       746
        
                             >

     
···

       750
        
                               ${this.getDeleteButtonText(u.id, "user")}

     

       751
        
                             </button>

     

       752
        
                           `

     

       753
       -
                         }

     

       754
        
                       </div>

     

       755
        
                     </div>

     

       756
        
                   `,

···

       324
        
       				throw new Error(data.error || "Failed to load users");

     

       325
        
       			}

     

       326
        
       

     

       327
       +
       			const result = await response.json();

     

       328
       +
       			this.users = result.data || result;

     

       329
        
       		} catch (err) {

     

       330
       +
       			this.error =

     

       331
       +
       				err instanceof Error

     

       332
       +
       					? err.message

     

       333
       +
       					: "Failed to load users. Please try again.";

     

       334
        
       		} finally {

     

       335
        
       			this.isLoading = false;

     

       336
        
       		}

     
···

       393
        
       				await this.loadUsers();

     

       394
        
       			}

     

       395
        
       		} catch (err) {

     

       396
       +
       			this.error =

     

       397
       +
       				err instanceof Error ? err.message : "Failed to update user role";

     

       398
        
       			select.value = oldRole;

     

       399
        
       		}

     

       400
        
       	}

     
···

       465
        
       			}

     

       466
        
       

     

       467
        
       			// Remove user from local array instead of reloading

     

       468
       +
       			this.users = this.users.filter((u) => u.id !== userId);

     

       469
        
       			this.dispatchEvent(new CustomEvent("user-deleted"));

     

       470
        
       		} catch (err) {

     

       471
       +
       			this.error =

     

       472
       +
       				err instanceof Error

     

       473
       +
       					? err.message

     

       474
       +
       					: "Failed to delete user. Please try again.";

     

       475
        
       		}

     

       476
        
       	}

     

       477
        
       

     

       478
       +
       	private handleRevokeClick(

     

       479
       +
       		userId: number,

     

       480
       +
       		email: string,

     

       481
       +
       		subscriptionId: string,

     

       482
       +
       		event: Event,

     

       483
       +
       	) {

     

       484
        
       		event.stopPropagation();

     

       485
        
       

     

       486
        
       		// If this is a different item or timeout expired, reset

     
···

       523
        
       			this.deleteState = null;

     

       524
        
       		}, 1000);

     

       525
        
       

     

       526
       +
       		this.deleteState = {

     

       527
       +
       			id: userId,

     

       528
       +
       			type: "revoke",

     

       529
       +
       			clicks: newClicks,

     

       530
       +
       			timeout,

     

       531
       +
       		};

     

       532
        
       	}

     

       533
        
       

     

       534
       +
       	private async performRevokeSubscription(

     

       535
       +
       		userId: number,

     

       536
       +
       		_email: string,

     

       537
       +
       		subscriptionId: string,

     

       538
       +
       	) {

     

       539
        
       		this.revokingSubscriptions.add(userId);

     

       540
        
       		this.requestUpdate();

     

       541
        
       		this.error = null;

     
···

       554
        
       

     

       555
        
       			await this.loadUsers();

     

       556
        
       		} catch (err) {

     

       557
       +
       			this.error =

     

       558
       +
       				err instanceof Error ? err.message : "Failed to revoke subscription";

     

       559
        
       			this.revokingSubscriptions.delete(userId);

     

       560
        
       		}

     

       561
        
       	}

     
···

       614
        
       		if (userId === 0) {

     

       615
        
       			return;

     

       616
        
       		}

     

       617
       +
       

     

       618
        
       		// Don't open modal if clicking on delete button, revoke button, sync button, or role select

     

       619
        
       		if (

     

       620
        
       			(event.target as HTMLElement).closest(".delete-btn") ||

     
···

       639
        
       

     

       640
        
       	private get filteredUsers() {

     

       641
        
       		const query = this.searchQuery.toLowerCase();

     

       642
       +
       

     

       643
        
       		// Filter users based on search query

     

       644
        
       		let filtered = this.users.filter(

     

       645
        
       			(u) =>

     

       646
        
       				u.email.toLowerCase().includes(query) ||

     

       647
        
       				u.name?.toLowerCase().includes(query),

     

       648
        
       		);

     

       649
       +
       

     

       650
        
       		// Hide ghost user unless specifically searched for

     

       651
       +
       		if (

     

       652
       +
       			!query.includes("deleted") &&

     

       653
       +
       			!query.includes("ghost") &&

     

       654
       +
       			!query.includes("system")

     

       655
       +
       		) {

     

       656
       +
       			filtered = filtered.filter((u) => u.id !== 0);

     

       657
        
       		}

     

       658
       +
       

     

       659
        
       		return filtered;

     

       660
        
       	}

     

       661
        
       

     
···

       693
        
                 <div class="users-grid">

     

       694
        
                   ${filtered.map(

     

       695
        
       							(u) => html`

     

       696
       +
                     <div class="user-card ${u.id === 0 ? "system" : ""}" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       697
        
                       <div class="card-header">

     

       698
        
                         <div class="user-info">

     

       699
        
                           <img

     
···

       706
        
                             <div class="user-email">${u.email}</div>

     

       707
        
                           </div>

     

       708
        
                         </div>

     

       709
       +
                         ${

     

       710
       +
       										u.id === 0

     

       711
       +
       											? html`<span class="system-badge">System</span>`

     

       712
       +
       											: u.role === "admin"

     

       713
       +
       												? html`<span class="admin-badge">Admin</span>`

     

       714
       +
       												: ""

     

       715
       +
       									}

     

       716
        
                       </div>

     

       717
        
       

     

       718
        
                       <div class="meta-row">

     
···

       723
        
                         <div class="meta-item">

     

       724
        
                           <div class="meta-label">Subscription</div>

     

       725
        
                           <div class="meta-value">

     

       726
       +
                             ${

     

       727
       +
       												u.subscription_status

     

       728
       +
       													? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>`

     

       729
       +
       													: html`<span class="subscription-badge none">None</span>`

     

       730
       +
       											}

     

       731
        
                           </div>

     

       732
        
                         </div>

     

       733
        
                         <div class="meta-item">

     
···

       745
        
                       </div>

     

       746
        
       

     

       747
        
                       <div class="actions">

     

       748
       +
                         ${

     

       749
       +
       										u.id === 0

     

       750
       +
       											? html`<div style="color: var(--paynes-gray); font-size: 0.875rem; padding: 0.5rem;">System account cannot be modified</div>`

     

       751
       +
       											: html`

     

       752
        
                             <select

     

       753
        
                               class="role-select"

     

       754
        
                               .value=${u.role}

     
···

       770
        
                               ?disabled=${!u.subscription_status || !u.subscription_id || this.revokingSubscriptions.has(u.id)}

     

       771
        
                               @click=${(e: Event) => {

     

       772
        
       													if (u.subscription_id) {

     

       773
       +
       														this.handleRevokeClick(

     

       774
       +
       															u.id,

     

       775
       +
       															u.email,

     

       776
       +
       															u.subscription_id,

     

       777
       +
       															e,

     

       778
       +
       														);

     

       779
        
       													}

     

       780
        
       												}}

     

       781
        
                             >

     
···

       785
        
                               ${this.getDeleteButtonText(u.id, "user")}

     

       786
        
                             </button>

     

       787
        
                           `

     

       788
       +
       									}

     

       789
        
                       </div>

     

       790
        
                     </div>

     

       791
        
                   `,

+10 -10

src/components/auth.ts

···

       440
        
       				}

     

       441
        
       

     

       442
        
       				const data = await response.json();

     

       443
       -
       				

     

       444
        
       				if (data.email_verification_required) {

     

       445
        
       					this.needsEmailVerification = true;

     

       446
        
       					this.password = "";

     
···

       478
        
       				}

     

       479
        
       

     

       480
        
       				const data = await response.json();

     

       481
       -
       				

     

       482
        
       				if (data.email_verification_required) {

     

       483
        
       					this.needsEmailVerification = true;

     

       484
        
       					this.password = "";

     
···

       608
        
       	private startResendTimer(sentAtTimestamp: number) {

     

       609
        
       		// Use provided timestamp

     

       610
        
       		this.codeSentAt = sentAtTimestamp;

     

       611
       -
       		

     

       612
        
       		// Clear existing interval if any

     

       613
        
       		if (this.resendInterval !== null) {

     

       614
        
       			clearInterval(this.resendInterval);

     

       615
        
       		}

     

       616
       -
       		

     

       617
        
       		// Update timer based on elapsed time

     

       618
        
       		const updateTimer = () => {

     

       619
        
       			if (this.codeSentAt === null) return;

     

       620
       -
       			

     

       621
        
       			const now = Math.floor(Date.now() / 1000);

     

       622
        
       			const elapsed = now - this.codeSentAt;

     

       623
       -
       			const remaining = Math.max(0, (5 * 60) - elapsed);

     

       624
        
       			this.resendCodeTimer = remaining;

     

       625
       -
       			

     

       626
        
       			if (remaining <= 0) {

     

       627
        
       				if (this.resendInterval !== null) {

     

       628
        
       					clearInterval(this.resendInterval);

     
···

       630
        
       				}

     

       631
        
       			}

     

       632
        
       		};

     

       633
       -
       		

     

       634
        
       		// Update immediately

     

       635
        
       		updateTimer();

     

       636
       -
       		

     

       637
        
       		// Then update every second

     

       638
        
       		this.resendInterval = window.setInterval(updateTimer, 1000);

     

       639
        
       	}

     
···

       671
        
       	private formatTimer(seconds: number): string {

     

       672
        
       		const mins = Math.floor(seconds / 60);

     

       673
        
       		const secs = seconds % 60;

     

       674
       -
       		return `${mins}:${secs.toString().padStart(2, '0')}`;

     

       675
        
       	}

     

       676
        
       

     

       677
        
       	override disconnectedCallback() {

···

       440
        
       				}

     

       441
        
       

     

       442
        
       				const data = await response.json();

     

       443
       +
       

     

       444
        
       				if (data.email_verification_required) {

     

       445
        
       					this.needsEmailVerification = true;

     

       446
        
       					this.password = "";

     
···

       478
        
       				}

     

       479
        
       

     

       480
        
       				const data = await response.json();

     

       481
       +
       

     

       482
        
       				if (data.email_verification_required) {

     

       483
        
       					this.needsEmailVerification = true;

     

       484
        
       					this.password = "";

     
···

       608
        
       	private startResendTimer(sentAtTimestamp: number) {

     

       609
        
       		// Use provided timestamp

     

       610
        
       		this.codeSentAt = sentAtTimestamp;

     

       611
       +
       

     

       612
        
       		// Clear existing interval if any

     

       613
        
       		if (this.resendInterval !== null) {

     

       614
        
       			clearInterval(this.resendInterval);

     

       615
        
       		}

     

       616
       +
       

     

       617
        
       		// Update timer based on elapsed time

     

       618
        
       		const updateTimer = () => {

     

       619
        
       			if (this.codeSentAt === null) return;

     

       620
       +
       

     

       621
        
       			const now = Math.floor(Date.now() / 1000);

     

       622
        
       			const elapsed = now - this.codeSentAt;

     

       623
       +
       			const remaining = Math.max(0, 5 * 60 - elapsed);

     

       624
        
       			this.resendCodeTimer = remaining;

     

       625
       +
       

     

       626
        
       			if (remaining <= 0) {

     

       627
        
       				if (this.resendInterval !== null) {

     

       628
        
       					clearInterval(this.resendInterval);

     
···

       630
        
       				}

     

       631
        
       			}

     

       632
        
       		};

     

       633
       +
       

     

       634
        
       		// Update immediately

     

       635
        
       		updateTimer();

     

       636
       +
       

     

       637
        
       		// Then update every second

     

       638
        
       		this.resendInterval = window.setInterval(updateTimer, 1000);

     

       639
        
       	}

     
···

       671
        
       	private formatTimer(seconds: number): string {

     

       672
        
       		const mins = Math.floor(seconds / 60);

     

       673
        
       		const secs = seconds % 60;

     

       674
       +
       		return `${mins}:${secs.toString().padStart(2, "0")}`;

     

       675
        
       	}

     

       676
        
       

     

       677
        
       	override disconnectedCallback() {

+123 -13

src/components/class-view.ts

···

       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
        
       import "./upload-recording-modal.ts";

     

       4
        
       import "./vtt-viewer.ts";

     

       0
        
       
     

       5
        
       

     

       6
        
       interface Class {

     

       7
        
       	id: string;

     
···

       24
        
       	id: string;

     

       25
        
       	user_id: number;

     

       26
        
       	meeting_time_id: string | null;

     

       0
        
       
     

       27
        
       	filename: string;

     

       28
        
       	original_filename: string;

     

       29
        
       	status:

     
···

       42
        
       	audioUrl?: string;

     

       43
        
       }

     

       44
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       45
        
       @customElement("class-view")

     

       46
        
       export class ClassView extends LitElement {

     

       47
        
       	@state() classId = "";

     

       48
        
       	@state() classInfo: Class | null = null;

     

       49
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       50
        
       	@state() transcriptions: Transcription[] = [];

     

       51
        
       	@state() isLoading = true;

     

       52
        
       	@state() error: string | null = null;

     
···

       363
        
       			const data = await response.json();

     

       364
        
       			this.classInfo = data.class;

     

       365
        
       			this.meetingTimes = data.meetingTimes || [];

     

       0
        
       
     

       0
        
       
     

       366
        
       			this.transcriptions = data.transcriptions || [];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       367
        
       

     

       368
        
       			// Load VTT for completed transcriptions

     

       369
        
       			await this.loadVTTForCompleted();

     
···

       450
        
       	}

     

       451
        
       

     

       452
        
       	private get filteredTranscriptions() {

     

       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       454
        
       

     

       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       -
       		);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       459
        
       	}

     

       460
        
       

     

       461
        
       	private formatDate(timestamp: number): string {

     
···

       521
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
        
                   <h1>${this.classInfo.name}</h1>

     

       523
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       525
        
                 </div>

     

       526
        
               </div>

     

       527
        
       

     
···

       538
        
       						: ""

     

       539
        
       				}

     

       540
        
       

     

       541
       -
               ${!canAccessTranscriptions ? html`

     

       0
        
       
     

       0
        
       
     

       542
        
                 <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin: 2rem 0; text-align: center;">

     

       543
        
                   <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Access Recordings</h3>

     

       544
        
                   <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and view transcriptions.</p>

     

       545
        
                   <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       546
        
                 </div>

     

       547
       -
               ` : html`

     

       0
        
       
     

       548
        
               <div class="search-upload">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       549
        
                 <input

     

       550
        
                   type="text"

     

       551
        
                   class="search-box"

     
···

       564
        
                 </button>

     

       565
        
               </div>

     

       566
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       567
        
               ${

     

       568
        
       					this.filteredTranscriptions.length === 0

     

       569
        
       						? html`

     
···

       572
        
                 <p>${this.searchQuery ? "Try a different search term" : "Upload a recording to get started!"}</p>

     

       573
        
               </div>

     

       574
        
             `

     

       575
       -
       					: html`

     

       576
        
               ${this.filteredTranscriptions.map(

     

       577
       -
       						(t) => html`

     

       578
        
                 <div class="transcription-card">

     

       579
        
                   <div class="transcription-header">

     

       580
        
                     <div>

     
···

       617
        
                   ${t.error_message ? html`<div class="error">${t.error_message}</div>` : ""}

     

       618
        
                 </div>

     

       619
        
               `,

     

       620
       -
       					)}

     

       621
        
             `

     

       622
       -
       			}

     

       623
       -
               `}

     

       0
        
       
     

       624
        
             </div>

     

       625
        
       

     

       626
        
             <upload-recording-modal

     

       627
        
               ?open=${this.uploadModalOpen}

     

       628
        
               .classId=${this.classId}

     

       629
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       0
        
       
     

       0
        
       
     

       630
        
               @close=${this.handleModalClose}

     

       631
        
               @upload-success=${this.handleUploadSuccess}

     

       632
        
             ></upload-recording-modal>

···

       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
        
       import "./upload-recording-modal.ts";

     

       4
        
       import "./vtt-viewer.ts";

     

       5
       +
       import "./pending-recordings-view.ts";

     

       6
        
       

     

       7
        
       interface Class {

     

       8
        
       	id: string;

     
···

       25
        
       	id: string;

     

       26
        
       	user_id: number;

     

       27
        
       	meeting_time_id: string | null;

     

       28
       +
       	section_id: string | null;

     

       29
        
       	filename: string;

     

       30
        
       	original_filename: string;

     

       31
        
       	status:

     
···

       44
        
       	audioUrl?: string;

     

       45
        
       }

     

       46
        
       

     

       47
       +
       interface ClassSection {

     

       48
       +
       	id: string;

     

       49
       +
       	section_number: string;

     

       50
       +
       }

     

       51
       +
       

     

       52
        
       @customElement("class-view")

     

       53
        
       export class ClassView extends LitElement {

     

       54
        
       	@state() classId = "";

     

       55
        
       	@state() classInfo: Class | null = null;

     

       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       +
       	@state() userSection: string | null = null;

     

       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       60
        
       	@state() transcriptions: Transcription[] = [];

     

       61
        
       	@state() isLoading = true;

     

       62
        
       	@state() error: string | null = null;

     
···

       373
        
       			const data = await response.json();

     

       374
        
       			this.classInfo = data.class;

     

       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       +
       			this.sections = data.sections || [];

     

       377
       +
       			this.userSection = data.userSection || null;

     

       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       +
       

     

       380
       +
       			// Default to user's section for filtering

     

       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       +
       			}

     

       384
        
       

     

       385
        
       			// Load VTT for completed transcriptions

     

       386
        
       			await this.loadVTTForCompleted();

     
···

       467
        
       	}

     

       468
        
       

     

       469
        
       	private get filteredTranscriptions() {

     

       470
       +
       		let filtered = this.transcriptions;

     

       471
        
       

     

       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       +
       		

     

       475
       +
       		// Only filter by section if:

     

       476
       +
       		// 1. There are sections in the class

     

       477
       +
       		// 2. User has a section OR has selected one

     

       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       +
       			// For admins: show all transcriptions

     

       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       +
       			if (!this.isAdmin) {

     

       482
       +
       				filtered = filtered.filter(

     

       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       +
       				);

     

       485
       +
       			}

     

       486
       +
       		}

     

       487
       +
       

     

       488
       +
       		// Filter by search query

     

       489
       +
       		if (this.searchQuery) {

     

       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       +
       			);

     

       494
       +
       		}

     

       495
       +
       

     

       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       +
       

     

       499
       +
       		return filtered;

     

       500
        
       	}

     

       501
        
       

     

       502
        
       	private formatDate(timestamp: number): string {

     
···

       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       563
        
                   <h1>${this.classInfo.name}</h1>

     

       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       565
       +
                   <div class="semester">

     

       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       +
                     ${

     

       568
       +
       								this.userSection

     

       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       +
       									: ""

     

       571
       +
       							}

     

       572
       +
                   </div>

     

       573
        
                 </div>

     

       574
        
               </div>

     

       575
        
       

     
···

       586
        
       						: ""

     

       587
        
       				}

     

       588
        
       

     

       589
       +
               ${

     

       590
       +
       					!canAccessTranscriptions

     

       591
       +
       						? html`

     

       592
        
                 <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin: 2rem 0; text-align: center;">

     

       593
        
                   <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Access Recordings</h3>

     

       594
        
                   <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and view transcriptions.</p>

     

       595
        
                   <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       596
        
                 </div>

     

       597
       +
               `

     

       598
       +
       						: html`

     

       599
        
               <div class="search-upload">

     

       600
       +
                 ${

     

       601
       +
       						this.sections.length > 1

     

       602
       +
       							? html`

     

       603
       +
                     <select

     

       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       +
                       @change=${(e: Event) => {

     

       606
       +
       									this.selectedSectionFilter =

     

       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       +
       								}}

     

       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       +
                     >

     

       611
       +
                       ${this.sections.map(

     

       612
       +
       									(s) =>

     

       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       +
       								)}

     

       615
       +
                     </select>

     

       616
       +
                   `

     

       617
       +
       							: ""

     

       618
       +
       					}

     

       619
        
                 <input

     

       620
        
                   type="text"

     

       621
        
                   class="search-box"

     
···

       634
        
                 </button>

     

       635
        
               </div>

     

       636
        
       

     

       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       +
               ${

     

       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       +
       						// Apply section filtering to pending recordings

     

       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       +
       						

     

       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       +
       								return false;

     

       646
       +
       							}

     

       647
       +
       							

     

       648
       +
       							// Filter by section if applicable

     

       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       +
       							}

     

       653
       +
       							

     

       654
       +
       							return true;

     

       655
       +
       						}).length;

     

       656
       +
       

     

       657
       +
       						// Only show if there are pending recordings

     

       658
       +
       						if (pendingCount === 0) return "";

     

       659
       +
       

     

       660
       +
       						return html`

     

       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       +
                     <pending-recordings-view

     

       663
       +
                       .classId=${this.classId}

     

       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       +
                       .sectionId=${sectionFilter}

     

       667
       +
                     ></pending-recordings-view>

     

       668
       +
                   </div>

     

       669
       +
                 `;

     

       670
       +
       					})

     

       671
       +
       				}

     

       672
       +
       

     

       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       674
        
               ${

     

       675
        
       					this.filteredTranscriptions.length === 0

     

       676
        
       						? html`

     
···

       679
        
                 <p>${this.searchQuery ? "Try a different search term" : "Upload a recording to get started!"}</p>

     

       680
        
               </div>

     

       681
        
             `

     

       682
       +
       						: html`

     

       683
        
               ${this.filteredTranscriptions.map(

     

       684
       +
       					(t) => html`

     

       685
        
                 <div class="transcription-card">

     

       686
        
                   <div class="transcription-header">

     

       687
        
                     <div>

     
···

       724
        
                   ${t.error_message ? html`<div class="error">${t.error_message}</div>` : ""}

     

       725
        
                 </div>

     

       726
        
               `,

     

       727
       +
       				)}

     

       728
        
             `

     

       729
       +
       				}

     

       730
       +
               `

     

       731
       +
       				}

     

       732
        
             </div>

     

       733
        
       

     

       734
        
             <upload-recording-modal

     

       735
        
               ?open=${this.uploadModalOpen}

     

       736
        
               .classId=${this.classId}

     

       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       +
               .sections=${this.sections}

     

       739
       +
               .userSection=${this.userSection}

     

       740
        
               @close=${this.handleModalClose}

     

       741
        
               @upload-success=${this.handleUploadSuccess}

     

       742
        
             ></upload-recording-modal>

+21 -7

src/components/classes-overview.ts

···

       150
        
             margin-bottom: 1rem;

     

       151
        
           }

     

       152
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       153
        
           .loading {

     

       154
        
             text-align: center;

     

       155
        
             padding: 4rem 2rem;

     
···

       214
        
       	}

     

       215
        
       

     

       216
        
       	private async handleClassJoined() {

     

       0
        
       
     

       217
        
       		await this.loadClasses();

     

       218
        
       	}

     

       219
        
       

     
···

       259
        
       										? html`

     

       260
        
                         <div class="register-card" @click=${this.handleRegisterClick}>

     

       261
        
                           <div class="register-icon">+</div>

     

       262
       -
                           <div class="register-text">Register for Class</div>

     

       263
        
                         </div>

     

       264
        
                       `

     

       265
        
       										: ""

     
···

       273
        
                 <div class="empty-state">

     

       274
        
                   <h2>No classes yet</h2>

     

       275
        
                   <p>You haven't been enrolled in any classes.</p>

     

       276
       -
                 </div>

     

       277
       -
                 <div class="classes-grid">

     

       278
       -
                   <div class="register-card" @click=${this.handleRegisterClick}>

     

       279
       -
                     <div class="register-icon">+</div>

     

       280
       -
                     <div class="register-text">Register for Class</div>

     

       281
       -
                   </div>

     

       282
        
                 </div>

     

       283
        
               `

     

       284
        
       			}

···

       150
        
             margin-bottom: 1rem;

     

       151
        
           }

     

       152
        
       

     

       153
       +
           .empty-state button {

     

       154
       +
             margin-top: 2rem;

     

       155
       +
             padding: 0.75rem 2rem;

     

       156
       +
             background: var(--accent);

     

       157
       +
             color: var(--white);

     

       158
       +
             border: none;

     

       159
       +
             border-radius: 8px;

     

       160
       +
             font-size: 1rem;

     

       161
       +
             font-weight: 600;

     

       162
       +
             cursor: pointer;

     

       163
       +
             transition: all 0.2s;

     

       164
       +
           }

     

       165
       +
       

     

       166
       +
           .empty-state button:hover {

     

       167
       +
             background: color-mix(in srgb, var(--accent) 90%, black);

     

       168
       +
             transform: translateY(-2px);

     

       169
       +
           }

     

       170
       +
       

     

       171
        
           .loading {

     

       172
        
             text-align: center;

     

       173
        
             padding: 4rem 2rem;

     
···

       232
        
       	}

     

       233
        
       

     

       234
        
       	private async handleClassJoined() {

     

       235
       +
       		this.showRegistrationModal = false;

     

       236
        
       		await this.loadClasses();

     

       237
        
       	}

     

       238
        
       

     
···

       278
        
       										? html`

     

       279
        
                         <div class="register-card" @click=${this.handleRegisterClick}>

     

       280
        
                           <div class="register-icon">+</div>

     

       281
       +
                           <div class="register-text">Register for a Class</div>

     

       282
        
                         </div>

     

       283
        
                       `

     

       284
        
       										: ""

     
···

       292
        
                 <div class="empty-state">

     

       293
        
                   <h2>No classes yet</h2>

     

       294
        
                   <p>You haven't been enrolled in any classes.</p>

     

       295
       +
                   <button @click=${this.handleRegisterClick}>Register for a Class</button>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       296
        
                 </div>

     

       297
        
               `

     

       298
        
       			}

+436

src/components/pending-recordings-view.ts

···

       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       +
       

     

       4
       +
       interface PendingRecording {

     

       5
       +
       	id: string;

     

       6
       +
       	user_id: number;

     

       7
       +
       	filename: string;

     

       8
       +
       	original_filename: string;

     

       9
       +
       	vote_count: number;

     

       10
       +
       	created_at: number;

     

       11
       +
       }

     

       12
       +
       

     

       13
       +
       interface RecordingsData {

     

       14
       +
       	recordings: PendingRecording[];

     

       15
       +
       	total_users: number;

     

       16
       +
       	user_vote: string | null;

     

       17
       +
       	vote_threshold: number;

     

       18
       +
       	winning_recording_id: string | null;

     

       19
       +
       }

     

       20
       +
       

     

       21
       +
       @customElement("pending-recordings-view")

     

       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       +
       	@property({ type: String }) classId = "";

     

       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       +
       

     

       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       +
       	@state() private userVote: string | null = null;

     

       30
       +
       	@state() private voteThreshold = 0;

     

       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       +
       	@state() private error: string | null = null;

     

       33
       +
       	@state() private timeRemaining = "";

     

       34
       +
       

     

       35
       +
       	private refreshInterval?: number;

     

       36
       +
       	private loadingInProgress = false;

     

       37
       +
       

     

       38
       +
       	static override styles = css`

     

       39
       +
           :host {

     

       40
       +
             display: block;

     

       41
       +
             padding: 1rem;

     

       42
       +
           }

     

       43
       +
       

     

       44
       +
           .container {

     

       45
       +
             max-width: 56rem;

     

       46
       +
             margin: 0 auto;

     

       47
       +
           }

     

       48
       +
       

     

       49
       +
           h2 {

     

       50
       +
             color: var(--text);

     

       51
       +
             margin-bottom: 0.5rem;

     

       52
       +
           }

     

       53
       +
       

     

       54
       +
           .info {

     

       55
       +
             color: var(--paynes-gray);

     

       56
       +
             font-size: 0.875rem;

     

       57
       +
             margin-bottom: 1.5rem;

     

       58
       +
           }

     

       59
       +
       

     

       60
       +
           .stats {

     

       61
       +
             display: flex;

     

       62
       +
             gap: 2rem;

     

       63
       +
             margin-bottom: 1.5rem;

     

       64
       +
             padding: 1rem;

     

       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       +
             border-radius: 8px;

     

       67
       +
           }

     

       68
       +
       

     

       69
       +
           .stat {

     

       70
       +
             display: flex;

     

       71
       +
             flex-direction: column;

     

       72
       +
             gap: 0.25rem;

     

       73
       +
           }

     

       74
       +
       

     

       75
       +
           .stat-label {

     

       76
       +
             font-size: 0.75rem;

     

       77
       +
             color: var(--paynes-gray);

     

       78
       +
             text-transform: uppercase;

     

       79
       +
             letter-spacing: 0.05em;

     

       80
       +
           }

     

       81
       +
       

     

       82
       +
           .stat-value {

     

       83
       +
             font-size: 1.5rem;

     

       84
       +
             font-weight: 600;

     

       85
       +
             color: var(--text);

     

       86
       +
           }

     

       87
       +
       

     

       88
       +
           .recordings-list {

     

       89
       +
             display: flex;

     

       90
       +
             flex-direction: column;

     

       91
       +
             gap: 1rem;

     

       92
       +
           }

     

       93
       +
       

     

       94
       +
           .recording-card {

     

       95
       +
             border: 2px solid var(--secondary);

     

       96
       +
             border-radius: 8px;

     

       97
       +
             padding: 1rem;

     

       98
       +
             transition: all 0.2s;

     

       99
       +
           }

     

       100
       +
       

     

       101
       +
           .recording-card.voted {

     

       102
       +
             border-color: var(--accent);

     

       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       +
           }

     

       105
       +
       

     

       106
       +
           .recording-card.winning {

     

       107
       +
             border-color: var(--accent);

     

       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       +
           }

     

       110
       +
       

     

       111
       +
           .recording-header {

     

       112
       +
             display: flex;

     

       113
       +
             justify-content: space-between;

     

       114
       +
             align-items: center;

     

       115
       +
             margin-bottom: 0.75rem;

     

       116
       +
           }

     

       117
       +
       

     

       118
       +
           .recording-info {

     

       119
       +
             flex: 1;

     

       120
       +
           }

     

       121
       +
       

     

       122
       +
           .recording-name {

     

       123
       +
             font-weight: 600;

     

       124
       +
             color: var(--text);

     

       125
       +
             margin-bottom: 0.25rem;

     

       126
       +
           }

     

       127
       +
       

     

       128
       +
           .recording-meta {

     

       129
       +
             font-size: 0.75rem;

     

       130
       +
             color: var(--paynes-gray);

     

       131
       +
           }

     

       132
       +
       

     

       133
       +
           .vote-section {

     

       134
       +
             display: flex;

     

       135
       +
             align-items: center;

     

       136
       +
             gap: 1rem;

     

       137
       +
           }

     

       138
       +
       

     

       139
       +
           .vote-count {

     

       140
       +
             font-size: 1.25rem;

     

       141
       +
             font-weight: 600;

     

       142
       +
             color: var(--accent);

     

       143
       +
             min-width: 3rem;

     

       144
       +
             text-align: center;

     

       145
       +
           }

     

       146
       +
       

     

       147
       +
           .vote-button {

     

       148
       +
             padding: 0.5rem 1rem;

     

       149
       +
             border-radius: 6px;

     

       150
       +
             font-size: 0.875rem;

     

       151
       +
             font-weight: 500;

     

       152
       +
             cursor: pointer;

     

       153
       +
             transition: all 0.2s;

     

       154
       +
             border: 2px solid var(--secondary);

     

       155
       +
             background: var(--background);

     

       156
       +
             color: var(--text);

     

       157
       +
           }

     

       158
       +
       

     

       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       +
             border-color: var(--accent);

     

       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       +
           }

     

       163
       +
       

     

       164
       +
           .vote-button.voted {

     

       165
       +
             border-color: var(--accent);

     

       166
       +
             background: var(--accent);

     

       167
       +
             color: var(--white);

     

       168
       +
           }

     

       169
       +
       

     

       170
       +
           .vote-button:disabled {

     

       171
       +
             opacity: 0.5;

     

       172
       +
             cursor: not-allowed;

     

       173
       +
           }

     

       174
       +
       

     

       175
       +
           .delete-button {

     

       176
       +
             padding: 0.5rem;

     

       177
       +
             border: none;

     

       178
       +
             background: transparent;

     

       179
       +
             color: var(--paynes-gray);

     

       180
       +
             cursor: pointer;

     

       181
       +
             border-radius: 4px;

     

       182
       +
             transition: all 0.2s;

     

       183
       +
           }

     

       184
       +
       

     

       185
       +
           .delete-button:hover {

     

       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       +
             color: red;

     

       188
       +
           }

     

       189
       +
       

     

       190
       +
           .winning-badge {

     

       191
       +
             background: var(--accent);

     

       192
       +
             color: var(--white);

     

       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       +
             border-radius: 12px;

     

       195
       +
             font-size: 0.75rem;

     

       196
       +
             font-weight: 600;

     

       197
       +
           }

     

       198
       +
       

     

       199
       +
           .error {

     

       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       +
             border: 1px solid red;

     

       202
       +
             color: red;

     

       203
       +
             padding: 0.75rem;

     

       204
       +
             border-radius: 4px;

     

       205
       +
             margin-bottom: 1rem;

     

       206
       +
             font-size: 0.875rem;

     

       207
       +
           }

     

       208
       +
       

     

       209
       +
           .empty-state {

     

       210
       +
             text-align: center;

     

       211
       +
             padding: 3rem 1rem;

     

       212
       +
             color: var(--paynes-gray);

     

       213
       +
           }

     

       214
       +
       

     

       215
       +
           .audio-player {

     

       216
       +
             margin-top: 0.75rem;

     

       217
       +
           }

     

       218
       +
       

     

       219
       +
           audio {

     

       220
       +
             width: 100%;

     

       221
       +
             height: 2.5rem;

     

       222
       +
           }

     

       223
       +
         `;

     

       224
       +
       

     

       225
       +
       	override connectedCallback() {

     

       226
       +
       		super.connectedCallback();

     

       227
       +
       		this.loadRecordings();

     

       228
       +
       		// Refresh every 10 seconds

     

       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       +
       	}

     

       231
       +
       

     

       232
       +
       	override disconnectedCallback() {

     

       233
       +
       		super.disconnectedCallback();

     

       234
       +
       		if (this.refreshInterval) {

     

       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       +
       		}

     

       237
       +
       	}

     

       238
       +
       

     

       239
       +
       	private async loadRecordings() {

     

       240
       +
       		if (this.loadingInProgress) return;

     

       241
       +
       

     

       242
       +
       		this.loadingInProgress = true;

     

       243
       +
       

     

       244
       +
       		try {

     

       245
       +
       			// Build URL with optional section_id parameter

     

       246
       +
       			const url = new URL(

     

       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       +
       				window.location.origin,

     

       249
       +
       			);

     

       250
       +
       			if (this.sectionId !== null) {

     

       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       +
       			}

     

       253
       +
       

     

       254
       +
       			const response = await fetch(url.toString());

     

       255
       +
       

     

       256
       +
       			if (!response.ok) {

     

       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       +
       			}

     

       259
       +
       

     

       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       +
       			this.recordings = data.recordings;

     

       262
       +
       			this.userVote = data.user_vote;

     

       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       +
       

     

       266
       +
       			// Calculate time remaining for first recording

     

       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       +
       				const now = Date.now() / 1000;

     

       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       +
       

     

       273
       +
       				if (remaining > 0) {

     

       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       +
       				} else {

     

       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       +
       				}

     

       280
       +
       			}

     

       281
       +
       

     

       282
       +
       			this.error = null;

     

       283
       +
       		} catch (error) {

     

       284
       +
       			this.error =

     

       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       +
       		} finally {

     

       287
       +
       			this.loadingInProgress = false;

     

       288
       +
       		}

     

       289
       +
       	}

     

       290
       +
       

     

       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       +
       		try {

     

       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       +
       				method: "POST",

     

       295
       +
       			});

     

       296
       +
       

     

       297
       +
       			if (!response.ok) {

     

       298
       +
       				throw new Error("Failed to vote");

     

       299
       +
       			}

     

       300
       +
       

     

       301
       +
       			const data = await response.json();

     

       302
       +
       

     

       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       +
       			if (data.winning_recording_id) {

     

       305
       +
       				window.location.reload();

     

       306
       +
       			} else {

     

       307
       +
       				// Just reload recordings to show updated votes

     

       308
       +
       				await this.loadRecordings();

     

       309
       +
       			}

     

       310
       +
       		} catch (error) {

     

       311
       +
       			this.error =

     

       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       +
       		}

     

       314
       +
       	}

     

       315
       +
       

     

       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       +
       			return;

     

       319
       +
       		}

     

       320
       +
       

     

       321
       +
       		try {

     

       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       +
       				method: "DELETE",

     

       324
       +
       			});

     

       325
       +
       

     

       326
       +
       			if (!response.ok) {

     

       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       +
       			}

     

       329
       +
       

     

       330
       +
       			await this.loadRecordings();

     

       331
       +
       		} catch (error) {

     

       332
       +
       			this.error =

     

       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       +
       		}

     

       335
       +
       	}

     

       336
       +
       

     

       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       +
       		const now = Date.now() / 1000;

     

       339
       +
       		const diff = now - timestamp;

     

       340
       +
       

     

       341
       +
       		if (diff < 60) return "just now";

     

       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       +
       	}

     

       346
       +
       

     

       347
       +
       	override render() {

     

       348
       +
       		return html`

     

       349
       +
             <div class="container">

     

       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       +
               <p class="info">

     

       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       +
               </p>

     

       354
       +
       

     

       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       +
       

     

       357
       +
               ${

     

       358
       +
       					this.recordings.length > 0

     

       359
       +
       						? html`

     

       360
       +
                   <div class="stats">

     

       361
       +
                     <div class="stat">

     

       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       +
                     </div>

     

       365
       +
                     <div class="stat">

     

       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       +
                     </div>

     

       369
       +
                     <div class="stat">

     

       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       +
                     </div>

     

       373
       +
                   </div>

     

       374
       +
       

     

       375
       +
                   <div class="recordings-list">

     

       376
       +
                     ${this.recordings.map(

     

       377
       +
       								(recording) => html`

     

       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       +
                         <div class="recording-header">

     

       380
       +
                           <div class="recording-info">

     

       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       +
                             <div class="recording-meta">

     

       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       +
                             </div>

     

       385
       +
                           </div>

     

       386
       +
       

     

       387
       +
                           <div class="vote-section">

     

       388
       +
                             ${

     

       389
       +
       												this.winningRecordingId === recording.id

     

       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       +
       													: ""

     

       392
       +
       											}

     

       393
       +
                             

     

       394
       +
                             <div class="vote-count">

     

       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       +
                             </div>

     

       397
       +
       

     

       398
       +
                             <button

     

       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       +
                             >

     

       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       +
                             </button>

     

       405
       +
       

     

       406
       +
                             <button

     

       407
       +
                               class="delete-button"

     

       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       +
                               title="Delete recording"

     

       410
       +
                             >

     

       411
       +
                               🗑️

     

       412
       +
                             </button>

     

       413
       +
                           </div>

     

       414
       +
                         </div>

     

       415
       +
       

     

       416
       +
                         <div class="audio-player">

     

       417
       +
                           <audio controls preload="none">

     

       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       +
                           </audio>

     

       420
       +
                         </div>

     

       421
       +
                       </div>

     

       422
       +
                     `,

     

       423
       +
       							)}

     

       424
       +
                   </div>

     

       425
       +
                 `

     

       426
       +
       						: html`

     

       427
       +
                   <div class="empty-state">

     

       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       +
                   </div>

     

       431
       +
                 `

     

       432
       +
       				}

     

       433
       +
             </div>

     

       434
       +
           `;

     

       435
       +
       	}

     

       436
       +
       }

+335

src/components/reset-password-form.ts

···

       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       +
       import { hashPasswordClient } from "../lib/client-auth";

     

       4
       +
       

     

       5
       +
       @customElement("reset-password-form")

     

       6
       +
       export class ResetPasswordForm extends LitElement {

     

       7
       +
       	@property({ type: String }) token: string | null = null;

     

       8
       +
       	@state() private email: string | null = null;

     

       9
       +
       	@state() private password = "";

     

       10
       +
       	@state() private confirmPassword = "";

     

       11
       +
       	@state() private error = "";

     

       12
       +
       	@state() private isSubmitting = false;

     

       13
       +
       	@state() private isSuccess = false;

     

       14
       +
       	@state() private isLoadingEmail = false;

     

       15
       +
       

     

       16
       +
       	static override styles = css`

     

       17
       +
       		:host {

     

       18
       +
       			display: block;

     

       19
       +
       		}

     

       20
       +
       

     

       21
       +
       		.reset-card {

     

       22
       +
       			background: var(--background);

     

       23
       +
       			border: 2px solid var(--secondary);

     

       24
       +
       			border-radius: 12px;

     

       25
       +
       			padding: 2.5rem;

     

       26
       +
       			max-width: 25rem;

     

       27
       +
       			width: 100%;

     

       28
       +
       			box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);

     

       29
       +
       		}

     

       30
       +
       

     

       31
       +
       		.reset-title {

     

       32
       +
       			margin-top: 0;

     

       33
       +
       			margin-bottom: 2rem;

     

       34
       +
       			color: var(--text);

     

       35
       +
       			text-align: center;

     

       36
       +
       			font-size: 1.75rem;

     

       37
       +
       		}

     

       38
       +
       

     

       39
       +
       		.form-group {

     

       40
       +
       			margin-bottom: 1.5rem;

     

       41
       +
       		}

     

       42
       +
       

     

       43
       +
       		label {

     

       44
       +
       			display: block;

     

       45
       +
       			margin-bottom: 0.25rem;

     

       46
       +
       			font-weight: 500;

     

       47
       +
       			color: var(--text);

     

       48
       +
       			font-size: 0.875rem;

     

       49
       +
       		}

     

       50
       +
       

     

       51
       +
       		input {

     

       52
       +
       			width: 100%;

     

       53
       +
       			padding: 0.75rem;

     

       54
       +
       			border: 2px solid var(--secondary);

     

       55
       +
       			border-radius: 6px;

     

       56
       +
       			font-size: 1rem;

     

       57
       +
       			font-family: inherit;

     

       58
       +
       			background: var(--background);

     

       59
       +
       			color: var(--text);

     

       60
       +
       			transition: all 0.2s;

     

       61
       +
       			box-sizing: border-box;

     

       62
       +
       		}

     

       63
       +
       

     

       64
       +
       		input::placeholder {

     

       65
       +
       			color: var(--secondary);

     

       66
       +
       			opacity: 1;

     

       67
       +
       		}

     

       68
       +
       

     

       69
       +
       		input:focus {

     

       70
       +
       			outline: none;

     

       71
       +
       			border-color: var(--primary);

     

       72
       +
       		}

     

       73
       +
       

     

       74
       +
       		.error-banner {

     

       75
       +
       			background: #fecaca;

     

       76
       +
       			border: 2px solid rgba(220, 38, 38, 0.8);

     

       77
       +
       			border-radius: 6px;

     

       78
       +
       			padding: 1rem;

     

       79
       +
       			margin-bottom: 1rem;

     

       80
       +
       			color: #dc2626;

     

       81
       +
       			font-weight: 500;

     

       82
       +
       		}

     

       83
       +
       

     

       84
       +
       		.btn-primary {

     

       85
       +
       			width: 100%;

     

       86
       +
       			padding: 0.75rem 1.5rem;

     

       87
       +
       			border: 2px solid var(--primary);

     

       88
       +
       			border-radius: 6px;

     

       89
       +
       			font-size: 1rem;

     

       90
       +
       			font-weight: 500;

     

       91
       +
       			cursor: pointer;

     

       92
       +
       			transition: all 0.2s;

     

       93
       +
       			font-family: inherit;

     

       94
       +
       			background: var(--primary);

     

       95
       +
       			color: white;

     

       96
       +
       			margin-top: 0.5rem;

     

       97
       +
       		}

     

       98
       +
       

     

       99
       +
       		.btn-primary:hover:not(:disabled) {

     

       100
       +
       			background: transparent;

     

       101
       +
       			color: var(--primary);

     

       102
       +
       		}

     

       103
       +
       

     

       104
       +
       		.btn-primary:disabled {

     

       105
       +
       			opacity: 0.6;

     

       106
       +
       			cursor: not-allowed;

     

       107
       +
       		}

     

       108
       +
       

     

       109
       +
       		.back-link {

     

       110
       +
       			display: block;

     

       111
       +
       			text-align: center;

     

       112
       +
       			margin-top: 1.5rem;

     

       113
       +
       			color: var(--primary);

     

       114
       +
       			text-decoration: none;

     

       115
       +
       			font-weight: 500;

     

       116
       +
       			font-size: 0.875rem;

     

       117
       +
       			transition: all 0.2s;

     

       118
       +
       		}

     

       119
       +
       

     

       120
       +
       		.back-link:hover {

     

       121
       +
       			color: var(--accent);

     

       122
       +
       		}

     

       123
       +
       

     

       124
       +
       		.success-message {

     

       125
       +
       			text-align: center;

     

       126
       +
       		}

     

       127
       +
       

     

       128
       +
       		.success-icon {

     

       129
       +
       			font-size: 3rem;

     

       130
       +
       			margin-bottom: 1rem;

     

       131
       +
       		}

     

       132
       +
       

     

       133
       +
       		.success-text {

     

       134
       +
       			color: var(--primary);

     

       135
       +
       			font-size: 1.25rem;

     

       136
       +
       			font-weight: 500;

     

       137
       +
       			margin-bottom: 1.5rem;

     

       138
       +
       		}

     

       139
       +
       

     

       140
       +
       		.success-link {

     

       141
       +
       			display: inline-block;

     

       142
       +
       			padding: 0.75rem 1.5rem;

     

       143
       +
       			background: var(--accent);

     

       144
       +
       			color: white;

     

       145
       +
       			text-decoration: none;

     

       146
       +
       			border-radius: 6px;

     

       147
       +
       			font-weight: 500;

     

       148
       +
       			transition: all 0.2s;

     

       149
       +
       		}

     

       150
       +
       

     

       151
       +
       		.success-link:hover {

     

       152
       +
       			background: var(--primary);

     

       153
       +
       		}

     

       154
       +
       	`;

     

       155
       +
       

     

       156
       +
       	override async updated(changedProperties: Map<string, unknown>) {

     

       157
       +
       		super.updated(changedProperties);

     

       158
       +
       

     

       159
       +
       		// When token property changes and we don't have email yet, load it

     

       160
       +
       		if (

     

       161
       +
       			changedProperties.has("token") &&

     

       162
       +
       			this.token &&

     

       163
       +
       			!this.email &&

     

       164
       +
       			!this.isLoadingEmail

     

       165
       +
       		) {

     

       166
       +
       			await this.loadEmail();

     

       167
       +
       		}

     

       168
       +
       	}

     

       169
       +
       

     

       170
       +
       	private async loadEmail() {

     

       171
       +
       		this.isLoadingEmail = true;

     

       172
       +
       		this.error = "";

     

       173
       +
       

     

       174
       +
       		try {

     

       175
       +
       			const url = `/api/auth/reset-password?token=${encodeURIComponent(this.token || "")}`;

     

       176
       +
       			const response = await fetch(url);

     

       177
       +
       			const data = await response.json();

     

       178
       +
       

     

       179
       +
       			if (!response.ok) {

     

       180
       +
       				throw new Error(data.error || "Invalid or expired reset token");

     

       181
       +
       			}

     

       182
       +
       

     

       183
       +
       			this.email = data.email;

     

       184
       +
       		} catch (err) {

     

       185
       +
       			this.error =

     

       186
       +
       				err instanceof Error ? err.message : "Failed to verify reset token";

     

       187
       +
       		} finally {

     

       188
       +
       			this.isLoadingEmail = false;

     

       189
       +
       		}

     

       190
       +
       	}

     

       191
       +
       

     

       192
       +
       	override render() {

     

       193
       +
       		if (!this.token) {

     

       194
       +
       			return html`

     

       195
       +
       				<div class="reset-card">

     

       196
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       197
       +
       					<div class="error-banner">Invalid or missing reset token</div>

     

       198
       +
       					<a href="/" class="back-link">Back to home</a>

     

       199
       +
       				</div>

     

       200
       +
       			`;

     

       201
       +
       		}

     

       202
       +
       

     

       203
       +
       		if (this.isLoadingEmail) {

     

       204
       +
       			return html`

     

       205
       +
       				<div class="reset-card">

     

       206
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       207
       +
       					<p style="text-align: center; color: var(--text);">Verifying reset token...</p>

     

       208
       +
       				</div>

     

       209
       +
       			`;

     

       210
       +
       		}

     

       211
       +
       

     

       212
       +
       		if (this.error && !this.email) {

     

       213
       +
       			return html`

     

       214
       +
       				<div class="reset-card">

     

       215
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       216
       +
       					<div class="error-banner">${this.error}</div>

     

       217
       +
       					<a href="/" class="back-link">Back to home</a>

     

       218
       +
       				</div>

     

       219
       +
       			`;

     

       220
       +
       		}

     

       221
       +
       

     

       222
       +
       		if (this.isSuccess) {

     

       223
       +
       			return html`

     

       224
       +
       				<div class="reset-card">

     

       225
       +
       					<div class="success-message">

     

       226
       +
       						<div class="success-icon">✓</div>

     

       227
       +
       						<div class="success-text">Password reset successfully!</div>

     

       228
       +
       						<a href="/" class="success-link">Go to home</a>

     

       229
       +
       					</div>

     

       230
       +
       				</div>

     

       231
       +
       			`;

     

       232
       +
       		}

     

       233
       +
       

     

       234
       +
       		return html`

     

       235
       +
       			<div class="reset-card">

     

       236
       +
       				<h1 class="reset-title">Reset Password</h1>

     

       237
       +
       				

     

       238
       +
       				<form @submit=${this.handleSubmit}>

     

       239
       +
       					${

     

       240
       +
       						this.error

     

       241
       +
       							? html`<div class="error-banner">${this.error}</div>`

     

       242
       +
       							: ""

     

       243
       +
       					}

     

       244
       +
       					

     

       245
       +
       					<div class="form-group">

     

       246
       +
       						<label for="password">New Password</label>

     

       247
       +
       						<input 

     

       248
       +
       							type="password" 

     

       249
       +
       							id="password" 

     

       250
       +
       							.value=${this.password}

     

       251
       +
       							@input=${(e: Event) => {

     

       252
       +
       								this.password = (e.target as HTMLInputElement).value;

     

       253
       +
       							}}

     

       254
       +
       							required 

     

       255
       +
       							minlength="8"

     

       256
       +
       							placeholder="Enter new password (min 8 characters)"

     

       257
       +
       						>

     

       258
       +
       					</div>

     

       259
       +
       					

     

       260
       +
       					<div class="form-group">

     

       261
       +
       						<label for="confirm-password">Confirm Password</label>

     

       262
       +
       						<input 

     

       263
       +
       							type="password" 

     

       264
       +
       							id="confirm-password" 

     

       265
       +
       							.value=${this.confirmPassword}

     

       266
       +
       							@input=${(e: Event) => {

     

       267
       +
       								this.confirmPassword = (e.target as HTMLInputElement).value;

     

       268
       +
       							}}

     

       269
       +
       							required 

     

       270
       +
       							minlength="8"

     

       271
       +
       							placeholder="Confirm new password"

     

       272
       +
       						>

     

       273
       +
       					</div>

     

       274
       +
       					

     

       275
       +
       					<button type="submit" class="btn-primary" ?disabled=${this.isSubmitting}>

     

       276
       +
       						${this.isSubmitting ? "Resetting..." : "Reset Password"}

     

       277
       +
       					</button>

     

       278
       +
       				</form>

     

       279
       +
       				

     

       280
       +
       				<a href="/" class="back-link">Back to home</a>

     

       281
       +
       			</div>

     

       282
       +
       		`;

     

       283
       +
       	}

     

       284
       +
       

     

       285
       +
       	private async handleSubmit(e: Event) {

     

       286
       +
       		e.preventDefault();

     

       287
       +
       		this.error = "";

     

       288
       +
       

     

       289
       +
       		// Validate passwords match

     

       290
       +
       		if (this.password !== this.confirmPassword) {

     

       291
       +
       			this.error = "Passwords do not match";

     

       292
       +
       			return;

     

       293
       +
       		}

     

       294
       +
       

     

       295
       +
       		// Validate password length

     

       296
       +
       		if (this.password.length < 8) {

     

       297
       +
       			this.error = "Password must be at least 8 characters";

     

       298
       +
       			return;

     

       299
       +
       		}

     

       300
       +
       

     

       301
       +
       		this.isSubmitting = true;

     

       302
       +
       

     

       303
       +
       		try {

     

       304
       +
       			if (!this.email) {

     

       305
       +
       				throw new Error("Email not loaded");

     

       306
       +
       			}

     

       307
       +
       

     

       308
       +
       			// Hash password client-side with user's email

     

       309
       +
       			const hashedPassword = await hashPasswordClient(

     

       310
       +
       				this.password,

     

       311
       +
       				this.email,

     

       312
       +
       			);

     

       313
       +
       

     

       314
       +
       			const response = await fetch("/api/auth/reset-password", {

     

       315
       +
       				method: "POST",

     

       316
       +
       				headers: { "Content-Type": "application/json" },

     

       317
       +
       				body: JSON.stringify({ token: this.token, password: hashedPassword }),

     

       318
       +
       			});

     

       319
       +
       

     

       320
       +
       			const data = await response.json();

     

       321
       +
       

     

       322
       +
       			if (!response.ok) {

     

       323
       +
       				throw new Error(data.error || "Failed to reset password");

     

       324
       +
       			}

     

       325
       +
       

     

       326
       +
       			// Show success message

     

       327
       +
       			this.isSuccess = true;

     

       328
       +
       		} catch (err) {

     

       329
       +
       			this.error =

     

       330
       +
       				err instanceof Error ? err.message : "Failed to reset password";

     

       331
       +
       		} finally {

     

       332
       +
       			this.isSubmitting = false;

     

       333
       +
       		}

     

       334
       +
       	}

     

       335
       +
       }

+10 -5

src/components/transcription.ts

···

       565
        
       

     

       566
        
       	async checkHealth() {

     

       567
        
       		try {

     

       568
       -
       			const response = await fetch("/api/transcriptions/health");

     

       569
        
       			if (response.ok) {

     

       570
        
       				const data = await response.json();

     

       571
       -
       				this.serviceAvailable = data.available;

     

       572
        
       			} else {

     

       573
        
       				this.serviceAvailable = false;

     

       574
        
       			}

     
···

       792
        
       	}

     

       793
        
       

     

       794
        
       	override render() {

     

       795
       -
       		const canUpload = this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       0
        
       
     

       796
        
       

     

       797
        
       		return html`

     

       798
       -
             ${!this.hasSubscription && !this.isAdmin ? html`

     

       0
        
       
     

       0
        
       
     

       799
        
               <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin-bottom: 2rem; text-align: center;">

     

       800
        
                 <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Upload Transcriptions</h3>

     

       801
        
                 <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and transcribe audio files.</p>

     

       802
        
                 <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       803
        
               </div>

     

       804
       -
             ` : ''}

     

       0
        
       
     

       0
        
       
     

       805
        
       

     

       806
        
             <div class="upload-area ${this.dragOver ? "drag-over" : ""} ${!canUpload ? "disabled" : ""}"

     

       807
        
                  @dragover=${canUpload ? this.handleDragOver : null}

···

       565
        
       

     

       566
        
       	async checkHealth() {

     

       567
        
       		try {

     

       568
       +
       			const response = await fetch("/api/health");

     

       569
        
       			if (response.ok) {

     

       570
        
       				const data = await response.json();

     

       571
       +
       				this.serviceAvailable = data.status === "healthy";

     

       572
        
       			} else {

     

       573
        
       				this.serviceAvailable = false;

     

       574
        
       			}

     
···

       792
        
       	}

     

       793
        
       

     

       794
        
       	override render() {

     

       795
       +
       		const canUpload =

     

       796
       +
       			this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       797
        
       

     

       798
        
       		return html`

     

       799
       +
             ${

     

       800
       +
       				!this.hasSubscription && !this.isAdmin

     

       801
       +
       					? html`

     

       802
        
               <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin-bottom: 2rem; text-align: center;">

     

       803
        
                 <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Upload Transcriptions</h3>

     

       804
        
                 <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and transcribe audio files.</p>

     

       805
        
                 <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       806
        
               </div>

     

       807
       +
             `

     

       808
       +
       					: ""

     

       809
       +
       			}

     

       810
        
       

     

       811
        
             <div class="upload-area ${this.dragOver ? "drag-over" : ""} ${!canUpload ? "disabled" : ""}"

     

       812
        
                  @dragover=${canUpload ? this.handleDragOver : null}

+153 -46

src/components/user-settings.ts

···

       36
        
       	canceled_at: number | null;

     

       37
        
       }

     

       38
        
       

     

       39
       -
       type SettingsPage = "account" | "sessions" | "passkeys" | "billing" | "notifications" | "danger";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       40
        
       

     

       41
        
       @customElement("user-settings")

     

       42
        
       export class UserSettings extends LitElement {

     
···

       61
        
       	@state() addingPasskey = false;

     

       62
        
       	@state() emailNotificationsEnabled = true;

     

       63
        
       	@state() deletingAccount = false;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       64
        
       

     

       65
        
       	static override styles = css`

     

       66
        
       		:host {

     
···

       288
        
       			line-height: 1.5;

     

       289
        
       		}

     

       290
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       291
        
       		.session-list {

     

       292
        
       			display: flex;

     

       293
        
       			flex-direction: column;

     
···

       517
        
       	override async connectedCallback() {

     

       518
        
       		super.connectedCallback();

     

       519
        
       		this.passkeySupported = isPasskeySupported();

     

       520
       -
       		

     

       521
        
       		// Check for tab query parameter

     

       522
        
       		const params = new URLSearchParams(window.location.search);

     

       523
        
       		const tab = params.get("tab");

     

       524
        
       		if (tab && this.isValidTab(tab)) {

     

       525
        
       			this.currentPage = tab as SettingsPage;

     

       526
        
       		}

     

       527
       -
       		

     

       528
        
       		await this.loadUser();

     

       529
        
       		await this.loadSessions();

     

       530
        
       		await this.loadSubscription();

     
···

       534
        
       	}

     

       535
        
       

     

       536
        
       	private isValidTab(tab: string): boolean {

     

       537
       -
       		return ["account", "sessions", "passkeys", "billing", "notifications", "danger"].includes(tab);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       538
        
       	}

     

       539
        
       

     

       540
        
       	private setTab(tab: SettingsPage) {

     
···

       647
        
       			// Reload passkeys

     

       648
        
       			await this.loadPasskeys();

     

       649
        
       		} catch (err) {

     

       650
       -
       			this.error = err instanceof Error ? err.message : "Failed to delete passkey";

     

       0
        
       
     

       651
        
       		}

     

       652
        
       	}

     

       653
        
       

     
···

       655
        
       		this.error = "";

     

       656
        
       		try {

     

       657
        
       			const response = await fetch("/api/auth/logout", { method: "POST" });

     

       658
       -
       			

     

       659
        
       			if (!response.ok) {

     

       660
        
       				const data = await response.json();

     

       661
        
       				this.error = data.error || "Failed to logout";

     

       662
        
       				return;

     

       663
        
       			}

     

       664
       -
       			

     

       665
        
       			window.location.href = "/";

     

       666
        
       		} catch (err) {

     

       667
        
       			this.error = err instanceof Error ? err.message : "Failed to logout";

     
···

       672
        
       		this.deletingAccount = true;

     

       673
        
       		this.error = "";

     

       674
        
       		document.body.style.cursor = "wait";

     

       675
       -
       		

     

       676
        
       		try {

     

       677
        
       			const response = await fetch("/api/user", {

     

       678
        
       				method: "DELETE",

     
···

       696
        
       

     

       697
        
       	async handleUpdateEmail() {

     

       698
        
       		this.error = "";

     

       0
        
       
     

       699
        
       		if (!this.newEmail) {

     

       700
        
       			this.error = "Email required";

     

       701
        
       			return;

     

       702
        
       		}

     

       703
        
       

     

       0
        
       
     

       704
        
       		try {

     

       705
        
       			const response = await fetch("/api/user/email", {

     

       706
        
       				method: "PUT",

     
···

       708
        
       				body: JSON.stringify({ email: this.newEmail }),

     

       709
        
       			});

     

       710
        
       

     

       0
        
       
     

       0
        
       
     

       711
        
       			if (!response.ok) {

     

       712
       -
       				const data = await response.json();

     

       713
        
       				this.error = data.error || "Failed to update email";

     

       714
        
       				return;

     

       715
        
       			}

     

       716
        
       

     

       717
       -
       			// Reload user data

     

       718
       -
       			await this.loadUser();

     

       0
        
       
     

       719
        
       			this.editingEmail = false;

     

       720
        
       			this.newEmail = "";

     

       721
        
       		} catch {

     

       722
        
       			this.error = "Failed to update email";

     

       0
        
       
     

       0
        
       
     

       723
        
       		}

     

       724
        
       	}

     

       725
        
       

     
···

       990
        
       

     

       991
        
       		return html`

     

       992
        
       			<div class="content-inner">

     

       993
       -
       			${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       994
        
       				<div class="error-banner">

     

       995
        
       					${this.error}

     

       996
        
       				</div>

     

       997
       -
       			` : ""}

     

       0
        
       
     

       0
        
       
     

       998
        
       			<div class="section">

     

       999
        
       				<h2 class="section-title">Profile Information</h2>

     

       1000
        
       

     
···

       1032
        
       				<div class="field-group">

     

       1033
        
       					<label class="field-label">Email</label>

     

       1034
        
       					${

     

       1035
       -
       						this.editingEmail

     

       1036
        
       							? html`

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1037
        
       							<div style="display: flex; gap: 0.5rem; align-items: center;">

     

       1038
        
       								<input

     

       1039
        
       									type="email"

     
···

       1047
        
       								<button

     

       1048
        
       									class="btn btn-affirmative btn-small"

     

       1049
        
       									@click=${this.handleUpdateEmail}

     

       0
        
       
     

       1050
        
       								>

     

       1051
       -
       									Save

     

       1052
        
       								</button>

     

       1053
        
       								<button

     

       1054
        
       									class="btn btn-neutral btn-small"

     
···

       1061
        
       								</button>

     

       1062
        
       							</div>

     

       1063
        
       						  `

     

       1064
       -
       							: html`

     

       1065
        
       							<div class="field-row">

     

       1066
        
       								<div class="field-value">${this.user.email}</div>

     

       1067
        
       								<button

     
···

       1069
        
       									@click=${() => {

     

       1070
        
       										this.editingEmail = true;

     

       1071
        
       										this.newEmail = this.user?.email ?? "";

     

       0
        
       
     

       1072
        
       									}}

     

       1073
        
       								>

     

       1074
        
       									Change

     
···

       1203
        
       	renderSessionsPage() {

     

       1204
        
       		return html`

     

       1205
        
       			<div class="content-inner">

     

       1206
       -
       			${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1207
        
       				<div class="error-banner">

     

       1208
        
       					${this.error}

     

       1209
        
       				</div>

     

       1210
       -
       			` : ""}

     

       0
        
       
     

       0
        
       
     

       1211
        
       			<div class="section">

     

       1212
        
       				<h2 class="section-title">Active Sessions</h2>

     

       1213
        
       				${

     
···

       1285
        
       			`;

     

       1286
        
       		}

     

       1287
        
       

     

       1288
       -
       		const hasActiveSubscription = this.subscription && (

     

       1289
       -
       			this.subscription.status === "active" || 

     

       1290
       -
       			this.subscription.status === "trialing"

     

       1291
       -
       		);

     

       1292
        
       

     

       1293
        
       		if (this.subscription && !hasActiveSubscription) {

     

       1294
        
       			// Has a subscription but it's not active (canceled, expired, etc.)

     

       1295
       -
       			const statusColor = 

     

       1296
       -
       				this.subscription.status === "canceled" ? "var(--accent)" :

     

       1297
       -
       				"var(--secondary)";

     

       0
        
       
     

       1298
        
       

     

       1299
        
       			return html`

     

       1300
        
       				<div class="content-inner">

     

       1301
       -
       					${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1302
        
       						<div class="error-banner">

     

       1303
        
       							${this.error}

     

       1304
        
       						</div>

     

       1305
       -
       					` : ""}

     

       0
        
       
     

       0
        
       
     

       1306
        
       					<div class="section">

     

       1307
        
       						<h2 class="section-title">Subscription</h2>

     

       1308
        
       						

     
···

       1324
        
       							</div>

     

       1325
        
       						</div>

     

       1326
        
       

     

       1327
       -
       						${this.subscription.canceled_at ? html`

     

       0
        
       
     

       0
        
       
     

       1328
        
       							<div class="field-group">

     

       1329
        
       								<label class="field-label">Canceled At</label>

     

       1330
        
       								<div class="field-value" style="color: var(--accent);">

     

       1331
        
       									${this.formatDate(this.subscription.canceled_at)}

     

       1332
        
       								</div>

     

       1333
        
       							</div>

     

       1334
       -
       						` : ""}

     

       0
        
       
     

       0
        
       
     

       1335
        
       

     

       1336
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1337
        
       							<button

     
···

       1353
        
       		if (hasActiveSubscription) {

     

       1354
        
       			return html`

     

       1355
        
       				<div class="content-inner">

     

       1356
       -
       					${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1357
        
       						<div class="error-banner">

     

       1358
        
       							${this.error}

     

       1359
        
       						</div>

     

       1360
       -
       					` : ""}

     

       0
        
       
     

       0
        
       
     

       1361
        
       					<div class="section">

     

       1362
        
       						<h2 class="section-title">Subscription</h2>

     

       1363
        
       						

     
···

       1376
        
       								">

     

       1377
        
       									${this.subscription.status}

     

       1378
        
       								</span>

     

       1379
       -
       								${this.subscription.cancel_at_period_end ? html`

     

       0
        
       
     

       0
        
       
     

       1380
        
       									<span style="color: var(--accent); font-size: 0.875rem;">

     

       1381
        
       										(Cancels at end of period)

     

       1382
        
       									</span>

     

       1383
       -
       								` : ""}

     

       0
        
       
     

       0
        
       
     

       1384
        
       							</div>

     

       1385
        
       						</div>

     

       1386
        
       

     

       1387
       -
       						${this.subscription.current_period_start && this.subscription.current_period_end ? html`

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1388
        
       							<div class="field-group">

     

       1389
        
       								<label class="field-label">Current Period</label>

     

       1390
        
       								<div class="field-value">

     
···

       1392
        
       									${this.formatDate(this.subscription.current_period_end)}

     

       1393
        
       								</div>

     

       1394
        
       							</div>

     

       1395
       -
       						` : ""}

     

       0
        
       
     

       0
        
       
     

       1396
        
       

     

       1397
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1398
        
       							<button

     
···

       1413
        
       

     

       1414
        
       		return html`

     

       1415
        
       			<div class="content-inner">

     

       1416
       -
       				${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1417
        
       					<div class="error-banner">

     

       1418
        
       						${this.error}

     

       1419
        
       					</div>

     

       1420
       -
       				` : ""}

     

       0
        
       
     

       0
        
       
     

       1421
        
       				<div class="section">

     

       1422
        
       					<h2 class="section-title">Billing & Subscription</h2>

     

       1423
        
       					<p class="field-description" style="margin-bottom: 1.5rem;">

     
···

       1438
        
       	renderDangerPage() {

     

       1439
        
       		return html`

     

       1440
        
       			<div class="content-inner">

     

       1441
       -
       			${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1442
        
       				<div class="error-banner">

     

       1443
        
       					${this.error}

     

       1444
        
       				</div>

     

       1445
       -
       			` : ""}

     

       0
        
       
     

       0
        
       
     

       1446
        
       			<div class="section danger-section">

     

       1447
        
       				<h2 class="section-title">Delete Account</h2>

     

       1448
        
       				<p class="danger-text">

     
···

       1465
        
       	renderNotificationsPage() {

     

       1466
        
       		return html`

     

       1467
        
       			<div class="content-inner">

     

       1468
       -
       				${this.error ? html`

     

       0
        
       
     

       0
        
       
     

       1469
        
       					<div class="error-banner">

     

       1470
        
       						${this.error}

     

       1471
        
       					</div>

     

       1472
       -
       				` : ""}

     

       0
        
       
     

       0
        
       
     

       1473
        
       				<div class="section">

     

       1474
        
       					<h2 class="section-title">Email Notifications</h2>

     

       1475
        
       					<p style="color: var(--text); margin-bottom: 1rem;">

     
···

       1491
        
       									const target = e.target as HTMLInputElement;

     

       1492
        
       									this.emailNotificationsEnabled = target.checked;

     

       1493
        
       									this.error = "";

     

       1494
       -
       									

     

       1495
        
       									try {

     

       1496
        
       										const response = await fetch("/api/user/notifications", {

     

       1497
        
       											method: "PUT",

     

       1498
        
       											headers: { "Content-Type": "application/json" },

     

       1499
        
       											body: JSON.stringify({

     

       1500
       -
       												email_notifications_enabled: this.emailNotificationsEnabled,

     

       0
        
       
     

       1501
        
       											}),

     

       1502
        
       										});

     

       1503
       -
       										

     

       1504
        
       										if (!response.ok) {

     

       1505
        
       											const data = await response.json();

     

       1506
       -
       											throw new Error(data.error || "Failed to update notification settings");

     

       0
        
       
     

       0
        
       
     

       1507
        
       										}

     

       1508
        
       									} catch (err) {

     

       1509
        
       										// Revert on error

     

       1510
        
       										this.emailNotificationsEnabled = !target.checked;

     

       1511
        
       										target.checked = !target.checked;

     

       1512
       -
       										this.error = err instanceof Error ? err.message : "Failed to update notification settings";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1513
        
       									}

     

       1514
        
       								}}

     

       1515
        
       							/>

···

       36
        
       	canceled_at: number | null;

     

       37
        
       }

     

       38
        
       

     

       39
       +
       type SettingsPage =

     

       40
       +
       	| "account"

     

       41
       +
       	| "sessions"

     

       42
       +
       	| "passkeys"

     

       43
       +
       	| "billing"

     

       44
       +
       	| "notifications"

     

       45
       +
       	| "danger";

     

       46
        
       

     

       47
        
       @customElement("user-settings")

     

       48
        
       export class UserSettings extends LitElement {

     
···

       67
        
       	@state() addingPasskey = false;

     

       68
        
       	@state() emailNotificationsEnabled = true;

     

       69
        
       	@state() deletingAccount = false;

     

       70
       +
       	@state() emailChangeMessage = "";

     

       71
       +
       	@state() pendingEmailChange = "";

     

       72
       +
       	@state() updatingEmail = false;

     

       73
        
       

     

       74
        
       	static override styles = css`

     

       75
        
       		:host {

     
···

       297
        
       			line-height: 1.5;

     

       298
        
       		}

     

       299
        
       

     

       300
       +
       		.success-message {

     

       301
       +
       			padding: 1rem;

     

       302
       +
       			background: rgba(76, 175, 80, 0.1);

     

       303
       +
       			border: 1px solid rgba(76, 175, 80, 0.3);

     

       304
       +
       			border-radius: 0.5rem;

     

       305
       +
       			color: var(--text);

     

       306
       +
       		}

     

       307
       +
       

     

       308
       +
       		.spinner {

     

       309
       +
       			display: inline-block;

     

       310
       +
       			width: 1rem;

     

       311
       +
       			height: 1rem;

     

       312
       +
       			border: 2px solid rgba(255, 255, 255, 0.3);

     

       313
       +
       			border-top-color: white;

     

       314
       +
       			border-radius: 50%;

     

       315
       +
       			animation: spin 0.6s linear infinite;

     

       316
       +
       		}

     

       317
       +
       

     

       318
       +
       		@keyframes spin {

     

       319
       +
       			to {

     

       320
       +
       				transform: rotate(360deg);

     

       321
       +
       			}

     

       322
       +
       		}

     

       323
       +
       

     

       324
        
       		.session-list {

     

       325
        
       			display: flex;

     

       326
        
       			flex-direction: column;

     
···

       550
        
       	override async connectedCallback() {

     

       551
        
       		super.connectedCallback();

     

       552
        
       		this.passkeySupported = isPasskeySupported();

     

       553
       +
       

     

       554
        
       		// Check for tab query parameter

     

       555
        
       		const params = new URLSearchParams(window.location.search);

     

       556
        
       		const tab = params.get("tab");

     

       557
        
       		if (tab && this.isValidTab(tab)) {

     

       558
        
       			this.currentPage = tab as SettingsPage;

     

       559
        
       		}

     

       560
       +
       

     

       561
        
       		await this.loadUser();

     

       562
        
       		await this.loadSessions();

     

       563
        
       		await this.loadSubscription();

     
···

       567
        
       	}

     

       568
        
       

     

       569
        
       	private isValidTab(tab: string): boolean {

     

       570
       +
       		return [

     

       571
       +
       			"account",

     

       572
       +
       			"sessions",

     

       573
       +
       			"passkeys",

     

       574
       +
       			"billing",

     

       575
       +
       			"notifications",

     

       576
       +
       			"danger",

     

       577
       +
       		].includes(tab);

     

       578
        
       	}

     

       579
        
       

     

       580
        
       	private setTab(tab: SettingsPage) {

     
···

       687
        
       			// Reload passkeys

     

       688
        
       			await this.loadPasskeys();

     

       689
        
       		} catch (err) {

     

       690
       +
       			this.error =

     

       691
       +
       				err instanceof Error ? err.message : "Failed to delete passkey";

     

       692
        
       		}

     

       693
        
       	}

     

       694
        
       

     
···

       696
        
       		this.error = "";

     

       697
        
       		try {

     

       698
        
       			const response = await fetch("/api/auth/logout", { method: "POST" });

     

       699
       +
       

     

       700
        
       			if (!response.ok) {

     

       701
        
       				const data = await response.json();

     

       702
        
       				this.error = data.error || "Failed to logout";

     

       703
        
       				return;

     

       704
        
       			}

     

       705
       +
       

     

       706
        
       			window.location.href = "/";

     

       707
        
       		} catch (err) {

     

       708
        
       			this.error = err instanceof Error ? err.message : "Failed to logout";

     
···

       713
        
       		this.deletingAccount = true;

     

       714
        
       		this.error = "";

     

       715
        
       		document.body.style.cursor = "wait";

     

       716
       +
       

     

       717
        
       		try {

     

       718
        
       			const response = await fetch("/api/user", {

     

       719
        
       				method: "DELETE",

     
···

       737
        
       

     

       738
        
       	async handleUpdateEmail() {

     

       739
        
       		this.error = "";

     

       740
       +
       		this.emailChangeMessage = "";

     

       741
        
       		if (!this.newEmail) {

     

       742
        
       			this.error = "Email required";

     

       743
        
       			return;

     

       744
        
       		}

     

       745
        
       

     

       746
       +
       		this.updatingEmail = true;

     

       747
        
       		try {

     

       748
        
       			const response = await fetch("/api/user/email", {

     

       749
        
       				method: "PUT",

     
···

       751
        
       				body: JSON.stringify({ email: this.newEmail }),

     

       752
        
       			});

     

       753
        
       

     

       754
       +
       			const data = await response.json();

     

       755
       +
       

     

       756
        
       			if (!response.ok) {

     

       0
        
       
     

       757
        
       				this.error = data.error || "Failed to update email";

     

       758
        
       				return;

     

       759
        
       			}

     

       760
        
       

     

       761
       +
       			// Show success message with pending email

     

       762
       +
       			this.emailChangeMessage = data.message || "Verification email sent";

     

       763
       +
       			this.pendingEmailChange = data.pendingEmail || this.newEmail;

     

       764
        
       			this.editingEmail = false;

     

       765
        
       			this.newEmail = "";

     

       766
        
       		} catch {

     

       767
        
       			this.error = "Failed to update email";

     

       768
       +
       		} finally {

     

       769
       +
       			this.updatingEmail = false;

     

       770
        
       		}

     

       771
        
       	}

     

       772
        
       

     
···

       1037
        
       

     

       1038
        
       		return html`

     

       1039
        
       			<div class="content-inner">

     

       1040
       +
       			${

     

       1041
       +
       				this.error

     

       1042
       +
       					? html`

     

       1043
        
       				<div class="error-banner">

     

       1044
        
       					${this.error}

     

       1045
        
       				</div>

     

       1046
       +
       			`

     

       1047
       +
       					: ""

     

       1048
       +
       			}

     

       1049
        
       			<div class="section">

     

       1050
        
       				<h2 class="section-title">Profile Information</h2>

     

       1051
        
       

     
···

       1083
        
       				<div class="field-group">

     

       1084
        
       					<label class="field-label">Email</label>

     

       1085
        
       					${

     

       1086
       +
       						this.emailChangeMessage

     

       1087
        
       							? html`

     

       1088
       +
       							<div class="success-message" style="margin-bottom: 1rem;">

     

       1089
       +
       								${this.emailChangeMessage}

     

       1090
       +
       								${this.pendingEmailChange ? html`<br><strong>New email:</strong> ${this.pendingEmailChange}` : ""}

     

       1091
       +
       							</div>

     

       1092
       +
       							<div class="field-row">

     

       1093
       +
       								<div class="field-value">${this.user.email}</div>

     

       1094
       +
       							</div>

     

       1095
       +
       						  `

     

       1096
       +
       							: this.editingEmail

     

       1097
       +
       								? html`

     

       1098
        
       							<div style="display: flex; gap: 0.5rem; align-items: center;">

     

       1099
        
       								<input

     

       1100
        
       									type="email"

     
···

       1108
        
       								<button

     

       1109
        
       									class="btn btn-affirmative btn-small"

     

       1110
        
       									@click=${this.handleUpdateEmail}

     

       1111
       +
       									?disabled=${this.updatingEmail}

     

       1112
        
       								>

     

       1113
       +
       									${this.updatingEmail ? html`<span class="spinner"></span>` : "Save"}

     

       1114
        
       								</button>

     

       1115
        
       								<button

     

       1116
        
       									class="btn btn-neutral btn-small"

     
···

       1123
        
       								</button>

     

       1124
        
       							</div>

     

       1125
        
       						  `

     

       1126
       +
       								: html`

     

       1127
        
       							<div class="field-row">

     

       1128
        
       								<div class="field-value">${this.user.email}</div>

     

       1129
        
       								<button

     
···

       1131
        
       									@click=${() => {

     

       1132
        
       										this.editingEmail = true;

     

       1133
        
       										this.newEmail = this.user?.email ?? "";

     

       1134
       +
       										this.emailChangeMessage = "";

     

       1135
        
       									}}

     

       1136
        
       								>

     

       1137
        
       									Change

     
···

       1266
        
       	renderSessionsPage() {

     

       1267
        
       		return html`

     

       1268
        
       			<div class="content-inner">

     

       1269
       +
       			${

     

       1270
       +
       				this.error

     

       1271
       +
       					? html`

     

       1272
        
       				<div class="error-banner">

     

       1273
        
       					${this.error}

     

       1274
        
       				</div>

     

       1275
       +
       			`

     

       1276
       +
       					: ""

     

       1277
       +
       			}

     

       1278
        
       			<div class="section">

     

       1279
        
       				<h2 class="section-title">Active Sessions</h2>

     

       1280
        
       				${

     
···

       1352
        
       			`;

     

       1353
        
       		}

     

       1354
        
       

     

       1355
       +
       		const hasActiveSubscription =

     

       1356
       +
       			this.subscription &&

     

       1357
       +
       			(this.subscription.status === "active" ||

     

       1358
       +
       				this.subscription.status === "trialing");

     

       1359
        
       

     

       1360
        
       		if (this.subscription && !hasActiveSubscription) {

     

       1361
        
       			// Has a subscription but it's not active (canceled, expired, etc.)

     

       1362
       +
       			const statusColor =

     

       1363
       +
       				this.subscription.status === "canceled"

     

       1364
       +
       					? "var(--accent)"

     

       1365
       +
       					: "var(--secondary)";

     

       1366
        
       

     

       1367
        
       			return html`

     

       1368
        
       				<div class="content-inner">

     

       1369
       +
       					${

     

       1370
       +
       						this.error

     

       1371
       +
       							? html`

     

       1372
        
       						<div class="error-banner">

     

       1373
        
       							${this.error}

     

       1374
        
       						</div>

     

       1375
       +
       					`

     

       1376
       +
       							: ""

     

       1377
       +
       					}

     

       1378
        
       					<div class="section">

     

       1379
        
       						<h2 class="section-title">Subscription</h2>

     

       1380
        
       						

     
···

       1396
        
       							</div>

     

       1397
        
       						</div>

     

       1398
        
       

     

       1399
       +
       						${

     

       1400
       +
       							this.subscription.canceled_at

     

       1401
       +
       								? html`

     

       1402
        
       							<div class="field-group">

     

       1403
        
       								<label class="field-label">Canceled At</label>

     

       1404
        
       								<div class="field-value" style="color: var(--accent);">

     

       1405
        
       									${this.formatDate(this.subscription.canceled_at)}

     

       1406
        
       								</div>

     

       1407
        
       							</div>

     

       1408
       +
       						`

     

       1409
       +
       								: ""

     

       1410
       +
       						}

     

       1411
        
       

     

       1412
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1413
        
       							<button

     
···

       1429
        
       		if (hasActiveSubscription) {

     

       1430
        
       			return html`

     

       1431
        
       				<div class="content-inner">

     

       1432
       +
       					${

     

       1433
       +
       						this.error

     

       1434
       +
       							? html`

     

       1435
        
       						<div class="error-banner">

     

       1436
        
       							${this.error}

     

       1437
        
       						</div>

     

       1438
       +
       					`

     

       1439
       +
       							: ""

     

       1440
       +
       					}

     

       1441
        
       					<div class="section">

     

       1442
        
       						<h2 class="section-title">Subscription</h2>

     

       1443
        
       						

     
···

       1456
        
       								">

     

       1457
        
       									${this.subscription.status}

     

       1458
        
       								</span>

     

       1459
       +
       								${

     

       1460
       +
       									this.subscription.cancel_at_period_end

     

       1461
       +
       										? html`

     

       1462
        
       									<span style="color: var(--accent); font-size: 0.875rem;">

     

       1463
        
       										(Cancels at end of period)

     

       1464
        
       									</span>

     

       1465
       +
       								`

     

       1466
       +
       										: ""

     

       1467
       +
       								}

     

       1468
        
       							</div>

     

       1469
        
       						</div>

     

       1470
        
       

     

       1471
       +
       						${

     

       1472
       +
       							this.subscription.current_period_start &&

     

       1473
       +
       							this.subscription.current_period_end

     

       1474
       +
       								? html`

     

       1475
        
       							<div class="field-group">

     

       1476
        
       								<label class="field-label">Current Period</label>

     

       1477
        
       								<div class="field-value">

     
···

       1479
        
       									${this.formatDate(this.subscription.current_period_end)}

     

       1480
        
       								</div>

     

       1481
        
       							</div>

     

       1482
       +
       						`

     

       1483
       +
       								: ""

     

       1484
       +
       						}

     

       1485
        
       

     

       1486
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1487
        
       							<button

     
···

       1502
        
       

     

       1503
        
       		return html`

     

       1504
        
       			<div class="content-inner">

     

       1505
       +
       				${

     

       1506
       +
       					this.error

     

       1507
       +
       						? html`

     

       1508
        
       					<div class="error-banner">

     

       1509
        
       						${this.error}

     

       1510
        
       					</div>

     

       1511
       +
       				`

     

       1512
       +
       						: ""

     

       1513
       +
       				}

     

       1514
        
       				<div class="section">

     

       1515
        
       					<h2 class="section-title">Billing & Subscription</h2>

     

       1516
        
       					<p class="field-description" style="margin-bottom: 1.5rem;">

     
···

       1531
        
       	renderDangerPage() {

     

       1532
        
       		return html`

     

       1533
        
       			<div class="content-inner">

     

       1534
       +
       			${

     

       1535
       +
       				this.error

     

       1536
       +
       					? html`

     

       1537
        
       				<div class="error-banner">

     

       1538
        
       					${this.error}

     

       1539
        
       				</div>

     

       1540
       +
       			`

     

       1541
       +
       					: ""

     

       1542
       +
       			}

     

       1543
        
       			<div class="section danger-section">

     

       1544
        
       				<h2 class="section-title">Delete Account</h2>

     

       1545
        
       				<p class="danger-text">

     
···

       1562
        
       	renderNotificationsPage() {

     

       1563
        
       		return html`

     

       1564
        
       			<div class="content-inner">

     

       1565
       +
       				${

     

       1566
       +
       					this.error

     

       1567
       +
       						? html`

     

       1568
        
       					<div class="error-banner">

     

       1569
        
       						${this.error}

     

       1570
        
       					</div>

     

       1571
       +
       				`

     

       1572
       +
       						: ""

     

       1573
       +
       				}

     

       1574
        
       				<div class="section">

     

       1575
        
       					<h2 class="section-title">Email Notifications</h2>

     

       1576
        
       					<p style="color: var(--text); margin-bottom: 1rem;">

     
···

       1592
        
       									const target = e.target as HTMLInputElement;

     

       1593
        
       									this.emailNotificationsEnabled = target.checked;

     

       1594
        
       									this.error = "";

     

       1595
       +
       

     

       1596
        
       									try {

     

       1597
        
       										const response = await fetch("/api/user/notifications", {

     

       1598
        
       											method: "PUT",

     

       1599
        
       											headers: { "Content-Type": "application/json" },

     

       1600
        
       											body: JSON.stringify({

     

       1601
       +
       												email_notifications_enabled:

     

       1602
       +
       													this.emailNotificationsEnabled,

     

       1603
        
       											}),

     

       1604
        
       										});

     

       1605
       +
       

     

       1606
        
       										if (!response.ok) {

     

       1607
        
       											const data = await response.json();

     

       1608
       +
       											throw new Error(

     

       1609
       +
       												data.error || "Failed to update notification settings",

     

       1610
       +
       											);

     

       1611
        
       										}

     

       1612
        
       									} catch (err) {

     

       1613
        
       										// Revert on error

     

       1614
        
       										this.emailNotificationsEnabled = !target.checked;

     

       1615
        
       										target.checked = !target.checked;

     

       1616
       +
       										this.error =

     

       1617
       +
       											err instanceof Error

     

       1618
       +
       												? err.message

     

       1619
       +
       												: "Failed to update notification settings";

     

       1620
        
       									}

     

       1621
        
       								}}

     

       1622
        
       							/>

+98 -59

src/db/schema.ts

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
       -
       export const db = new Database("thistle.db");

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
       

     

       5
        
       // Schema version tracking

     

       6
        
       db.run(`

     
···

       13
        
       const migrations = [

     

       14
        
       	{

     

       15
        
       		version: 1,

     

       16
       -
       		name: "Complete schema with class system",

     

       17
        
       		sql: `

     

       18
        
             -- Users table

     

       19
        
             CREATE TABLE IF NOT EXISTS users (

     
···

       24
        
               avatar TEXT DEFAULT 'd',

     

       25
        
               role TEXT NOT NULL DEFAULT 'user',

     

       26
        
               last_login INTEGER,

     

       0
        
       
     

       0
        
       
     

       27
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))

     

       28
        
             );

     

       29
        
       

     

       30
        
             CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);

     

       31
        
             CREATE INDEX IF NOT EXISTS idx_users_last_login ON users(last_login);

     

       0
        
       
     

       32
        
       

     

       33
        
             -- Sessions table

     

       34
        
             CREATE TABLE IF NOT EXISTS sessions (

     
···

       84
        
       

     

       85
        
             CREATE INDEX IF NOT EXISTS idx_classes_semester_year ON classes(semester, year);

     

       86
        
             CREATE INDEX IF NOT EXISTS idx_classes_archived ON classes(archived);

     

       0
        
       
     

       87
        
       

     

       88
        
             -- Class members table

     

       89
        
             CREATE TABLE IF NOT EXISTS class_members (

     
···

       132
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_class_id ON transcriptions(class_id);

     

       133
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_status ON transcriptions(status);

     

       134
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_whisper_job_id ON transcriptions(whisper_job_id);

     

       135
       -
           `,

     

       136
       -
       	},

     

       137
       -
       	{

     

       138
       -
       		version: 2,

     

       139
       -
       		name: "Add section column to classes table",

     

       140
       -
       		sql: `

     

       141
       -
             ALTER TABLE classes ADD COLUMN section TEXT;

     

       142
       -
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       143
       -
           `,

     

       144
       -
       	},

     

       145
       -
       	{

     

       146
       -
       		version: 3,

     

       147
       -
       		name: "Add class waitlist table",

     

       148
       -
       		sql: `

     

       149
        
             CREATE TABLE IF NOT EXISTS class_waitlist (

     

       150
        
               id TEXT PRIMARY KEY,

     

       151
        
               user_id INTEGER NOT NULL,

     

       152
        
               course_code TEXT NOT NULL,

     

       153
        
               course_name TEXT NOT NULL,

     

       154
        
               professor TEXT NOT NULL,

     

       155
       -
               section TEXT,

     

       156
        
               semester TEXT NOT NULL,

     

       157
        
               year INTEGER NOT NULL,

     

       0
        
       
     

       158
        
               additional_info TEXT,

     

       159
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       160
        
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     
···

       162
        
       

     

       163
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_user_id ON class_waitlist(user_id);

     

       164
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_course_code ON class_waitlist(course_code);

     

       165
       -
           `,

     

       166
       -
       	},

     

       167
       -
       	{

     

       168
       -
       		version: 4,

     

       169
       -
       		name: "Add meeting_times to class_waitlist",

     

       170
       -
       		sql: `

     

       171
       -
             ALTER TABLE class_waitlist ADD COLUMN meeting_times TEXT;

     

       172
       -
           `,

     

       173
       -
       	},

     

       174
       -
       	{

     

       175
       -
       		version: 5,

     

       176
       -
       		name: "Remove section columns",

     

       177
       -
       		sql: `

     

       178
       -
             DROP INDEX IF EXISTS idx_classes_section;

     

       179
       -
             ALTER TABLE classes DROP COLUMN section;

     

       180
       -
             ALTER TABLE class_waitlist DROP COLUMN section;

     

       181
       -
           `,

     

       182
       -
       	},

     

       183
       -
       	{

     

       184
       -
       		version: 6,

     

       185
       -
       		name: "Add subscriptions table for Polar integration",

     

       186
       -
       		sql: `

     

       187
        
             -- Subscriptions table

     

       188
        
             CREATE TABLE IF NOT EXISTS subscriptions (

     

       189
        
               id TEXT PRIMARY KEY,

     
···

       202
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_user_id ON subscriptions(user_id);

     

       203
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);

     

       204
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);

     

       205
       -
           `,

     

       206
       -
       	},

     

       207
       -
       	{

     

       208
       -
       		version: 7,

     

       209
       -
       		name: "Create ghost user for deleted accounts",

     

       210
       -
       		sql: `

     

       211
       -
             -- Create a ghost user account for orphaned transcriptions

     

       212
       -
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       213
       -
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       214
       -
           `,

     

       215
       -
       	},

     

       216
       -
       	{

     

       217
       -
       		version: 8,

     

       218
       -
       		name: "Add email verification system",

     

       219
       -
       		sql: `

     

       220
       -
             -- Add email verification flag to users

     

       221
       -
             ALTER TABLE users ADD COLUMN email_verified BOOLEAN DEFAULT 0;

     

       222
        
       

     

       223
        
             -- Email verification tokens table

     

       224
        
             CREATE TABLE IF NOT EXISTS email_verification_tokens (

     
···

       245
        
       

     

       246
        
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user_id ON password_reset_tokens(user_id);

     

       247
        
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_token ON password_reset_tokens(token);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       248
        
           `,

     

       249
        
       	},

     

       250
        
       	{

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       251
        
       		version: 4,

     

       252
       -
       		name: "Add email notification preferences",

     

       253
        
       		sql: `

     

       254
       -
             ALTER TABLE users ADD COLUMN email_notifications_enabled BOOLEAN DEFAULT 1;

     

       255
       -
           `,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       256
        
       	},

     

       257
        
       ];

     

       258

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
       +
       // Use test database when NODE_ENV is test

     

       4
       +
       const dbPath =

     

       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
       +
       export const db = new Database(dbPath);

     

       7
       +
       

     

       8
       +
       console.log(`[Database] Using database: ${dbPath}`);

     

       9
        
       

     

       10
        
       // Schema version tracking

     

       11
        
       db.run(`

     
···

       18
        
       const migrations = [

     

       19
        
       	{

     

       20
        
       		version: 1,

     

       21
       +
       		name: "Initial schema with all tables and constraints",

     

       22
        
       		sql: `

     

       23
        
             -- Users table

     

       24
        
             CREATE TABLE IF NOT EXISTS users (

     
···

       29
        
               avatar TEXT DEFAULT 'd',

     

       30
        
               role TEXT NOT NULL DEFAULT 'user',

     

       31
        
               last_login INTEGER,

     

       32
       +
               email_verified BOOLEAN DEFAULT 0,

     

       33
       +
               email_notifications_enabled BOOLEAN DEFAULT 1,

     

       34
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))

     

       35
        
             );

     

       36
        
       

     

       37
        
             CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);

     

       38
        
             CREATE INDEX IF NOT EXISTS idx_users_last_login ON users(last_login);

     

       39
       +
             CREATE INDEX IF NOT EXISTS idx_users_email_verified ON users(email_verified);

     

       40
        
       

     

       41
        
             -- Sessions table

     

       42
        
             CREATE TABLE IF NOT EXISTS sessions (

     
···

       92
        
       

     

       93
        
             CREATE INDEX IF NOT EXISTS idx_classes_semester_year ON classes(semester, year);

     

       94
        
             CREATE INDEX IF NOT EXISTS idx_classes_archived ON classes(archived);

     

       95
       +
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       96
        
       

     

       97
        
             -- Class members table

     

       98
        
             CREATE TABLE IF NOT EXISTS class_members (

     
···

       141
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_class_id ON transcriptions(class_id);

     

       142
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_status ON transcriptions(status);

     

       143
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_whisper_job_id ON transcriptions(whisper_job_id);

     

       144
       +
             CREATE INDEX IF NOT EXISTS idx_transcriptions_meeting_time_id ON transcriptions(meeting_time_id);

     

       145
       +
       

     

       146
       +
             -- Class waitlist table

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       147
        
             CREATE TABLE IF NOT EXISTS class_waitlist (

     

       148
        
               id TEXT PRIMARY KEY,

     

       149
        
               user_id INTEGER NOT NULL,

     

       150
        
               course_code TEXT NOT NULL,

     

       151
        
               course_name TEXT NOT NULL,

     

       152
        
               professor TEXT NOT NULL,

     

       0
        
       
     

       153
        
               semester TEXT NOT NULL,

     

       154
        
               year INTEGER NOT NULL,

     

       155
       +
               meeting_times TEXT,

     

       156
        
               additional_info TEXT,

     

       157
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       158
        
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     
···

       160
        
       

     

       161
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_user_id ON class_waitlist(user_id);

     

       162
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_course_code ON class_waitlist(course_code);

     

       163
       +
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       164
        
             -- Subscriptions table

     

       165
        
             CREATE TABLE IF NOT EXISTS subscriptions (

     

       166
        
               id TEXT PRIMARY KEY,

     
···

       179
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_user_id ON subscriptions(user_id);

     

       180
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);

     

       181
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       182
        
       

     

       183
        
             -- Email verification tokens table

     

       184
        
             CREATE TABLE IF NOT EXISTS email_verification_tokens (

     
···

       205
        
       

     

       206
        
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user_id ON password_reset_tokens(user_id);

     

       207
        
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_token ON password_reset_tokens(token);

     

       208
       +
       

     

       209
       +
             -- Email change tokens table

     

       210
       +
             CREATE TABLE IF NOT EXISTS email_change_tokens (

     

       211
       +
               id TEXT PRIMARY KEY,

     

       212
       +
               user_id INTEGER NOT NULL,

     

       213
       +
               new_email TEXT NOT NULL,

     

       214
       +
               token TEXT NOT NULL UNIQUE,

     

       215
       +
               expires_at INTEGER NOT NULL,

     

       216
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       217
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       218
       +
             );

     

       219
       +
       

     

       220
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_user_id ON email_change_tokens(user_id);

     

       221
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_token ON email_change_tokens(token);

     

       222
       +
       

     

       223
       +
             -- Create ghost user for deleted accounts

     

       224
       +
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       225
       +
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       226
        
           `,

     

       227
        
       	},

     

       228
        
       	{

     

       229
       +
       		version: 2,

     

       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       +
       		sql: `

     

       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       +
       

     

       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       +
       

     

       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       +
       				class_id TEXT NOT NULL,

     

       242
       +
       				section_number TEXT NOT NULL,

     

       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       +
       			);

     

       247
       +
       

     

       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       +
       

     

       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       +
       

     

       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       +
       		`,

     

       255
       +
       	},

     

       256
       +
       	{

     

       257
       +
       		version: 3,

     

       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       259
       +
       		sql: `

     

       260
       +
       			-- Add vote count to transcriptions

     

       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       +
       

     

       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       +
       

     

       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       +
       			);

     

       276
       +
       

     

       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       +
       		`,

     

       280
       +
       	},

     

       281
       +
       	{

     

       282
        
       		version: 4,

     

       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
        
       		sql: `

     

       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       +
       			-- Defaults to created_at for existing records

     

       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       +
       			

     

       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       +
       

     

       292
       +
       			-- Create index for ordering by recording date

     

       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       +
       		`,

     

       295
        
       	},

     

       296
        
       ];

     

       297

+4 -2

src/index.test.README.md

···

       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       58
        
       ### Transcription Endpoints

     

       59
       -
       - `GET /api/transcriptions/health` - Check transcription service health

     

       60
        
       - `GET /api/transcriptions` - List user transcriptions

     

       61
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       62
        
       - `GET /api/transcriptions/:id` - Get transcription details

     
···

       70
        
       - `PUT /api/admin/users/:id/role` - Update user role

     

       71
        
       - `PUT /api/admin/users/:id/name` - Update user name

     

       72
        
       - `PUT /api/admin/users/:id/email` - Update user email

     

       73
       -
       - `PUT /api/admin/users/:id/password` - Update user password

     

       74
        
       - `GET /api/admin/users/:id/sessions` - List user sessions

     

       75
        
       - `DELETE /api/admin/users/:id/sessions` - Delete all user sessions

     

       76
        
       - `DELETE /api/admin/users/:id/sessions/:sessionId` - Delete specific session

···

       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
        
       

     

       58
       +
       ### Health Endpoint

     

       59
       +
       - `GET /api/health` - Check service health (database, whisper, storage)

     

       60
       +
       

     

       61
        
       ### Transcription Endpoints

     

       0
        
       
     

       62
        
       - `GET /api/transcriptions` - List user transcriptions

     

       63
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       64
        
       - `GET /api/transcriptions/:id` - Get transcription details

     
···

       72
        
       - `PUT /api/admin/users/:id/role` - Update user role

     

       73
        
       - `PUT /api/admin/users/:id/name` - Update user name

     

       74
        
       - `PUT /api/admin/users/:id/email` - Update user email

     

       75
       +
       - `POST /api/admin/users/:id/password-reset` - Send password reset email

     

       76
        
       - `GET /api/admin/users/:id/sessions` - List user sessions

     

       77
        
       - `DELETE /api/admin/users/:id/sessions` - Delete all user sessions

     

       78
        
       - `DELETE /api/admin/users/:id/sessions/:sessionId` - Delete specific session

+353 -747

src/index.test.ts

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       9
       -
       import db from "./db/schema";

     

       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
        
       

     

       12
       -
       // Test server URL - uses port 3001 for testing to avoid conflicts

     

       13
        
       const TEST_PORT = 3001;

     

       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       0
        
       
     

       15
        
       

     

       16
       -
       // Check if server is available

     

       17
       -
       let serverAvailable = false;

     

       18
        
       

     

       19
        
       beforeAll(async () => {

     

       0
        
       
     

       20
        
       	try {

     

       21
       -
       		const response = await fetch(`${BASE_URL}/api/transcriptions/health`, {

     

       22
       -
       			signal: AbortSignal.timeout(1000),

     

       23
       -
       		});

     

       24
       -
       		serverAvailable = response.ok || response.status === 404;

     

       25
        
       	} catch {

     

       26
       -
       		console.warn(

     

       27
       -
       			`\n⚠️  Test server not running on port ${TEST_PORT}. Start it with:\n   PORT=${TEST_PORT} bun run src/index.ts\n   Then run tests in another terminal.\n`,

     

       28
       -
       		);

     

       29
       -
       		serverAvailable = false;

     

       30
        
       	}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       31
        
       });

     

       32
        
       

     

       33
        
       // Test user credentials

     
···

       81
        
       	});

     

       82
        
       }

     

       83
        
       

     

       84
       -
       // Cleanup helpers

     

       85
       -
       function cleanupTestData() {

     

       86
       -
       	// Delete test users and their related data (cascade will handle most of it)

     

       87
       -
       	// Include 'newemail%' to catch users whose emails were updated during tests

     

       88
       -
       	db.run(

     

       89
       -
       		"DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       90
       -
       	);

     

       91
       -
       	db.run(

     

       92
       -
       		"DELETE FROM passkeys WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       93
       -
       	);

     

       94
       -
       	db.run(

     

       95
       -
       		"DELETE FROM transcriptions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       96
       -
       	);

     

       97
       -
       	db.run(

     

       98
       -
       		"DELETE FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%'",

     

       99
       -
       	);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       100
        
       

     

       101
       -
       	// Clear ALL rate limit data to prevent accumulation across tests

     

       102
       -
       	// (IP-based rate limits don't contain test/admin in the key)

     

       103
       -
       	db.run("DELETE FROM rate_limit_attempts");

     

       104
       -
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       105
        
       

     

       106
       -
       beforeEach(() => {

     

       107
       -
       	if (serverAvailable) {

     

       108
       -
       		cleanupTestData();

     

       109
        
       	}

     

       110
       -
       });

     

       111
        
       

     

       112
       -
       afterAll(() => {

     

       113
       -
       	if (serverAvailable) {

     

       114
       -
       		cleanupTestData();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       115
        
       	}

     

       116
       -
       });

     

       117
        
       

     

       118
       -
       // Helper to skip tests if server is not available

     

       119
       -
       function serverTest(name: string, fn: () => void | Promise<void>) {

     

       120
       -
       	test(name, async () => {

     

       121
       -
       		if (!serverAvailable) {

     

       122
       -
       			console.log(`⏭️  Skipping: ${name} (server not running)`);

     

       123
       -
       			return;

     

       124
       -
       		}

     

       125
       -
       		await fn();

     

       126
       -
       	});

     

       127
        
       }

     

       128
        
       

     

       0
        
       
     

       0
        
       
     

       129
        
       describe("API Endpoints - Authentication", () => {

     

       130
        
       	describe("POST /api/auth/register", () => {

     

       131
       -
       		serverTest("should register a new user successfully", async () => {

     

       132
        
       			const hashedPassword = await clientHashPassword(

     

       133
        
       				TEST_USER.email,

     

       134
        
       				TEST_USER.password,

     
···

       144
        
       				}),

     

       145
        
       			});

     

       146
        
       

     

       147
       -
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       148
        
       			const data = await response.json();

     

       149
        
       			expect(data.user).toBeDefined();

     

       150
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       151
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       152
        
       		});

     

       153
        
       

     

       154
       -
       		serverTest("should reject registration with missing email", async () => {

     

       155
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       156
        
       				method: "POST",

     

       157
        
       				headers: { "Content-Type": "application/json" },

     
···

       165
        
       			expect(data.error).toBe("Email and password required");

     

       166
        
       		});

     

       167
        
       

     

       168
       -
       		serverTest(

     

       169
       -
       			"should reject registration with invalid password format",

     

       170
       -
       			async () => {

     

       171
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       172
       -
       					method: "POST",

     

       173
       -
       					headers: { "Content-Type": "application/json" },

     

       174
       -
       					body: JSON.stringify({

     

       175
       -
       						email: TEST_USER.email,

     

       176
       -
       						password: "short",

     

       177
       -
       					}),

     

       178
       -
       				});

     

       179
       -
       

     

       180
       -
       				expect(response.status).toBe(400);

     

       181
       -
       				const data = await response.json();

     

       182
       -
       				expect(data.error).toBe("Invalid password format");

     

       183
       -
       			},

     

       184
       -
       		);

     

       185
       -
       

     

       186
       -
       		serverTest("should reject duplicate email registration", async () => {

     

       187
       -
       			const hashedPassword = await clientHashPassword(

     

       188
       -
       				TEST_USER.email,

     

       189
       -
       				TEST_USER.password,

     

       190
       -
       			);

     

       191
       -
       

     

       192
       -
       			// First registration

     

       193
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       194
       -
       				method: "POST",

     

       195
       -
       				headers: { "Content-Type": "application/json" },

     

       196
       -
       				body: JSON.stringify({

     

       197
       -
       					email: TEST_USER.email,

     

       198
       -
       					password: hashedPassword,

     

       199
       -
       					name: TEST_USER.name,

     

       200
       -
       				}),

     

       201
       -
       			});

     

       202
       -
       

     

       203
       -
       			// Duplicate registration

     

       204
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       205
        
       				method: "POST",

     

       206
        
       				headers: { "Content-Type": "application/json" },

     

       207
        
       				body: JSON.stringify({

     

       208
        
       					email: TEST_USER.email,

     

       209
       -
       					password: hashedPassword,

     

       210
       -
       					name: TEST_USER.name,

     

       211
        
       				}),

     

       212
        
       			});

     

       213
        
       

     

       214
        
       			expect(response.status).toBe(400);

     

       215
        
       			const data = await response.json();

     

       216
       -
       			expect(data.error).toBe("Email already registered");

     

       217
        
       		});

     

       218
        
       

     

       219
       -
       		serverTest("should enforce rate limiting on registration", async () => {

     

       220
       -
       			const hashedPassword = await clientHashPassword(

     

       221
       -
       				"test@example.com",

     

       222
       -
       				"password",

     

       223
       -
       			);

     

       224
       -
       

     

       225
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       226
       -
       			let rateLimitHit = false;

     

       227
       -
       			for (let i = 0; i < 10; i++) {

     

       228
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       229
       -
       					method: "POST",

     

       230
       -
       					headers: { "Content-Type": "application/json" },

     

       231
       -
       					body: JSON.stringify({

     

       232
       -
       						email: `test${i}@example.com`,

     

       233
       -
       						password: hashedPassword,

     

       234
       -
       					}),

     

       235
       -
       				});

     

       236
       -
       

     

       237
       -
       				if (response.status === 429) {

     

       238
       -
       					rateLimitHit = true;

     

       239
       -
       					break;

     

       240
       -
       				}

     

       241
       -
       			}

     

       242
       -
       

     

       243
       -
       			// Verify that rate limiting was triggered

     

       244
       -
       			expect(rateLimitHit).toBe(true);

     

       245
       -
       		});

     

       246
       -
       	});

     

       247
       -
       

     

       248
       -
       	describe("POST /api/auth/login", () => {

     

       249
       -
       		serverTest("should login successfully with valid credentials", async () => {

     

       250
       -
       			// Register user first

     

       251
        
       			const hashedPassword = await clientHashPassword(

     

       252
        
       				TEST_USER.email,

     

       253
        
       				TEST_USER.password,

     

       254
        
       			);

     

       0
        
       
     

       0
        
       
     

       255
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       256
        
       				method: "POST",

     

       257
        
       				headers: { "Content-Type": "application/json" },

     
···

       262
        
       				}),

     

       263
        
       			});

     

       264
        
       

     

       265
       -
       			// Login

     

       266
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       267
        
       				method: "POST",

     

       268
        
       				headers: { "Content-Type": "application/json" },

     

       269
        
       				body: JSON.stringify({

     

       270
        
       					email: TEST_USER.email,

     

       271
        
       					password: hashedPassword,

     

       0
        
       
     

       272
        
       				}),

     

       273
        
       			});

     

       274
        
       

     

       275
       -
       			expect(response.status).toBe(200);

     

       276
        
       			const data = await response.json();

     

       277
       -
       			expect(data.user).toBeDefined();

     

       278
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       279
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       280
        
       		});

     

       281
        
       

     

       282
       -
       		serverTest("should reject login with invalid credentials", async () => {

     

       283
       -
       			// Register user first

     

       284
        
       			const hashedPassword = await clientHashPassword(

     

       285
       -
       				TEST_USER.email,

     

       286
       -
       				TEST_USER.password,

     

       287
        
       			);

     

       0
        
       
     

       0
        
       
     

       288
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       289
        
       				method: "POST",

     

       290
        
       				headers: { "Content-Type": "application/json" },

     

       291
        
       				body: JSON.stringify({

     

       292
       -
       					email: TEST_USER.email,

     

       293
        
       					password: hashedPassword,

     

       294
        
       				}),

     

       295
        
       			});

     

       296
        
       

     

       297
       -
       			// Login with wrong password

     

       298
       -
       			const wrongPassword = await clientHashPassword(

     

       299
       -
       				TEST_USER.email,

     

       300
       -
       				"WrongPassword123!",

     

       301
       -
       			);

     

       302
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       303
       -
       				method: "POST",

     

       304
       -
       				headers: { "Content-Type": "application/json" },

     

       305
       -
       				body: JSON.stringify({

     

       306
       -
       					email: TEST_USER.email,

     

       307
       -
       					password: wrongPassword,

     

       308
       -
       				}),

     

       309
       -
       			});

     

       310
       -
       

     

       311
       -
       			expect(response.status).toBe(401);

     

       312
       -
       			const data = await response.json();

     

       313
       -
       			expect(data.error).toBe("Invalid email or password");

     

       314
       -
       		});

     

       315
       -
       

     

       316
       -
       		serverTest("should reject login with missing fields", async () => {

     

       317
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       318
       -
       				method: "POST",

     

       319
       -
       				headers: { "Content-Type": "application/json" },

     

       320
       -
       				body: JSON.stringify({

     

       321
       -
       					email: TEST_USER.email,

     

       322
       -
       				}),

     

       323
       -
       			});

     

       324
       -
       

     

       325
       -
       			expect(response.status).toBe(400);

     

       326
       -
       			const data = await response.json();

     

       327
       -
       			expect(data.error).toBe("Email and password required");

     

       328
       -
       		});

     

       329
       -
       

     

       330
       -
       		serverTest("should enforce rate limiting on login attempts", async () => {

     

       331
       -
       			const hashedPassword = await clientHashPassword(

     

       332
       -
       				TEST_USER.email,

     

       333
       -
       				TEST_USER.password,

     

       334
       -
       			);

     

       335
       -
       

     

       336
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       337
        
       			let rateLimitHit = false;

     

       338
       -
       			for (let i = 0; i < 11; i++) {

     

       339
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       340
        
       					method: "POST",

     

       341
        
       					headers: { "Content-Type": "application/json" },

     

       342
        
       					body: JSON.stringify({

     

       343
       -
       						email: TEST_USER.email,

     

       344
        
       						password: hashedPassword,

     

       345
        
       					}),

     

       346
        
       				});

     
···

       356
        
       		});

     

       357
        
       	});

     

       358
        
       

     

       359
       -
       	describe("POST /api/auth/logout", () => {

     

       360
       -
       		serverTest("should logout successfully", async () => {

     

       361
        
       			// Register and login

     

       362
       -
       			const hashedPassword = await clientHashPassword(

     

       363
       -
       				TEST_USER.email,

     

       364
       -
       				TEST_USER.password,

     

       365
       -
       			);

     

       366
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
       -
       				method: "POST",

     

       368
       -
       				headers: { "Content-Type": "application/json" },

     

       369
       -
       				body: JSON.stringify({

     

       370
       -
       					email: TEST_USER.email,

     

       371
       -
       					password: hashedPassword,

     

       372
       -
       				}),

     

       373
       -
       			});

     

       374
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       375
       -
       

     

       376
       -
       			// Logout

     

       377
       -
       			const response = await authRequest(

     

       378
       -
       				`${BASE_URL}/api/auth/logout`,

     

       379
       -
       				sessionCookie,

     

       380
       -
       				{

     

       381
       -
       					method: "POST",

     

       382
       -
       				},

     

       383
       -
       			);

     

       384
       -
       

     

       385
       -
       			expect(response.status).toBe(200);

     

       386
       -
       			const data = await response.json();

     

       387
       -
       			expect(data.success).toBe(true);

     

       388
       -
       

     

       389
       -
       			// Verify cookie is cleared

     

       390
       -
       			const setCookie = response.headers.get("set-cookie");

     

       391
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       392
       -
       		});

     

       393
       -
       

     

       394
       -
       		serverTest("should logout even without valid session", async () => {

     

       395
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       396
       -
       				method: "POST",

     

       397
       -
       			});

     

       398
       -
       

     

       399
       -
       			expect(response.status).toBe(200);

     

       400
       -
       			const data = await response.json();

     

       401
       -
       			expect(data.success).toBe(true);

     

       402
       -
       		});

     

       403
       -
       	});

     

       404
       -
       

     

       405
       -
       	describe("GET /api/auth/me", () => {

     

       406
       -
       		serverTest(

     

       407
       -
       			"should return current user info when authenticated",

     

       408
       -
       			async () => {

     

       409
       -
       				// Register user

     

       410
       -
       				const hashedPassword = await clientHashPassword(

     

       411
       -
       					TEST_USER.email,

     

       412
       -
       					TEST_USER.password,

     

       413
       -
       				);

     

       414
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       415
       -
       					method: "POST",

     

       416
       -
       					headers: { "Content-Type": "application/json" },

     

       417
       -
       					body: JSON.stringify({

     

       418
       -
       						email: TEST_USER.email,

     

       419
       -
       						password: hashedPassword,

     

       420
       -
       						name: TEST_USER.name,

     

       421
       -
       					}),

     

       422
       -
       				});

     

       423
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       -
       

     

       425
       -
       				// Get current user

     

       426
       -
       				const response = await authRequest(

     

       427
       -
       					`${BASE_URL}/api/auth/me`,

     

       428
       -
       					sessionCookie,

     

       429
       -
       				);

     

       430
       -
       

     

       431
       -
       				expect(response.status).toBe(200);

     

       432
       -
       				const data = await response.json();

     

       433
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       434
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       435
       -
       				expect(data.role).toBeDefined();

     

       436
       -
       			},

     

       437
       -
       		);

     

       438
       -
       

     

       439
       -
       		serverTest("should return 401 when not authenticated", async () => {

     

       440
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       441
       -
       

     

       442
       -
       			expect(response.status).toBe(401);

     

       443
       -
       			const data = await response.json();

     

       444
       -
       			expect(data.error).toBe("Not authenticated");

     

       445
       -
       		});

     

       446
       -
       

     

       447
       -
       		serverTest("should return 401 with invalid session", async () => {

     

       448
       -
       			const response = await authRequest(

     

       449
       -
       				`${BASE_URL}/api/auth/me`,

     

       450
       -
       				"invalid-session",

     

       451
       -
       			);

     

       452
       -
       

     

       453
       -
       			expect(response.status).toBe(401);

     

       454
       -
       			const data = await response.json();

     

       455
       -
       			expect(data.error).toBe("Invalid session");

     

       456
       -
       		});

     

       457
       -
       	});

     

       458
       -
       });

     

       459
       -
       

     

       460
       -
       describe("API Endpoints - Session Management", () => {

     

       461
       -
       	describe("GET /api/sessions", () => {

     

       462
       -
       		serverTest("should return user sessions", async () => {

     

       463
       -
       			// Register user

     

       464
       -
       			const hashedPassword = await clientHashPassword(

     

       465
       -
       				TEST_USER.email,

     

       466
       -
       				TEST_USER.password,

     

       467
       -
       			);

     

       468
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       469
       -
       				method: "POST",

     

       470
       -
       				headers: { "Content-Type": "application/json" },

     

       471
       -
       				body: JSON.stringify({

     

       472
       -
       					email: TEST_USER.email,

     

       473
       -
       					password: hashedPassword,

     

       474
       -
       				}),

     

       475
       -
       			});

     

       476
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       477
       -
       

     

       478
       -
       			// Get sessions

     

       479
       -
       			const response = await authRequest(

     

       480
       -
       				`${BASE_URL}/api/sessions`,

     

       481
       -
       				sessionCookie,

     

       482
       -
       			);

     

       483
       -
       

     

       484
       -
       			expect(response.status).toBe(200);

     

       485
       -
       			const data = await response.json();

     

       486
       -
       			expect(data.sessions).toBeDefined();

     

       487
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       488
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       489
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       490
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       491
       -
       		});

     

       492
       -
       

     

       493
       -
       		serverTest("should require authentication", async () => {

     

       494
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       495
       -
       

     

       496
       -
       			expect(response.status).toBe(401);

     

       497
       -
       		});

     

       498
       -
       	});

     

       499
       -
       

     

       500
       -
       	describe("DELETE /api/sessions", () => {

     

       501
       -
       		serverTest("should delete specific session", async () => {

     

       502
       -
       			// Register user and create multiple sessions

     

       503
       -
       			const hashedPassword = await clientHashPassword(

     

       504
       -
       				TEST_USER.email,

     

       505
       -
       				TEST_USER.password,

     

       506
       -
       			);

     

       507
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       508
       -
       				method: "POST",

     

       509
       -
       				headers: { "Content-Type": "application/json" },

     

       510
       -
       				body: JSON.stringify({

     

       511
       -
       					email: TEST_USER.email,

     

       512
       -
       					password: hashedPassword,

     

       513
       -
       				}),

     

       514
       -
       			});

     

       515
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       516
       -
       

     

       517
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       518
       -
       				method: "POST",

     

       519
       -
       				headers: { "Content-Type": "application/json" },

     

       520
       -
       				body: JSON.stringify({

     

       521
       -
       					email: TEST_USER.email,

     

       522
       -
       					password: hashedPassword,

     

       523
       -
       				}),

     

       524
       -
       			});

     

       525
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       526
       -
       

     

       527
       -
       			// Get sessions list

     

       528
       -
       			const sessionsResponse = await authRequest(

     

       529
       -
       				`${BASE_URL}/api/sessions`,

     

       530
       -
       				session1Cookie,

     

       531
       -
       			);

     

       532
       -
       			const sessionsData = await sessionsResponse.json();

     

       533
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       534
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       535
       -
       			)?.id;

     

       536
       -
       

     

       537
       -
       			// Delete session 2

     

       538
       -
       			const response = await authRequest(

     

       539
       -
       				`${BASE_URL}/api/sessions`,

     

       540
       -
       				session1Cookie,

     

       541
       -
       				{

     

       542
       -
       					method: "DELETE",

     

       543
       -
       					headers: { "Content-Type": "application/json" },

     

       544
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       545
       -
       				},

     

       546
       -
       			);

     

       547
       -
       

     

       548
       -
       			expect(response.status).toBe(200);

     

       549
       -
       			const data = await response.json();

     

       550
       -
       			expect(data.success).toBe(true);

     

       551
       -
       

     

       552
       -
       			// Verify session 2 is deleted

     

       553
       -
       			const verifyResponse = await authRequest(

     

       554
       -
       				`${BASE_URL}/api/auth/me`,

     

       555
       -
       				session2Cookie,

     

       556
       -
       			);

     

       557
       -
       			expect(verifyResponse.status).toBe(401);

     

       558
       -
       		});

     

       559
       -
       

     

       560
       -
       		serverTest("should not delete another user's session", async () => {

     

       561
       -
       			// Register two users

     

       562
       -
       			const hashedPassword1 = await clientHashPassword(

     

       563
       -
       				TEST_USER.email,

     

       564
       -
       				TEST_USER.password,

     

       565
       -
       			);

     

       566
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       567
       -
       				method: "POST",

     

       568
       -
       				headers: { "Content-Type": "application/json" },

     

       569
       -
       				body: JSON.stringify({

     

       570
       -
       					email: TEST_USER.email,

     

       571
       -
       					password: hashedPassword1,

     

       572
       -
       				}),

     

       573
       -
       			});

     

       574
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       575
       -
       

     

       576
       -
       			const hashedPassword2 = await clientHashPassword(

     

       577
       -
       				TEST_USER_2.email,

     

       578
       -
       				TEST_USER_2.password,

     

       579
       -
       			);

     

       580
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       581
       -
       				method: "POST",

     

       582
       -
       				headers: { "Content-Type": "application/json" },

     

       583
       -
       				body: JSON.stringify({

     

       584
       -
       					email: TEST_USER_2.email,

     

       585
       -
       					password: hashedPassword2,

     

       586
       -
       				}),

     

       587
       -
       			});

     

       588
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       589
       -
       

     

       590
       -
       			// Try to delete user2's session using user1's credentials

     

       591
       -
       			const response = await authRequest(

     

       592
       -
       				`${BASE_URL}/api/sessions`,

     

       593
       -
       				user1Cookie,

     

       594
       -
       				{

     

       595
       -
       					method: "DELETE",

     

       596
       -
       					headers: { "Content-Type": "application/json" },

     

       597
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       598
       -
       				},

     

       599
       -
       			);

     

       600
       -
       

     

       601
       -
       			expect(response.status).toBe(404);

     

       602
       -
       		});

     

       603
       -
       

     

       604
       -
       		serverTest("should not delete current session", async () => {

     

       605
       -
       			// Register user

     

       606
       -
       			const hashedPassword = await clientHashPassword(

     

       607
       -
       				TEST_USER.email,

     

       608
       -
       				TEST_USER.password,

     

       609
       -
       			);

     

       610
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       611
       -
       				method: "POST",

     

       612
       -
       				headers: { "Content-Type": "application/json" },

     

       613
       -
       				body: JSON.stringify({

     

       614
       -
       					email: TEST_USER.email,

     

       615
       -
       					password: hashedPassword,

     

       616
       -
       				}),

     

       617
       -
       			});

     

       618
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       619
        
       

     

       620
        
       			// Try to delete own current session

     

       621
        
       			const response = await authRequest(

     
···

       637
        
       

     

       638
        
       describe("API Endpoints - User Management", () => {

     

       639
        
       	describe("DELETE /api/user", () => {

     

       640
       -
       		serverTest("should delete user account", async () => {

     

       641
       -
       			// Register user

     

       642
       -
       			const hashedPassword = await clientHashPassword(

     

       643
       -
       				TEST_USER.email,

     

       644
       -
       				TEST_USER.password,

     

       645
       -
       			);

     

       646
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       647
       -
       				method: "POST",

     

       648
       -
       				headers: { "Content-Type": "application/json" },

     

       649
       -
       				body: JSON.stringify({

     

       650
       -
       					email: TEST_USER.email,

     

       651
       -
       					password: hashedPassword,

     

       652
       -
       				}),

     

       653
       -
       			});

     

       654
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       655
        
       

     

       656
        
       			// Delete account

     

       657
        
       			const response = await authRequest(

     
···

       662
        
       				},

     

       663
        
       			);

     

       664
        
       

     

       665
       -
       			expect(response.status).toBe(200);

     

       666
       -
       			const data = await response.json();

     

       667
       -
       			expect(data.success).toBe(true);

     

       668
        
       

     

       669
        
       			// Verify user is deleted

     

       670
        
       			const verifyResponse = await authRequest(

     
···

       674
        
       			expect(verifyResponse.status).toBe(401);

     

       675
        
       		});

     

       676
        
       

     

       677
       -
       		serverTest("should require authentication", async () => {

     

       678
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       679
        
       				method: "DELETE",

     

       680
        
       			});

     
···

       684
        
       	});

     

       685
        
       

     

       686
        
       	describe("PUT /api/user/email", () => {

     

       687
       -
       		serverTest("should update user email", async () => {

     

       688
       -
       			// Register user

     

       689
       -
       			const hashedPassword = await clientHashPassword(

     

       690
       -
       				TEST_USER.email,

     

       691
       -
       				TEST_USER.password,

     

       692
       -
       			);

     

       693
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       694
       -
       				method: "POST",

     

       695
       -
       				headers: { "Content-Type": "application/json" },

     

       696
       -
       				body: JSON.stringify({

     

       697
       -
       					email: TEST_USER.email,

     

       698
       -
       					password: hashedPassword,

     

       699
       -
       				}),

     

       700
       -
       			});

     

       701
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       702
        
       

     

       703
       -
       			// Update email

     

       704
        
       			const newEmail = "newemail@example.com";

     

       705
        
       			const response = await authRequest(

     

       706
        
       				`${BASE_URL}/api/user/email`,

     
···

       716
        
       			const data = await response.json();

     

       717
        
       			expect(data.success).toBe(true);

     

       718
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       719
        
       			// Verify email updated

     

       720
        
       			const meResponse = await authRequest(

     

       721
        
       				`${BASE_URL}/api/auth/me`,

     
···

       725
        
       			expect(meData.email).toBe(newEmail);

     

       726
        
       		});

     

       727
        
       

     

       728
       -
       		serverTest("should reject duplicate email", async () => {

     

       729
        
       			// Register two users

     

       730
       -
       			const hashedPassword1 = await clientHashPassword(

     

       731
       -
       				TEST_USER.email,

     

       732
       -
       				TEST_USER.password,

     

       733
       -
       			);

     

       734
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       735
       -
       				method: "POST",

     

       736
       -
       				headers: { "Content-Type": "application/json" },

     

       737
       -
       				body: JSON.stringify({

     

       738
       -
       					email: TEST_USER.email,

     

       739
       -
       					password: hashedPassword1,

     

       740
       -
       				}),

     

       741
       -
       			});

     

       742
       -
       

     

       743
       -
       			const hashedPassword2 = await clientHashPassword(

     

       744
       -
       				TEST_USER_2.email,

     

       745
       -
       				TEST_USER_2.password,

     

       746
       -
       			);

     

       747
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       748
       -
       				method: "POST",

     

       749
       -
       				headers: { "Content-Type": "application/json" },

     

       750
       -
       				body: JSON.stringify({

     

       751
       -
       					email: TEST_USER_2.email,

     

       752
       -
       					password: hashedPassword2,

     

       753
       -
       				}),

     

       754
       -
       			});

     

       755
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       756
        
       

     

       757
        
       			// Try to update user2's email to user1's email

     

       758
        
       			const response = await authRequest(

     
···

       765
        
       				},

     

       766
        
       			);

     

       767
        
       

     

       768
       -
       			expect(response.status).toBe(400);

     

       769
        
       			const data = await response.json();

     

       770
        
       			expect(data.error).toBe("Email already in use");

     

       771
        
       		});

     

       772
        
       	});

     

       773
        
       

     

       774
        
       	describe("PUT /api/user/password", () => {

     

       775
       -
       		serverTest("should update user password", async () => {

     

       776
       -
       			// Register user

     

       777
       -
       			const hashedPassword = await clientHashPassword(

     

       778
       -
       				TEST_USER.email,

     

       779
       -
       				TEST_USER.password,

     

       780
       -
       			);

     

       781
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       782
       -
       				method: "POST",

     

       783
       -
       				headers: { "Content-Type": "application/json" },

     

       784
       -
       				body: JSON.stringify({

     

       785
       -
       					email: TEST_USER.email,

     

       786
       -
       					password: hashedPassword,

     

       787
       -
       				}),

     

       788
       -
       			});

     

       789
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       790
        
       

     

       791
        
       			// Update password

     

       792
        
       			const newPassword = await clientHashPassword(

     
···

       819
        
       			expect(loginResponse.status).toBe(200);

     

       820
        
       		});

     

       821
        
       

     

       822
       -
       		serverTest("should reject invalid password format", async () => {

     

       823
       -
       			// Register user

     

       824
       -
       			const hashedPassword = await clientHashPassword(

     

       825
       -
       				TEST_USER.email,

     

       826
       -
       				TEST_USER.password,

     

       827
       -
       			);

     

       828
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       829
       -
       				method: "POST",

     

       830
       -
       				headers: { "Content-Type": "application/json" },

     

       831
       -
       				body: JSON.stringify({

     

       832
       -
       					email: TEST_USER.email,

     

       833
       -
       					password: hashedPassword,

     

       834
       -
       				}),

     

       835
       -
       			});

     

       836
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       837
        
       

     

       838
        
       			// Try to update with invalid format

     

       839
        
       			const response = await authRequest(

     
···

       853
        
       	});

     

       854
        
       

     

       855
        
       	describe("PUT /api/user/name", () => {

     

       856
       -
       		serverTest("should update user name", async () => {

     

       857
       -
       			// Register user

     

       858
       -
       			const hashedPassword = await clientHashPassword(

     

       859
       -
       				TEST_USER.email,

     

       860
       -
       				TEST_USER.password,

     

       861
       -
       			);

     

       862
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       863
       -
       				method: "POST",

     

       864
       -
       				headers: { "Content-Type": "application/json" },

     

       865
       -
       				body: JSON.stringify({

     

       866
       -
       					email: TEST_USER.email,

     

       867
       -
       					password: hashedPassword,

     

       868
       -
       					name: TEST_USER.name,

     

       869
       -
       				}),

     

       870
       -
       			});

     

       871
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       872
        
       

     

       873
        
       			// Update name

     

       874
        
       			const newName = "Updated Name";

     
···

       883
        
       			);

     

       884
        
       

     

       885
        
       			expect(response.status).toBe(200);

     

       886
       -
       			const data = await response.json();

     

       887
       -
       			expect(data.success).toBe(true);

     

       888
        
       

     

       889
        
       			// Verify name updated

     

       890
        
       			const meResponse = await authRequest(

     
···

       895
        
       			expect(meData.name).toBe(newName);

     

       896
        
       		});

     

       897
        
       

     

       898
       -
       		serverTest("should reject missing name", async () => {

     

       899
       -
       			// Register user

     

       900
       -
       			const hashedPassword = await clientHashPassword(

     

       901
       -
       				TEST_USER.email,

     

       902
       -
       				TEST_USER.password,

     

       903
       -
       			);

     

       904
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       905
       -
       				method: "POST",

     

       906
       -
       				headers: { "Content-Type": "application/json" },

     

       907
       -
       				body: JSON.stringify({

     

       908
       -
       					email: TEST_USER.email,

     

       909
       -
       					password: hashedPassword,

     

       910
       -
       				}),

     

       911
       -
       			});

     

       912
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       913
        
       

     

       914
        
       			const response = await authRequest(

     

       915
        
       				`${BASE_URL}/api/user/name`,

     
···

       926
        
       	});

     

       927
        
       

     

       928
        
       	describe("PUT /api/user/avatar", () => {

     

       929
       -
       		serverTest("should update user avatar", async () => {

     

       930
       -
       			// Register user

     

       931
       -
       			const hashedPassword = await clientHashPassword(

     

       932
       -
       				TEST_USER.email,

     

       933
       -
       				TEST_USER.password,

     

       934
       -
       			);

     

       935
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       936
       -
       				method: "POST",

     

       937
       -
       				headers: { "Content-Type": "application/json" },

     

       938
       -
       				body: JSON.stringify({

     

       939
       -
       					email: TEST_USER.email,

     

       940
       -
       					password: hashedPassword,

     

       941
       -
       				}),

     

       942
       -
       			});

     

       943
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       944
        
       

     

       945
        
       			// Update avatar

     

       946
        
       			const newAvatar = "👨‍💻";

     
···

       969
        
       	});

     

       970
        
       });

     

       971
        
       

     

       972
       -
       describe("API Endpoints - Transcriptions", () => {

     

       973
       -
       	describe("GET /api/transcriptions/health", () => {

     

       974
       -
       		serverTest(

     

       975
       -
       			"should return transcription service health status",

     

       976
       -
       			async () => {

     

       977
       -
       				const response = await fetch(`${BASE_URL}/api/transcriptions/health`);

     

       978
        
       

     

       979
       -
       				expect(response.status).toBe(200);

     

       980
       -
       				const data = await response.json();

     

       981
       -
       				expect(data).toHaveProperty("available");

     

       982
       -
       				expect(typeof data.available).toBe("boolean");

     

       983
       -
       			},

     

       984
       -
       		);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       985
        
       	});

     

       0
        
       
     

       986
        
       

     

       0
        
       
     

       987
        
       	describe("GET /api/transcriptions", () => {

     

       988
       -
       		serverTest("should return user transcriptions", async () => {

     

       989
       -
       			// Register user

     

       990
       -
       			const hashedPassword = await clientHashPassword(

     

       991
       -
       				TEST_USER.email,

     

       992
       -
       				TEST_USER.password,

     

       993
       -
       			);

     

       994
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       995
       -
       				method: "POST",

     

       996
       -
       				headers: { "Content-Type": "application/json" },

     

       997
       -
       				body: JSON.stringify({

     

       998
       -
       					email: TEST_USER.email,

     

       999
       -
       					password: hashedPassword,

     

       1000
       -
       				}),

     

       1001
       -
       			});

     

       1002
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1003
        
       

     

       1004
        
       			// Get transcriptions

     

       1005
        
       			const response = await authRequest(

     
···

       1013
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       1014
        
       		});

     

       1015
        
       

     

       1016
       -
       		serverTest("should require authentication", async () => {

     

       1017
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       1018
        
       

     

       1019
        
       			expect(response.status).toBe(401);

     
···

       1021
        
       	});

     

       1022
        
       

     

       1023
        
       	describe("POST /api/transcriptions", () => {

     

       1024
       -
       		serverTest("should upload audio file and start transcription", async () => {

     

       1025
       -
       			// Register user

     

       1026
       -
       			const hashedPassword = await clientHashPassword(

     

       1027
       -
       				TEST_USER.email,

     

       1028
       -
       				TEST_USER.password,

     

       1029
       -
       			);

     

       1030
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1031
       -
       				method: "POST",

     

       1032
       -
       				headers: { "Content-Type": "application/json" },

     

       1033
       -
       				body: JSON.stringify({

     

       1034
       -
       					email: TEST_USER.email,

     

       1035
       -
       					password: hashedPassword,

     

       1036
       -
       				}),

     

       1037
       -
       			});

     

       1038
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1039
        
       

     

       1040
        
       			// Create a test audio file

     

       1041
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1053
        
       				},

     

       1054
        
       			);

     

       1055
        
       

     

       1056
       -
       			expect(response.status).toBe(200);

     

       1057
        
       			const data = await response.json();

     

       1058
        
       			expect(data.id).toBeDefined();

     

       1059
        
       			expect(data.message).toContain("Upload successful");

     

       1060
        
       		});

     

       1061
        
       

     

       1062
       -
       		serverTest("should reject non-audio files", async () => {

     

       1063
       -
       			// Register user

     

       1064
       -
       			const hashedPassword = await clientHashPassword(

     

       1065
       -
       				TEST_USER.email,

     

       1066
       -
       				TEST_USER.password,

     

       1067
       -
       			);

     

       1068
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1069
       -
       				method: "POST",

     

       1070
       -
       				headers: { "Content-Type": "application/json" },

     

       1071
       -
       				body: JSON.stringify({

     

       1072
       -
       					email: TEST_USER.email,

     

       1073
       -
       					password: hashedPassword,

     

       1074
       -
       				}),

     

       1075
       -
       			});

     

       1076
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1077
        
       

     

       1078
        
       			// Try to upload non-audio file

     

       1079
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1092
        
       			expect(response.status).toBe(400);

     

       1093
        
       		});

     

       1094
        
       

     

       1095
       -
       		serverTest("should reject files exceeding size limit", async () => {

     

       1096
       -
       			// Register user

     

       1097
       -
       			const hashedPassword = await clientHashPassword(

     

       1098
       -
       				TEST_USER.email,

     

       1099
       -
       				TEST_USER.password,

     

       1100
       -
       			);

     

       1101
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1102
       -
       				method: "POST",

     

       1103
       -
       				headers: { "Content-Type": "application/json" },

     

       1104
       -
       				body: JSON.stringify({

     

       1105
       -
       					email: TEST_USER.email,

     

       1106
       -
       					password: hashedPassword,

     

       1107
       -
       				}),

     

       1108
       -
       			});

     

       1109
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       1110
        
       

     

       1111
        
       			// Create a file larger than 100MB (the actual limit)

     

       1112
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1129
        
       			expect(data.error).toContain("File size must be less than");

     

       1130
        
       		});

     

       1131
        
       

     

       1132
       -
       		serverTest("should require authentication", async () => {

     

       1133
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       1134
        
       			const formData = new FormData();

     

       1135
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       1150
        
       	let userId: number;

     

       1151
        
       

     

       1152
        
       	beforeEach(async () => {

     

       1153
       -
       		if (!serverAvailable) return;

     

       1154
       -
       

     

       1155
        
       		// Create admin user

     

       1156
       -
       		const adminHash = await clientHashPassword(

     

       1157
       -
       			TEST_ADMIN.email,

     

       1158
       -
       			TEST_ADMIN.password,

     

       1159
       -
       		);

     

       1160
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1161
       -
       			method: "POST",

     

       1162
       -
       			headers: { "Content-Type": "application/json" },

     

       1163
       -
       			body: JSON.stringify({

     

       1164
       -
       				email: TEST_ADMIN.email,

     

       1165
       -
       				password: adminHash,

     

       1166
       -
       				name: TEST_ADMIN.name,

     

       1167
       -
       			}),

     

       1168
       -
       		});

     

       1169
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       1170
        
       

     

       1171
        
       		// Manually set admin role in database

     

       0
        
       
     

       1172
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1173
        
       			TEST_ADMIN.email,

     

       1174
        
       		]);

     

       1175
        
       

     

       1176
        
       		// Create regular user

     

       1177
       -
       		const userHash = await clientHashPassword(

     

       1178
       -
       			TEST_USER.email,

     

       1179
       -
       			TEST_USER.password,

     

       1180
       -
       		);

     

       1181
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1182
       -
       			method: "POST",

     

       1183
       -
       			headers: { "Content-Type": "application/json" },

     

       1184
       -
       			body: JSON.stringify({

     

       1185
       -
       				email: TEST_USER.email,

     

       1186
       -
       				password: userHash,

     

       1187
       -
       				name: TEST_USER.name,

     

       1188
       -
       			}),

     

       1189
       -
       		});

     

       1190
       -
       		userCookie = extractSessionCookie(userResponse);

     

       1191
        
       

     

       1192
        
       		// Get user ID

     

       1193
        
       		const userIdResult = db

     

       1194
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1195
        
       			.get(TEST_USER.email);

     

       1196
        
       		userId = userIdResult?.id;

     

       0
        
       
     

       0
        
       
     

       1197
        
       	});

     

       1198
        
       

     

       1199
        
       	describe("GET /api/admin/users", () => {

     

       1200
       -
       		serverTest("should return all users for admin", async () => {

     

       1201
        
       			const response = await authRequest(

     

       1202
        
       				`${BASE_URL}/api/admin/users`,

     

       1203
        
       				adminCookie,

     
···

       1209
        
       			expect(data.length).toBeGreaterThan(0);

     

       1210
        
       		});

     

       1211
        
       

     

       1212
       -
       		serverTest("should reject non-admin users", async () => {

     

       1213
        
       			const response = await authRequest(

     

       1214
        
       				`${BASE_URL}/api/admin/users`,

     

       1215
        
       				userCookie,

     
···

       1218
        
       			expect(response.status).toBe(403);

     

       1219
        
       		});

     

       1220
        
       

     

       1221
       -
       		serverTest("should require authentication", async () => {

     

       1222
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       1223
        
       

     

       1224
        
       			expect(response.status).toBe(401);

     
···

       1226
        
       	});

     

       1227
        
       

     

       1228
        
       	describe("GET /api/admin/transcriptions", () => {

     

       1229
       -
       		serverTest("should return all transcriptions for admin", async () => {

     

       1230
        
       			const response = await authRequest(

     

       1231
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1232
        
       				adminCookie,

     
···

       1237
        
       			expect(Array.isArray(data)).toBe(true);

     

       1238
        
       		});

     

       1239
        
       

     

       1240
       -
       		serverTest("should reject non-admin users", async () => {

     

       1241
        
       			const response = await authRequest(

     

       1242
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1243
        
       				userCookie,

     
···

       1248
        
       	});

     

       1249
        
       

     

       1250
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       1251
       -
       		serverTest("should delete user as admin", async () => {

     

       1252
        
       			const response = await authRequest(

     

       1253
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1254
        
       				adminCookie,

     
···

       1257
        
       				},

     

       1258
        
       			);

     

       1259
        
       

     

       1260
       -
       			expect(response.status).toBe(200);

     

       1261
       -
       			const data = await response.json();

     

       1262
       -
       			expect(data.success).toBe(true);

     

       1263
        
       

     

       1264
        
       			// Verify user is deleted

     

       1265
        
       			const verifyResponse = await authRequest(

     
···

       1269
        
       			expect(verifyResponse.status).toBe(401);

     

       1270
        
       		});

     

       1271
        
       

     

       1272
       -
       		serverTest("should reject non-admin users", async () => {

     

       1273
        
       			const response = await authRequest(

     

       1274
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1275
        
       				userCookie,

     
···

       1283
        
       	});

     

       1284
        
       

     

       1285
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       1286
       -
       		serverTest("should update user role as admin", async () => {

     

       1287
        
       			const response = await authRequest(

     

       1288
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1289
        
       				adminCookie,

     
···

       1295
        
       			);

     

       1296
        
       

     

       1297
        
       			expect(response.status).toBe(200);

     

       1298
       -
       			const data = await response.json();

     

       1299
       -
       			expect(data.success).toBe(true);

     

       1300
        
       

     

       1301
        
       			// Verify role updated

     

       1302
        
       			const meResponse = await authRequest(

     
···

       1307
        
       			expect(meData.role).toBe("admin");

     

       1308
        
       		});

     

       1309
        
       

     

       1310
       -
       		serverTest("should reject invalid roles", async () => {

     

       1311
        
       			const response = await authRequest(

     

       1312
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1313
        
       				adminCookie,

     
···

       1323
        
       	});

     

       1324
        
       

     

       1325
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       1326
       -
       		serverTest("should return user details for admin", async () => {

     

       1327
        
       			const response = await authRequest(

     

       1328
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1329
        
       				adminCookie,

     
···

       1337
        
       			expect(data).toHaveProperty("sessions");

     

       1338
        
       		});

     

       1339
        
       

     

       1340
       -
       		serverTest("should reject non-admin users", async () => {

     

       1341
        
       			const response = await authRequest(

     

       1342
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1343
        
       				userCookie,

     
···

       1348
        
       	});

     

       1349
        
       

     

       1350
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       1351
       -
       		serverTest("should update user name as admin", async () => {

     

       1352
        
       			const newName = "Admin Updated Name";

     

       1353
        
       			const response = await authRequest(

     

       1354
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       1365
        
       			expect(data.success).toBe(true);

     

       1366
        
       		});

     

       1367
        
       

     

       1368
       -
       		serverTest("should reject empty names", async () => {

     

       1369
        
       			const response = await authRequest(

     

       1370
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       1371
        
       				adminCookie,

     
···

       1381
        
       	});

     

       1382
        
       

     

       1383
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1384
       -
       		serverTest("should update user email as admin", async () => {

     

       1385
        
       			const newEmail = "newemail@admin.com";

     

       1386
        
       			const response = await authRequest(

     

       1387
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1398
        
       			expect(data.success).toBe(true);

     

       1399
        
       		});

     

       1400
        
       

     

       1401
       -
       		serverTest("should reject duplicate emails", async () => {

     

       1402
        
       			const response = await authRequest(

     

       1403
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1404
        
       				adminCookie,

     
···

       1409
        
       				},

     

       1410
        
       			);

     

       1411
        
       

     

       1412
       -
       			expect(response.status).toBe(400);

     

       1413
        
       			const data = await response.json();

     

       1414
        
       			expect(data.error).toBe("Email already in use");

     

       1415
        
       		});

     

       1416
        
       	});

     

       1417
        
       

     

       1418
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1419
       -
       		serverTest("should return user sessions as admin", async () => {

     

       1420
        
       			const response = await authRequest(

     

       1421
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1422
        
       				adminCookie,

     
···

       1429
        
       	});

     

       1430
        
       

     

       1431
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1432
       -
       		serverTest("should delete all user sessions as admin", async () => {

     

       1433
        
       			const response = await authRequest(

     

       1434
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1435
        
       				adminCookie,

     
···

       1438
        
       				},

     

       1439
        
       			);

     

       1440
        
       

     

       1441
       -
       			expect(response.status).toBe(200);

     

       1442
       -
       			const data = await response.json();

     

       1443
       -
       			expect(data.success).toBe(true);

     

       1444
        
       

     

       1445
        
       			// Verify sessions are deleted

     

       1446
        
       			const verifyResponse = await authRequest(

     
···

       1456
        
       	let sessionCookie: string;

     

       1457
        
       

     

       1458
        
       	beforeEach(async () => {

     

       1459
       -
       		if (!serverAvailable) return;

     

       1460
       -
       

     

       1461
       -
       		// Register user

     

       1462
       -
       		const hashedPassword = await clientHashPassword(

     

       1463
       -
       			TEST_USER.email,

     

       1464
       -
       			TEST_USER.password,

     

       1465
       -
       		);

     

       1466
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1467
       -
       			method: "POST",

     

       1468
       -
       			headers: { "Content-Type": "application/json" },

     

       1469
       -
       			body: JSON.stringify({

     

       1470
       -
       				email: TEST_USER.email,

     

       1471
       -
       				password: hashedPassword,

     

       1472
       -
       			}),

     

       1473
       -
       		});

     

       1474
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1475
        
       	});

     

       1476
        
       

     

       1477
        
       	describe("GET /api/passkeys", () => {

     

       1478
       -
       		serverTest("should return user passkeys", async () => {

     

       1479
        
       			const response = await authRequest(

     

       1480
        
       				`${BASE_URL}/api/passkeys`,

     

       1481
        
       				sessionCookie,

     
···

       1487
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1488
        
       		});

     

       1489
        
       

     

       1490
       -
       		serverTest("should require authentication", async () => {

     

       1491
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1492
        
       

     

       1493
        
       			expect(response.status).toBe(401);

     
···

       1495
        
       	});

     

       1496
        
       

     

       1497
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1498
       -
       		serverTest(

     

       1499
       -
       			"should return registration options for authenticated user",

     

       1500
       -
       			async () => {

     

       1501
       -
       				const response = await authRequest(

     

       1502
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1503
       -
       					sessionCookie,

     

       1504
       -
       					{

     

       1505
       -
       						method: "POST",

     

       1506
       -
       					},

     

       1507
       -
       				);

     

       1508
        
       

     

       1509
       -
       				expect(response.status).toBe(200);

     

       1510
       -
       				const data = await response.json();

     

       1511
       -
       				expect(data).toHaveProperty("challenge");

     

       1512
       -
       				expect(data).toHaveProperty("rp");

     

       1513
       -
       				expect(data).toHaveProperty("user");

     

       1514
       -
       			},

     

       1515
       -
       		);

     

       1516
        
       

     

       1517
       -
       		serverTest("should require authentication", async () => {

     

       1518
        
       			const response = await fetch(

     

       1519
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1520
        
       				{

     
···

       1527
        
       	});

     

       1528
        
       

     

       1529
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1530
       -
       		serverTest("should return authentication options for email", async () => {

     

       1531
        
       			const response = await fetch(

     

       1532
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1533
        
       				{

     
···

       1542
        
       			expect(data).toHaveProperty("challenge");

     

       1543
        
       		});

     

       1544
        
       

     

       1545
       -
       		serverTest("should handle non-existent email", async () => {

     

       1546
        
       			const response = await fetch(

     

       1547
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1548
        
       				{

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       9
       +
       import type { Subprocess } from "bun";

     

       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
        
       

     

       12
       +
       // Test server configuration

     

       13
        
       const TEST_PORT = 3001;

     

       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       15
       +
       const TEST_DB_PATH = "./thistle.test.db";

     

       16
        
       

     

       17
       +
       // Test server process

     

       18
       +
       let serverProcess: Subprocess | null = null;

     

       19
        
       

     

       20
        
       beforeAll(async () => {

     

       21
       +
       	// Clean up any existing test database

     

       22
        
       	try {

     

       23
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       24
        
       	} catch {

     

       25
       +
       		// Ignore if doesn't exist

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       26
        
       	}

     

       27
       +
       

     

       28
       +
       	// Start test server as subprocess

     

       29
       +
       	serverProcess = Bun.spawn(["bun", "run", "src/index.ts"], {

     

       30
       +
       		env: {

     

       31
       +
       			...process.env,

     

       32
       +
       			NODE_ENV: "test",

     

       33
       +
       			PORT: TEST_PORT.toString(),

     

       34
       +
       			SKIP_EMAILS: "true",

     

       35
       +
       			SKIP_POLAR_SYNC: "true",

     

       36
       +
       			// Dummy env vars to pass startup validation (won't be used due to SKIP_EMAILS/SKIP_POLAR_SYNC)

     

       37
       +
       			MAILCHANNELS_API_KEY: "test-key",

     

       38
       +
       			DKIM_PRIVATE_KEY: "test-key",

     

       39
       +
       			LLM_API_KEY: "test-key",

     

       40
       +
       			LLM_API_BASE_URL: "https://test.com",

     

       41
       +
       			LLM_MODEL: "test-model",

     

       42
       +
       			POLAR_ACCESS_TOKEN: "test-token",

     

       43
       +
       			POLAR_ORGANIZATION_ID: "test-org",

     

       44
       +
       			POLAR_PRODUCT_ID: "test-product",

     

       45
       +
       			POLAR_SUCCESS_URL: "http://localhost:3001/success",

     

       46
       +
       			POLAR_WEBHOOK_SECRET: "test-webhook-secret",

     

       47
       +
       			ORIGIN: "http://localhost:3001",

     

       48
       +
       		},

     

       49
       +
       		stdout: "pipe",

     

       50
       +
       		stderr: "pipe",

     

       51
       +
       	});

     

       52
       +
       

     

       53
       +
       	// Log server output for debugging

     

       54
       +
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       +
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       +
       	const decoder = new TextDecoder();

     

       57
       +
       

     

       58
       +
       	(async () => {

     

       59
       +
       		try {

     

       60
       +
       			while (true) {

     

       61
       +
       				const { value, done } = await stdoutReader.read();

     

       62
       +
       				if (done) break;

     

       63
       +
       				const text = decoder.decode(value);

     

       64
       +
       				console.log("[SERVER OUT]", text.trim());

     

       65
       +
       			}

     

       66
       +
       		} catch {}

     

       67
       +
       	})();

     

       68
       +
       

     

       69
       +
       	(async () => {

     

       70
       +
       		try {

     

       71
       +
       			while (true) {

     

       72
       +
       				const { value, done } = await stderrReader.read();

     

       73
       +
       				if (done) break;

     

       74
       +
       				const text = decoder.decode(value);

     

       75
       +
       				console.error("[SERVER ERR]", text.trim());

     

       76
       +
       			}

     

       77
       +
       		} catch {}

     

       78
       +
       	})();

     

       79
       +
       

     

       80
       +
       	// Wait for server to be ready

     

       81
       +
       	let retries = 30;

     

       82
       +
       	let ready = false;

     

       83
       +
       	while (retries > 0 && !ready) {

     

       84
       +
       		try {

     

       85
       +
       			const response = await fetch(`${BASE_URL}/api/health`, {

     

       86
       +
       				signal: AbortSignal.timeout(1000),

     

       87
       +
       			});

     

       88
       +
       			if (response.ok) {

     

       89
       +
       				ready = true;

     

       90
       +
       				break;

     

       91
       +
       			}

     

       92
       +
       		} catch {

     

       93
       +
       			// Server not ready yet

     

       94
       +
       		}

     

       95
       +
       		await new Promise((resolve) => setTimeout(resolve, 500));

     

       96
       +
       		retries--;

     

       97
       +
       	}

     

       98
       +
       

     

       99
       +
       	if (!ready) {

     

       100
       +
       		throw new Error("Test server failed to start within 15 seconds");

     

       101
       +
       	}

     

       102
       +
       

     

       103
       +
       	console.log(`✓ Test server running on port ${TEST_PORT}`);

     

       104
       +
       });

     

       105
       +
       

     

       106
       +
       afterAll(async () => {

     

       107
       +
       	// Kill test server

     

       108
       +
       	if (serverProcess) {

     

       109
       +
       		serverProcess.kill();

     

       110
       +
       		await new Promise((resolve) => setTimeout(resolve, 1000));

     

       111
       +
       	}

     

       112
       +
       

     

       113
       +
       	// Clean up test database

     

       114
       +
       	try {

     

       115
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       116
       +
       	} catch {

     

       117
       +
       		// Ignore if doesn't exist

     

       118
       +
       	}

     

       119
       +
       

     

       120
       +
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       +
       });

     

       122
       +
       

     

       123
       +
       // Clear database between each test

     

       124
       +
       beforeEach(async () => {

     

       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       +
       

     

       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       +
       	db.run("DELETE FROM classes");

     

       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       +
       

     

       142
       +
       	db.close();

     

       143
        
       });

     

       144
        
       

     

       145
        
       // Test user credentials

     
···

       193
        
       	});

     

       194
        
       }

     

       195
        
       

     

       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       +
       async function registerAndLogin(user: {

     

       198
       +
       	email: string;

     

       199
       +
       	password: string;

     

       200
       +
       	name?: string;

     

       201
       +
       }): Promise<string> {

     

       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       +
       

     

       204
       +
       	// Register the user

     

       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       +
       		method: "POST",

     

       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       +
       		body: JSON.stringify({

     

       209
       +
       			email: user.email,

     

       210
       +
       			password: hashedPassword,

     

       211
       +
       			name: user.name || "Test User",

     

       212
       +
       		}),

     

       213
       +
       	});

     

       214
       +
       

     

       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       +
       		const error = await registerResponse.json();

     

       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       +
       	}

     

       219
       +
       

     

       220
       +
       	const registerData = await registerResponse.json();

     

       221
       +
       	const userId = registerData.user.id;

     

       222
       +
       

     

       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       +
       	db.close();

     

       227
        
       

     

       228
       +
       	// Now login to get a session

     

       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       +
       		method: "POST",

     

       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       +
       		body: JSON.stringify({

     

       233
       +
       			email: user.email,

     

       234
       +
       			password: hashedPassword,

     

       235
       +
       		}),

     

       236
       +
       	});

     

       237
        
       

     

       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       +
       		const error = await loginResponse.json();

     

       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       241
        
       	}

     

       0
        
       
     

       242
        
       

     

       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       +
       }

     

       245
       +
       

     

       246
       +
       // Helper to add active subscription to a user

     

       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       +
       	const user = db

     

       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       +
       		.get(userEmail) as { id: number };

     

       252
       +
       	if (!user) {

     

       253
       +
       		db.close();

     

       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       255
        
       	}

     

       0
        
       
     

       256
        
       

     

       257
       +
       	db.run(

     

       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       +
       	);

     

       261
       +
       	db.close();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       262
        
       }

     

       263
        
       

     

       264
       +
       // All tests run against a fresh database, no cleanup needed

     

       265
       +
       

     

       266
        
       describe("API Endpoints - Authentication", () => {

     

       267
        
       	describe("POST /api/auth/register", () => {

     

       268
       +
       		test("should register a new user successfully", async () => {

     

       269
        
       			const hashedPassword = await clientHashPassword(

     

       270
        
       				TEST_USER.email,

     

       271
        
       				TEST_USER.password,

     
···

       281
        
       				}),

     

       282
        
       			});

     

       283
        
       

     

       284
       +
       			if (response.status !== 201) {

     

       285
       +
       				const error = await response.json();

     

       286
       +
       				console.error("Registration failed:", response.status, error);

     

       287
       +
       			}

     

       288
       +
       

     

       289
       +
       			expect(response.status).toBe(201);

     

       290
       +
       

     

       291
        
       			const data = await response.json();

     

       292
        
       			expect(data.user).toBeDefined();

     

       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       295
        
       		});

     

       296
        
       

     

       297
       +
       		test("should reject registration with missing email", async () => {

     

       298
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       299
        
       				method: "POST",

     

       300
        
       				headers: { "Content-Type": "application/json" },

     
···

       308
        
       			expect(data.error).toBe("Email and password required");

     

       309
        
       		});

     

       310
        
       

     

       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       313
        
       				method: "POST",

     

       314
        
       				headers: { "Content-Type": "application/json" },

     

       315
        
       				body: JSON.stringify({

     

       316
        
       					email: TEST_USER.email,

     

       317
       +
       					password: "short",

     

       0
        
       
     

       318
        
       				}),

     

       319
        
       			});

     

       320
        
       

     

       321
        
       			expect(response.status).toBe(400);

     

       322
        
       			const data = await response.json();

     

       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       324
        
       		});

     

       325
        
       

     

       326
       +
       		test("should reject duplicate email registration", async () => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       327
        
       			const hashedPassword = await clientHashPassword(

     

       328
        
       				TEST_USER.email,

     

       329
        
       				TEST_USER.password,

     

       330
        
       			);

     

       331
       +
       

     

       332
       +
       			// First registration

     

       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       334
        
       				method: "POST",

     

       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       340
        
       				}),

     

       341
        
       			});

     

       342
        
       

     

       343
       +
       			// Duplicate registration

     

       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       345
        
       				method: "POST",

     

       346
        
       				headers: { "Content-Type": "application/json" },

     

       347
        
       				body: JSON.stringify({

     

       348
        
       					email: TEST_USER.email,

     

       349
        
       					password: hashedPassword,

     

       350
       +
       					name: TEST_USER.name,

     

       351
        
       				}),

     

       352
        
       			});

     

       353
        
       

     

       354
       +
       			expect(response.status).toBe(409);

     

       355
        
       			const data = await response.json();

     

       356
       +
       			expect(data.error).toBe("Email already registered");

     

       0
        
       
     

       0
        
       
     

       357
        
       		});

     

       358
        
       

     

       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       0
        
       
     

       360
        
       			const hashedPassword = await clientHashPassword(

     

       361
       +
       				"ratelimit@example.com",

     

       362
       +
       				"password",

     

       363
        
       			);

     

       364
       +
       

     

       365
       +
       			// First registration succeeds

     

       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
        
       				method: "POST",

     

       368
        
       				headers: { "Content-Type": "application/json" },

     

       369
        
       				body: JSON.stringify({

     

       370
       +
       					email: "ratelimit@example.com",

     

       371
        
       					password: hashedPassword,

     

       372
        
       				}),

     

       373
        
       			});

     

       374
        
       

     

       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       377
        
       			let rateLimitHit = false;

     

       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       380
        
       					method: "POST",

     

       381
        
       					headers: { "Content-Type": "application/json" },

     

       382
        
       					body: JSON.stringify({

     

       383
       +
       						email: "ratelimit@example.com",

     

       384
        
       						password: hashedPassword,

     

       385
        
       					}),

     

       386
        
       				});

     
···

       396
        
       		});

     

       397
        
       	});

     

       398
        
       

     

       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       401
        
       			// Register and login

     

       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       403
        
       

     

       404
        
       			// Try to delete own current session

     

       405
        
       			const response = await authRequest(

     
···

       421
        
       

     

       422
        
       describe("API Endpoints - User Management", () => {

     

       423
        
       	describe("DELETE /api/user", () => {

     

       424
       +
       		test("should delete user account", async () => {

     

       425
       +
       			// Register and login

     

       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       427
        
       

     

       428
        
       			// Delete account

     

       429
        
       			const response = await authRequest(

     
···

       434
        
       				},

     

       435
        
       			);

     

       436
        
       

     

       437
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       438
        
       

     

       439
        
       			// Verify user is deleted

     

       440
        
       			const verifyResponse = await authRequest(

     
···

       444
        
       			expect(verifyResponse.status).toBe(401);

     

       445
        
       		});

     

       446
        
       

     

       447
       +
       		test("should require authentication", async () => {

     

       448
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       449
        
       				method: "DELETE",

     

       450
        
       			});

     
···

       454
        
       	});

     

       455
        
       

     

       456
        
       	describe("PUT /api/user/email", () => {

     

       457
       +
       		test("should update user email", async () => {

     

       458
       +
       			// Register and login

     

       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       460
        
       

     

       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       462
        
       			const newEmail = "newemail@example.com";

     

       463
        
       			const response = await authRequest(

     

       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       474
        
       			const data = await response.json();

     

       475
        
       			expect(data.success).toBe(true);

     

       476
        
       

     

       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       +
       			const tokenData = db

     

       480
       +
       				.query(

     

       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       +
       				)

     

       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       +
       				tokenData.new_email,

     

       486
       +
       				tokenData.user_id,

     

       487
       +
       			]);

     

       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       +
       				tokenData.user_id,

     

       490
       +
       			]);

     

       491
       +
       			db.close();

     

       492
       +
       

     

       493
        
       			// Verify email updated

     

       494
        
       			const meResponse = await authRequest(

     

       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       499
        
       			expect(meData.email).toBe(newEmail);

     

       500
        
       		});

     

       501
        
       

     

       502
       +
       		test("should reject duplicate email", async () => {

     

       503
        
       			// Register two users

     

       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       506
        
       

     

       507
        
       			// Try to update user2's email to user1's email

     

       508
        
       			const response = await authRequest(

     
···

       515
        
       				},

     

       516
        
       			);

     

       517
        
       

     

       518
       +
       			expect(response.status).toBe(409);

     

       519
        
       			const data = await response.json();

     

       520
        
       			expect(data.error).toBe("Email already in use");

     

       521
        
       		});

     

       522
        
       	});

     

       523
        
       

     

       524
        
       	describe("PUT /api/user/password", () => {

     

       525
       +
       		test("should update user password", async () => {

     

       526
       +
       			// Register and login

     

       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       528
        
       

     

       529
        
       			// Update password

     

       530
        
       			const newPassword = await clientHashPassword(

     
···

       557
        
       			expect(loginResponse.status).toBe(200);

     

       558
        
       		});

     

       559
        
       

     

       560
       +
       		test("should reject invalid password format", async () => {

     

       561
       +
       			// Register and login

     

       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       563
        
       

     

       564
        
       			// Try to update with invalid format

     

       565
        
       			const response = await authRequest(

     
···

       579
        
       	});

     

       580
        
       

     

       581
        
       	describe("PUT /api/user/name", () => {

     

       582
       +
       		test("should update user name", async () => {

     

       583
       +
       			// Register and login

     

       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       585
        
       

     

       586
        
       			// Update name

     

       587
        
       			const newName = "Updated Name";

     
···

       596
        
       			);

     

       597
        
       

     

       598
        
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       599
        
       

     

       600
        
       			// Verify name updated

     

       601
        
       			const meResponse = await authRequest(

     
···

       606
        
       			expect(meData.name).toBe(newName);

     

       607
        
       		});

     

       608
        
       

     

       609
       +
       		test("should reject missing name", async () => {

     

       610
       +
       			// Register and login

     

       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       612
        
       

     

       613
        
       			const response = await authRequest(

     

       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       625
        
       	});

     

       626
        
       

     

       627
        
       	describe("PUT /api/user/avatar", () => {

     

       628
       +
       		test("should update user avatar", async () => {

     

       629
       +
       			// Register and login

     

       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       631
        
       

     

       632
        
       			// Update avatar

     

       633
        
       			const newAvatar = "👨‍💻";

     
···

       656
        
       	});

     

       657
        
       });

     

       658
        
       

     

       659
       +
       describe("API Endpoints - Health", () => {

     

       660
       +
       	describe("GET /api/health", () => {

     

       661
       +
       		test("should return service health status with details", async () => {

     

       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       0
        
       
     

       0
        
       
     

       663
        
       

     

       664
       +
       			expect(response.status).toBe(200);

     

       665
       +
       			const data = await response.json();

     

       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       +
       		});

     

       673
        
       	});

     

       674
       +
       });

     

       675
        
       

     

       676
       +
       describe("API Endpoints - Transcriptions", () => {

     

       677
        
       	describe("GET /api/transcriptions", () => {

     

       678
       +
       		test("should return user transcriptions", async () => {

     

       679
       +
       			// Register and login

     

       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       +
       

     

       682
       +
       			// Add subscription

     

       683
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       684
        
       

     

       685
        
       			// Get transcriptions

     

       686
        
       			const response = await authRequest(

     
···

       694
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       695
        
       		});

     

       696
        
       

     

       697
       +
       		test("should require authentication", async () => {

     

       698
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       699
        
       

     

       700
        
       			expect(response.status).toBe(401);

     
···

       702
        
       	});

     

       703
        
       

     

       704
        
       	describe("POST /api/transcriptions", () => {

     

       705
       +
       		test("should upload audio file and start transcription", async () => {

     

       706
       +
       			// Register and login

     

       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       +
       

     

       709
       +
       			// Add subscription

     

       710
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       711
        
       

     

       712
        
       			// Create a test audio file

     

       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       725
        
       				},

     

       726
        
       			);

     

       727
        
       

     

       728
       +
       			expect(response.status).toBe(201);

     

       729
        
       			const data = await response.json();

     

       730
        
       			expect(data.id).toBeDefined();

     

       731
        
       			expect(data.message).toContain("Upload successful");

     

       732
        
       		});

     

       733
        
       

     

       734
       +
       		test("should reject non-audio files", async () => {

     

       735
       +
       			// Register and login

     

       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       +
       

     

       738
       +
       			// Add subscription

     

       739
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       740
        
       

     

       741
        
       			// Try to upload non-audio file

     

       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       755
        
       			expect(response.status).toBe(400);

     

       756
        
       		});

     

       757
        
       

     

       758
       +
       		test("should reject files exceeding size limit", async () => {

     

       759
       +
       			// Register and login

     

       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       +
       

     

       762
       +
       			// Add subscription

     

       763
       +
       			addSubscription(TEST_USER.email);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       764
        
       

     

       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       783
        
       			expect(data.error).toContain("File size must be less than");

     

       784
        
       		});

     

       785
        
       

     

       786
       +
       		test("should require authentication", async () => {

     

       787
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       788
        
       			const formData = new FormData();

     

       789
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       804
        
       	let userId: number;

     

       805
        
       

     

       806
        
       	beforeEach(async () => {

     

       0
        
       
     

       0
        
       
     

       807
        
       		// Create admin user

     

       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       809
        
       

     

       810
        
       		// Manually set admin role in database

     

       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       813
        
       			TEST_ADMIN.email,

     

       814
        
       		]);

     

       815
        
       

     

       816
        
       		// Create regular user

     

       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       818
        
       

     

       819
        
       		// Get user ID

     

       820
        
       		const userIdResult = db

     

       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       822
        
       			.get(TEST_USER.email);

     

       823
        
       		userId = userIdResult?.id;

     

       824
       +
       

     

       825
       +
       		db.close();

     

       826
        
       	});

     

       827
        
       

     

       828
        
       	describe("GET /api/admin/users", () => {

     

       829
       +
       		test("should return all users for admin", async () => {

     

       830
        
       			const response = await authRequest(

     

       831
        
       				`${BASE_URL}/api/admin/users`,

     

       832
        
       				adminCookie,

     
···

       838
        
       			expect(data.length).toBeGreaterThan(0);

     

       839
        
       		});

     

       840
        
       

     

       841
       +
       		test("should reject non-admin users", async () => {

     

       842
        
       			const response = await authRequest(

     

       843
        
       				`${BASE_URL}/api/admin/users`,

     

       844
        
       				userCookie,

     
···

       847
        
       			expect(response.status).toBe(403);

     

       848
        
       		});

     

       849
        
       

     

       850
       +
       		test("should require authentication", async () => {

     

       851
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       852
        
       

     

       853
        
       			expect(response.status).toBe(401);

     
···

       855
        
       	});

     

       856
        
       

     

       857
        
       	describe("GET /api/admin/transcriptions", () => {

     

       858
       +
       		test("should return all transcriptions for admin", async () => {

     

       859
        
       			const response = await authRequest(

     

       860
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       861
        
       				adminCookie,

     
···

       866
        
       			expect(Array.isArray(data)).toBe(true);

     

       867
        
       		});

     

       868
        
       

     

       869
       +
       		test("should reject non-admin users", async () => {

     

       870
        
       			const response = await authRequest(

     

       871
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       872
        
       				userCookie,

     
···

       877
        
       	});

     

       878
        
       

     

       879
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       880
       +
       		test("should delete user as admin", async () => {

     

       881
        
       			const response = await authRequest(

     

       882
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       883
        
       				adminCookie,

     
···

       886
        
       				},

     

       887
        
       			);

     

       888
        
       

     

       889
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       890
        
       

     

       891
        
       			// Verify user is deleted

     

       892
        
       			const verifyResponse = await authRequest(

     
···

       896
        
       			expect(verifyResponse.status).toBe(401);

     

       897
        
       		});

     

       898
        
       

     

       899
       +
       		test("should reject non-admin users", async () => {

     

       900
        
       			const response = await authRequest(

     

       901
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       902
        
       				userCookie,

     
···

       910
        
       	});

     

       911
        
       

     

       912
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       913
       +
       		test("should update user role as admin", async () => {

     

       914
        
       			const response = await authRequest(

     

       915
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       916
        
       				adminCookie,

     
···

       922
        
       			);

     

       923
        
       

     

       924
        
       			expect(response.status).toBe(200);

     

       0
        
       
     

       0
        
       
     

       925
        
       

     

       926
        
       			// Verify role updated

     

       927
        
       			const meResponse = await authRequest(

     
···

       932
        
       			expect(meData.role).toBe("admin");

     

       933
        
       		});

     

       934
        
       

     

       935
       +
       		test("should reject invalid roles", async () => {

     

       936
        
       			const response = await authRequest(

     

       937
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       938
        
       				adminCookie,

     
···

       948
        
       	});

     

       949
        
       

     

       950
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       951
       +
       		test("should return user details for admin", async () => {

     

       952
        
       			const response = await authRequest(

     

       953
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       954
        
       				adminCookie,

     
···

       962
        
       			expect(data).toHaveProperty("sessions");

     

       963
        
       		});

     

       964
        
       

     

       965
       +
       		test("should reject non-admin users", async () => {

     

       966
        
       			const response = await authRequest(

     

       967
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       968
        
       				userCookie,

     
···

       973
        
       	});

     

       974
        
       

     

       975
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       976
       +
       		test("should update user name as admin", async () => {

     

       977
        
       			const newName = "Admin Updated Name";

     

       978
        
       			const response = await authRequest(

     

       979
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       990
        
       			expect(data.success).toBe(true);

     

       991
        
       		});

     

       992
        
       

     

       993
       +
       		test("should reject empty names", async () => {

     

       994
        
       			const response = await authRequest(

     

       995
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       996
        
       				adminCookie,

     
···

       1006
        
       	});

     

       1007
        
       

     

       1008
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1009
       +
       		test("should update user email as admin", async () => {

     

       1010
        
       			const newEmail = "newemail@admin.com";

     

       1011
        
       			const response = await authRequest(

     

       1012
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1023
        
       			expect(data.success).toBe(true);

     

       1024
        
       		});

     

       1025
        
       

     

       1026
       +
       		test("should reject duplicate emails", async () => {

     

       1027
        
       			const response = await authRequest(

     

       1028
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1029
        
       				adminCookie,

     
···

       1034
        
       				},

     

       1035
        
       			);

     

       1036
        
       

     

       1037
       +
       			expect(response.status).toBe(409);

     

       1038
        
       			const data = await response.json();

     

       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1040
        
       		});

     

       1041
        
       	});

     

       1042
        
       

     

       1043
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1044
       +
       		test("should return user sessions as admin", async () => {

     

       1045
        
       			const response = await authRequest(

     

       1046
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1047
        
       				adminCookie,

     
···

       1054
        
       	});

     

       1055
        
       

     

       1056
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1057
       +
       		test("should delete all user sessions as admin", async () => {

     

       1058
        
       			const response = await authRequest(

     

       1059
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1060
        
       				adminCookie,

     
···

       1063
        
       				},

     

       1064
        
       			);

     

       1065
        
       

     

       1066
       +
       			expect(response.status).toBe(204);

     

       0
        
       
     

       0
        
       
     

       1067
        
       

     

       1068
        
       			// Verify sessions are deleted

     

       1069
        
       			const verifyResponse = await authRequest(

     
···

       1079
        
       	let sessionCookie: string;

     

       1080
        
       

     

       1081
        
       	beforeEach(async () => {

     

       1082
       +
       		// Register and login

     

       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1084
        
       	});

     

       1085
        
       

     

       1086
        
       	describe("GET /api/passkeys", () => {

     

       1087
       +
       		test("should return user passkeys", async () => {

     

       1088
        
       			const response = await authRequest(

     

       1089
        
       				`${BASE_URL}/api/passkeys`,

     

       1090
        
       				sessionCookie,

     
···

       1096
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1097
        
       		});

     

       1098
        
       

     

       1099
       +
       		test("should require authentication", async () => {

     

       1100
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1101
        
       

     

       1102
        
       			expect(response.status).toBe(401);

     
···

       1104
        
       	});

     

       1105
        
       

     

       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       +
       			const response = await authRequest(

     

       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       +
       				sessionCookie,

     

       1111
       +
       				{

     

       1112
       +
       					method: "POST",

     

       1113
       +
       				},

     

       1114
       +
       			);

     

       0
        
       
     

       0
        
       
     

       1115
        
       

     

       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       +
       			const data = await response.json();

     

       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       +
       		});

     

       0
        
       
     

       1122
        
       

     

       1123
       +
       		test("should require authentication", async () => {

     

       1124
        
       			const response = await fetch(

     

       1125
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1126
        
       				{

     
···

       1133
        
       	});

     

       1134
        
       

     

       1135
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1136
       +
       		test("should return authentication options for email", async () => {

     

       1137
        
       			const response = await fetch(

     

       1138
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1139
        
       				{

     
···

       1148
        
       			expect(data).toHaveProperty("challenge");

     

       1149
        
       		});

     

       1150
        
       

     

       1151
       +
       		test("should handle non-existent email", async () => {

     

       1152
        
       			const response = await fetch(

     

       1153
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1154
        
       				{

+1641 -488

src/index.ts

···

       2
        
       import {

     

       3
        
       	authenticateUser,

     

       4
        
       	cleanupExpiredSessions,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
       	createSession,

     

       6
        
       	createUser,

     

       7
        
       	deleteAllUserSessions,

     
···

       17
        
       	getUserByEmail,

     

       18
        
       	getUserBySession,

     

       19
        
       	getUserSessionsForUser,

     

       0
        
       
     

       0
        
       
     

       20
        
       	type UserRole,

     

       21
        
       	updateUserAvatar,

     

       22
        
       	updateUserEmail,

     
···

       24
        
       	updateUserName,

     

       25
        
       	updateUserPassword,

     

       26
        
       	updateUserRole,

     

       27
       -
       	createEmailVerificationToken,

     

       0
        
       
     

       28
        
       	verifyEmailToken,

     

       29
       -
       	verifyEmailCode,

     

       30
       -
       	isEmailVerified,

     

       31
       -
       	getVerificationCodeSentAt,

     

       32
       -
       	createPasswordResetToken,

     

       33
        
       	verifyPasswordResetToken,

     

       34
       -
       	consumePasswordResetToken,

     

       35
        
       } from "./lib/auth";

     

       36
        
       import {

     

       37
        
       	addToWaitlist,

     
···

       45
        
       	getClassById,

     

       46
        
       	getClassesForUser,

     

       47
        
       	getClassMembers,

     

       0
        
       
     

       0
        
       
     

       48
        
       	getMeetingTimesForClass,

     

       49
        
       	getTranscriptionsForClass,

     

       0
        
       
     

       50
        
       	isUserEnrolledInClass,

     

       51
        
       	joinClass,

     

       52
        
       	removeUserFromClass,

     

       53
        
       	searchClassesByCourseCode,

     

       54
        
       	toggleClassArchive,

     

       55
        
       	updateMeetingTime,

     

       0
        
       
     

       56
        
       } from "./lib/classes";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       57
        
       import { AuthErrors, handleError, ValidationErrors } from "./lib/errors";

     

       58
        
       import {

     

       59
        
       	hasActiveSubscription,

     
···

       70
        
       	verifyAndAuthenticatePasskey,

     

       71
        
       	verifyAndCreatePasskey,

     

       72
        
       } from "./lib/passkey";

     

       73
       -
       import { enforceRateLimit, clearRateLimit } from "./lib/rate-limit";

     

       74
        
       import { getTranscriptVTT } from "./lib/transcript-storage";

     

       75
        
       import {

     

       76
        
       	MAX_FILE_SIZE,

     
···

       78
        
       	type TranscriptionUpdate,

     

       79
        
       	WhisperServiceManager,

     

       80
        
       } from "./lib/transcription";

     

       81
       -
       import { sendEmail } from "./lib/email";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       82
        
       import {

     

       83
       -
       	verifyEmailTemplate,

     

       84
       -
       	passwordResetTemplate,

     

       85
       -
       } from "./lib/email-templates";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       86
        
       import adminHTML from "./pages/admin.html";

     

       87
        
       import checkoutHTML from "./pages/checkout.html";

     

       88
        
       import classHTML from "./pages/class.html";

     
···

       92
        
       import settingsHTML from "./pages/settings.html";

     

       93
        
       import transcribeHTML from "./pages/transcribe.html";

     

       94
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       95
        
       // Environment variables

     

       96
        
       const WHISPER_SERVICE_URL =

     

       97
        
       	process.env.WHISPER_SERVICE_URL || "http://localhost:8000";

     
···

       111
        
       	transcriptionEvents,

     

       112
        
       );

     

       113
        
       

     

       114
       -
       // Clean up expired sessions every hour

     

       115
       -
       setInterval(cleanupExpiredSessions, 60 * 60 * 1000);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       116
        
       

     

       117
        
       // Helper function to sync user subscriptions from Polar

     

       118
        
       async function syncUserSubscriptionsFromPolar(

     

       119
        
       	userId: number,

     

       120
        
       	email: string,

     

       121
        
       ): Promise<void> {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       122
        
       	try {

     

       123
        
       		const { polar } = await import("./lib/polar");

     

       124
        
       

     

       125
       -
       		// Search for customer by email

     

       126
        
       		const customers = await polar.customers.list({

     

       127
       -
       			organizationId: process.env.POLAR_ORGANIZATION_ID,

     

       128
        
       			query: email,

     

       129
        
       		});

     

       130
        
       

     
···

       140
        
       			customerId: customer.id,

     

       141
        
       		});

     

       142
        
       

     

       143
       -
       		if (!subscriptions.result.items || subscriptions.result.items.length === 0) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       144
        
       			console.log(`[Sync] No subscriptions found for customer ${customer.id}`);

     

       145
        
       			return;

     

       146
        
       		}

     

       147
        
       

     

       148
       -
       		// Update each subscription in the database

     

       149
       -
       		for (const subscription of subscriptions.result.items) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       150
        
       			db.run(

     

       151
        
       				`INSERT INTO subscriptions (id, user_id, customer_id, status, current_period_start, current_period_end, cancel_at_period_end, canceled_at, updated_at)

     

       152
        
       				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

     
···

       183
        
       		}

     

       184
        
       

     

       185
        
       		console.log(

     

       186
       -
       			`[Sync] Linked ${subscriptions.result.items.length} subscription(s) to user ${userId} (${email})`,

     

       187
        
       		);

     

       188
        
       	} catch (error) {

     

       189
        
       		console.error(

     
···

       193
        
       		// Don't throw - registration should succeed even if sync fails

     

       194
        
       	}

     

       195
        
       }

     

       196
       -
       

     

       197
        
       

     

       198
        
       // Sync with Whisper DB on startup

     

       199
        
       try {

     
···

       207
        
       }

     

       208
        
       

     

       209
        
       // Periodic sync every 5 minutes as backup (SSE handles real-time updates)

     

       210
       -
       setInterval(

     

       211
        
       	async () => {

     

       212
        
       		try {

     

       213
        
       			await whisperService.syncWithWhisper();

     
···

       221
        
       	5 * 60 * 1000,

     

       222
        
       );

     

       223
        
       

     

       224
       -
       // Clean up stale files daily

     

       225
       -
       setInterval(() => whisperService.cleanupStaleFiles(), 24 * 60 * 60 * 1000);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       226
        
       

     

       227
        
       const server = Bun.serve({

     

       228
       -
       	port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       229
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       230
        
       	routes: {

     

       231
        
       		"/": indexHTML,

     
···

       258
        
       							{ status: 400 },

     

       259
        
       						);

     

       260
        
       					}

     

       261
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       262
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       0
        
       
     

       263
        
       						return Response.json(

     

       264
       -
       							{ error: "Invalid password format" },

     

       265
        
       							{ status: 400 },

     

       266
        
       						);

     

       267
        
       					}

     

       268
        
       					const user = await createUser(email, password, name);

     

       269
       -
       					

     

       270
        
       					// Send verification email - MUST succeed for registration to complete

     

       271
        
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       272
       -
       					

     

       273
        
       					try {

     

       274
        
       						await sendEmail({

     

       275
        
       							to: user.email,

     
···

       283
        
       					} catch (err) {

     

       284
        
       						console.error("[Email] Failed to send verification email:", err);

     

       285
        
       						// Rollback user creation - direct DB delete since user was just created

     

       286
       -
       						db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [user.id]);

     

       0
        
       
     

       0
        
       
     

       287
        
       						db.run("DELETE FROM sessions WHERE user_id = ?", [user.id]);

     

       288
        
       						db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       289
        
       						return Response.json(

     

       290
       -
       							{ error: "Failed to send verification email. Please try again later." },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       291
        
       							{ status: 500 },

     

       292
        
       						);

     

       293
        
       					}

     

       294
       -
       					

     

       295
        
       					// Attempt to sync existing Polar subscriptions (after email succeeds)

     

       296
        
       					syncUserSubscriptionsFromPolar(user.id, user.email).catch(() => {

     

       297
        
       						// Silent fail - don't block registration

     

       298
        
       					});

     

       299
       -
       					

     

       300
        
       					// Clear rate limits on successful registration

     

       301
        
       					const ipAddress =

     

       302
        
       						req.headers.get("x-forwarded-for") ??

     

       303
        
       						req.headers.get("x-real-ip") ??

     

       304
        
       						"unknown";

     

       305
        
       					clearRateLimit("register", email, ipAddress);

     

       306
       -
       					

     

       307
        
       					// Return success but indicate email verification is needed

     

       308
        
       					// Don't create session yet - they need to verify first

     

       309
        
       					return Response.json(

     

       310
       -
       						{ 

     

       311
        
       							user: { id: user.id, email: user.email },

     

       312
        
       							email_verification_required: true,

     

       313
        
       							verification_code_sent_at: sentAt,

     

       314
        
       						},

     

       315
       -
       						{ status: 200 },

     

       316
        
       					);

     

       317
        
       				} catch (err: unknown) {

     

       318
        
       					const error = err as { message?: string };

     

       319
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       320
        
       						return Response.json(

     

       321
        
       							{ error: "Email already registered" },

     

       322
       -
       							{ status: 400 },

     

       323
        
       						);

     

       324
        
       					}

     

       325
        
       					console.error("[Auth] Registration error:", err);

     
···

       349
        
       					});

     

       350
        
       					if (rateLimitError) return rateLimitError;

     

       351
        
       

     

       352
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       353
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       0
        
       
     

       354
        
       						return Response.json(

     

       355
       -
       							{ error: "Invalid password format" },

     

       356
        
       							{ status: 400 },

     

       357
        
       						);

     

       358
        
       					}

     
···

       363
        
       							{ status: 401 },

     

       364
        
       						);

     

       365
        
       					}

     

       366
       -
       					

     

       367
        
       					// Clear rate limits on successful authentication

     

       368
        
       					const ipAddress =

     

       369
        
       						req.headers.get("x-forwarded-for") ??

     

       370
        
       						req.headers.get("x-real-ip") ??

     

       371
        
       						"unknown";

     

       372
        
       					clearRateLimit("login", email, ipAddress);

     

       373
       -
       					

     

       374
        
       					// Check if email is verified

     

       375
        
       					if (!isEmailVerified(user.id)) {

     

       376
        
       						let codeSentAt = getVerificationCodeSentAt(user.id);

     

       377
       -
       						

     

       378
        
       						// If no verification code exists, auto-send one

     

       379
        
       						if (!codeSentAt) {

     

       380
       -
       							const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       0
        
       
     

       0
        
       
     

       381
        
       							codeSentAt = sentAt;

     

       382
       -
       							

     

       383
        
       							try {

     

       384
        
       								await sendEmail({

     

       385
        
       									to: user.email,

     
···

       391
        
       									}),

     

       392
        
       								});

     

       393
        
       							} catch (err) {

     

       394
       -
       								console.error("[Email] Failed to send verification email on login:", err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       395
        
       								// Don't fail login - just return null timestamp so client can try resend

     

       396
        
       								codeSentAt = null;

     

       397
        
       							}

     

       398
        
       						}

     

       399
       -
       						

     

       400
        
       						return Response.json(

     

       401
       -
       							{ 

     

       402
        
       								user: { id: user.id, email: user.email },

     

       403
        
       								email_verification_required: true,

     

       404
        
       								verification_code_sent_at: codeSentAt,

     
···

       406
        
       							{ status: 200 },

     

       407
        
       						);

     

       408
        
       					}

     

       409
       -
       					

     

       410
        
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       411
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       412
        
       					return Response.json(

     
···

       451
        
       					return new Response(null, {

     

       452
        
       						status: 302,

     

       453
        
       						headers: {

     

       454
       -
       							"Location": "/classes",

     

       455
        
       							"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       456
        
       						},

     

       457
        
       					});

     
···

       475
        
       					// Get user by email

     

       476
        
       					const user = getUserByEmail(email);

     

       477
        
       					if (!user) {

     

       478
       -
       						return Response.json(

     

       479
       -
       							{ error: "User not found" },

     

       480
       -
       							{ status: 404 },

     

       481
       -
       						);

     

       482
        
       					}

     

       483
        
       

     

       484
        
       					// Check if already verified

     
···

       507
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       508
        
       

     

       509
        
       					return Response.json(

     

       510
       -
       						{ 

     

       0
        
       
     

       511
        
       							message: "Email verified successfully",

     

       512
        
       							email_verified: true,

     

       513
        
       							user: { id: user.id, email: user.email },

     
···

       527
        
       			POST: async (req) => {

     

       528
        
       				try {

     

       529
        
       					const user = requireAuth(req);

     

       530
       -
       					

     

       531
        
       					// Rate limiting

     

       532
        
       					const rateLimitError = enforceRateLimit(req, "resend-verification", {

     

       533
        
       						account: { max: 3, windowSeconds: 60 * 60, email: user.email },

     
···

       555
        
       						}),

     

       556
        
       					});

     

       557
        
       

     

       558
       -
       					return Response.json({ message: "Verification email sent" });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       559
        
       				} catch (error) {

     

       560
        
       					return handleError(error);

     

       561
        
       				}

     
···

       572
        
       					}

     

       573
        
       

     

       574
        
       					// Rate limiting by email

     

       575
       -
       					const rateLimitError = enforceRateLimit(req, "resend-verification-code", {

     

       576
       -
       						account: { max: 3, windowSeconds: 5 * 60, email },

     

       577
       -
       					});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       578
        
       					if (rateLimitError) return rateLimitError;

     

       579
        
       

     

       580
        
       					// Get user by email

     

       581
        
       					const user = getUserByEmail(email);

     

       582
        
       					if (!user) {

     

       583
        
       						// Don't reveal if user exists

     

       584
       -
       						return Response.json({ message: "If an account exists with that email, a verification code has been sent" });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       585
        
       					}

     

       586
        
       

     

       587
        
       					// Check if already verified

     
···

       605
        
       						}),

     

       606
        
       					});

     

       607
        
       

     

       608
       -
       					return Response.json({ 

     

       0
        
       
     

       609
        
       						message: "Verification code sent",

     

       610
        
       						verification_code_sent_at: sentAt,

     

       611
        
       					});

     
···

       633
        
       					// Always return success to prevent email enumeration

     

       634
        
       					const user = getUserByEmail(email);

     

       635
        
       					if (user) {

     

       636
       -
       						const origin =

     

       637
       -
       							req.headers.get("origin") || "http://localhost:3000";

     

       638
        
       						const resetToken = createPasswordResetToken(user.id);

     

       639
        
       						const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       640
        
       

     
···

       651
        
       					}

     

       652
        
       

     

       653
        
       					return Response.json({

     

       0
        
       
     

       654
        
       						message:

     

       655
        
       							"If an account exists with that email, a password reset link has been sent",

     

       656
        
       					});

     
···

       664
        
       			},

     

       665
        
       		},

     

       666
        
       		"/api/auth/reset-password": {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       667
        
       			POST: async (req) => {

     

       668
        
       				try {

     

       669
        
       					const body = await req.json();

     
···

       677
        
       					}

     

       678
        
       

     

       679
        
       					// Validate password format (client-side hashed PBKDF2)

     

       680
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       0
        
       
     

       681
        
       						return Response.json(

     

       682
       -
       							{ error: "Invalid password format" },

     

       683
        
       							{ status: 400 },

     

       684
        
       						);

     

       685
        
       					}

     
···

       696
        
       					await updateUserPassword(userId, password);

     

       697
        
       					consumePasswordResetToken(token);

     

       698
        
       

     

       699
       -
       					return Response.json({ message: "Password reset successfully" });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       700
        
       				} catch (error) {

     

       701
        
       					console.error("[Email] Reset password error:", error);

     

       702
        
       					return Response.json(

     
···

       725
        
       		},

     

       726
        
       		"/api/auth/me": {

     

       727
        
       			GET: (req) => {

     

       728
       -
       				const sessionId = getSessionFromRequest(req);

     

       729
       -
       				if (!sessionId) {

     

       730
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       731
       -
       				}

     

       732
       -
       				const user = getUserBySession(sessionId);

     

       733
       -
       				if (!user) {

     

       734
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       735
       -
       				}

     

       736
        
       

     

       737
       -
       				// Check subscription status

     

       738
       -
       				const subscription = db

     

       739
       -
       					.query<{ status: string }, [number]>(

     

       740
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       741
       -
       					)

     

       742
       -
       					.get(user.id);

     

       743
        
       

     

       744
       -
       				// Get notification preferences

     

       745
       -
       				const prefs = db

     

       746
       -
       					.query<{ email_notifications_enabled: number }, [number]>(

     

       747
       -
       						"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       748
       -
       					)

     

       749
       -
       					.get(user.id);

     

       750
        
       

     

       751
       -
       				return Response.json({

     

       752
       -
       					email: user.email,

     

       753
       -
       					name: user.name,

     

       754
       -
       					avatar: user.avatar,

     

       755
       -
       					created_at: user.created_at,

     

       756
       -
       					role: user.role,

     

       757
       -
       					has_subscription: !!subscription,

     

       758
       -
       					email_verified: isEmailVerified(user.id),

     

       759
       -
       					email_notifications_enabled: prefs?.email_notifications_enabled === 1,

     

       760
       -
       				});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       761
        
       			},

     

       762
        
       		},

     

       763
        
       		"/api/passkeys/register/options": {

     

       764
        
       			POST: async (req) => {

     

       765
        
       				try {

     

       766
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       767
        
       					const options = await createRegistrationOptions(user);

     

       768
        
       					return Response.json(options);

     

       769
        
       				} catch (err) {

     
···

       775
        
       			POST: async (req) => {

     

       776
        
       				try {

     

       777
        
       					const _user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       778
        
       					const body = await req.json();

     

       779
        
       					const { response: credentialResponse, challenge, name } = body;

     

       780
        
       

     
···

       800
        
       		"/api/passkeys/authenticate/options": {

     

       801
        
       			POST: async (req) => {

     

       802
        
       				try {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       803
        
       					const body = await req.json();

     

       804
        
       					const { email } = body;

     

       805
        
       

     
···

       813
        
       		"/api/passkeys/authenticate/verify": {

     

       814
        
       			POST: async (req) => {

     

       815
        
       				try {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       816
        
       					const body = await req.json();

     

       817
        
       					const { response: credentialResponse, challenge } = body;

     

       818
        
       

     
···

       878
        
       			PUT: async (req) => {

     

       879
        
       				try {

     

       880
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       881
        
       					const body = await req.json();

     

       882
        
       					const { name } = body;

     

       883
        
       					const passkeyId = req.params.id;

     
···

       887
        
       					}

     

       888
        
       

     

       889
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       890
       -
       					return Response.json({ success: true });

     

       891
        
       				} catch (err) {

     

       892
        
       					return handleError(err);

     

       893
        
       				}

     
···

       895
        
       			DELETE: async (req) => {

     

       896
        
       				try {

     

       897
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       898
        
       					const passkeyId = req.params.id;

     

       899
        
       					deletePasskey(passkeyId, user.id);

     

       900
       -
       					return Response.json({ success: true });

     

       901
        
       				} catch (err) {

     

       902
        
       					return handleError(err);

     

       903
        
       				}

     
···

       905
        
       		},

     

       906
        
       		"/api/sessions": {

     

       907
        
       			GET: (req) => {

     

       908
       -
       				const sessionId = getSessionFromRequest(req);

     

       909
       -
       				if (!sessionId) {

     

       910
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       911
        
       				}

     

       912
       -
       				const user = getUserBySession(sessionId);

     

       913
       -
       				if (!user) {

     

       914
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       915
       -
       				}

     

       916
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       917
       -
       				return Response.json({

     

       918
       -
       					sessions: sessions.map((s) => ({

     

       919
       -
       						id: s.id,

     

       920
       -
       						ip_address: s.ip_address,

     

       921
       -
       						user_agent: s.user_agent,

     

       922
       -
       						created_at: s.created_at,

     

       923
       -
       						expires_at: s.expires_at,

     

       924
       -
       						is_current: s.id === sessionId,

     

       925
       -
       					})),

     

       926
       -
       				});

     

       927
        
       			},

     

       928
        
       			DELETE: async (req) => {

     

       929
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       930
       -
       				if (!currentSessionId) {

     

       931
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       932
       -
       				}

     

       933
       -
       				const user = getUserBySession(currentSessionId);

     

       934
       -
       				if (!user) {

     

       935
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       936
       -
       				}

     

       937
       -
       				const body = await req.json();

     

       938
       -
       				const targetSessionId = body.sessionId;

     

       939
       -
       				if (!targetSessionId) {

     

       940
       -
       					return Response.json(

     

       941
       -
       						{ error: "Session ID required" },

     

       942
       -
       						{ status: 400 },

     

       943
       -
       					);

     

       944
       -
       				}

     

       945
       -
       				// Prevent deleting current session

     

       946
       -
       				if (targetSessionId === currentSessionId) {

     

       947
       -
       					return Response.json(

     

       948
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       949
       -
       						{ status: 400 },

     

       950
       -
       					);

     

       951
       -
       				}

     

       952
       -
       				// Verify the session belongs to the user

     

       953
       -
       				const targetSession = getSession(targetSessionId);

     

       954
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       955
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       956
        
       				}

     

       957
       -
       				deleteSession(targetSessionId);

     

       958
       -
       				return Response.json({ success: true });

     

       959
        
       			},

     

       960
        
       		},

     

       961
        
       		"/api/user": {

     

       962
        
       			DELETE: async (req) => {

     

       963
       -
       				const sessionId = getSessionFromRequest(req);

     

       964
       -
       				if (!sessionId) {

     

       965
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       966
       -
       				}

     

       967
       -
       				const user = getUserBySession(sessionId);

     

       968
       -
       				if (!user) {

     

       969
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       970
       -
       				}

     

       971
        
       

     

       972
       -
       				// Rate limiting

     

       973
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       974
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       975
       -
       				});

     

       976
       -
       				if (rateLimitError) return rateLimitError;

     

       977
        
       

     

       978
       -
       				await deleteUser(user.id);

     

       979
       -
       				return Response.json(

     

       980
       -
       					{ success: true },

     

       981
       -
       					{

     

       982
        
       						headers: {

     

       983
        
       							"Set-Cookie":

     

       984
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       985
        
       						},

     

       986
       -
       					},

     

       987
       -
       				);

     

       0
        
       
     

       0
        
       
     

       988
        
       			},

     

       989
        
       		},

     

       990
        
       		"/api/user/email": {

     

       991
        
       			PUT: async (req) => {

     

       992
       -
       				const sessionId = getSessionFromRequest(req);

     

       993
       -
       				if (!sessionId) {

     

       994
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       995
       -
       				}

     

       996
       -
       				const user = getUserBySession(sessionId);

     

       997
       -
       				if (!user) {

     

       998
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       999
       -
       				}

     

       1000
        
       

     

       1001
       -
       				// Rate limiting

     

       1002
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1003
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1004
       -
       				});

     

       1005
       -
       				if (rateLimitError) return rateLimitError;

     

       1006
        
       

     

       1007
       -
       				const body = await req.json();

     

       1008
       -
       				const { email } = body;

     

       1009
       -
       				if (!email) {

     

       1010
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1011
       -
       				}

     

       1012
       -
       				try {

     

       1013
       -
       					updateUserEmail(user.id, email);

     

       1014
       -
       					return Response.json({ success: true });

     

       1015
       -
       				} catch (err: unknown) {

     

       1016
       -
       					const error = err as { message?: string };

     

       1017
       -
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       1018
        
       						return Response.json(

     

       1019
        
       							{ error: "Email already in use" },

     

       1020
       -
       							{ status: 400 },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1021
        
       						);

     

       1022
        
       					}

     

       1023
       -
       					return Response.json(

     

       1024
       -
       						{ error: "Failed to update email" },

     

       1025
       -
       						{ status: 500 },

     

       1026
       -
       					);

     

       1027
        
       				}

     

       1028
        
       			},

     

       1029
        
       		},

     

       1030
       -
       		"/api/user/password": {

     

       1031
       -
       			PUT: async (req) => {

     

       1032
       -
       				const sessionId = getSessionFromRequest(req);

     

       1033
       -
       				if (!sessionId) {

     

       1034
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1035
       -
       				}

     

       1036
       -
       				const user = getUserBySession(sessionId);

     

       1037
       -
       				if (!user) {

     

       1038
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1039
       -
       				}

     

       1040
        
       

     

       1041
       -
       				// Rate limiting

     

       1042
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1043
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1044
       -
       				});

     

       1045
       -
       				if (rateLimitError) return rateLimitError;

     

       0
        
       
     

       1046
        
       

     

       1047
       -
       				const body = await req.json();

     

       1048
       -
       				const { password } = body;

     

       1049
       -
       				if (!password) {

     

       1050
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       1051
       -
       				}

     

       1052
       -
       				// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       1053
       -
       				if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       1054
       -
       					return Response.json(

     

       1055
       -
       						{ error: "Invalid password format" },

     

       1056
       -
       						{ status: 400 },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1057
        
       					);

     

       1058
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1059
        
       				try {

     

       1060
       -
       					await updateUserPassword(user.id, password);

     

       1061
       -
       					return Response.json({ success: true });

     

       1062
       -
       				} catch {

     

       1063
       -
       					return Response.json(

     

       1064
       -
       						{ error: "Failed to update password" },

     

       1065
       -
       						{ status: 500 },

     

       1066
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1067
        
       				}

     

       1068
        
       			},

     

       1069
        
       		},

     

       1070
        
       		"/api/user/name": {

     

       1071
        
       			PUT: async (req) => {

     

       1072
       -
       				const sessionId = getSessionFromRequest(req);

     

       1073
       -
       				if (!sessionId) {

     

       1074
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1075
       -
       				}

     

       1076
       -
       				const user = getUserBySession(sessionId);

     

       1077
       -
       				if (!user) {

     

       1078
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1079
       -
       				}

     

       1080
       -
       				const body = await req.json();

     

       1081
       -
       				const { name } = body;

     

       1082
       -
       				if (!name) {

     

       1083
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       1084
       -
       				}

     

       1085
        
       				try {

     

       1086
       -
       					updateUserName(user.id, name);

     

       1087
       -
       					return Response.json({ success: true });

     

       1088
       -
       				} catch {

     

       1089
       -
       					return Response.json(

     

       1090
       -
       						{ error: "Failed to update name" },

     

       1091
       -
       						{ status: 500 },

     

       1092
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1093
        
       				}

     

       1094
        
       			},

     

       1095
        
       		},

     

       1096
        
       		"/api/user/avatar": {

     

       1097
        
       			PUT: async (req) => {

     

       1098
       -
       				const sessionId = getSessionFromRequest(req);

     

       1099
       -
       				if (!sessionId) {

     

       1100
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1101
       -
       				}

     

       1102
       -
       				const user = getUserBySession(sessionId);

     

       1103
       -
       				if (!user) {

     

       1104
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1105
       -
       				}

     

       1106
       -
       				const body = await req.json();

     

       1107
       -
       				const { avatar } = body;

     

       1108
       -
       				if (!avatar) {

     

       1109
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1110
       -
       				}

     

       1111
        
       				try {

     

       1112
       -
       					updateUserAvatar(user.id, avatar);

     

       1113
       -
       					return Response.json({ success: true });

     

       1114
       -
       				} catch {

     

       1115
       -
       					return Response.json(

     

       1116
       -
       						{ error: "Failed to update avatar" },

     

       1117
       -
       						{ status: 500 },

     

       1118
       -
       					);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1119
        
       				}

     

       1120
        
       			},

     

       1121
        
       		},

     

       1122
        
       		"/api/user/notifications": {

     

       1123
        
       			PUT: async (req) => {

     

       1124
       -
       				const sessionId = getSessionFromRequest(req);

     

       1125
       -
       				if (!sessionId) {

     

       1126
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1127
       -
       				}

     

       1128
       -
       				const user = getUserBySession(sessionId);

     

       1129
       -
       				if (!user) {

     

       1130
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1131
       -
       				}

     

       1132
       -
       				const body = await req.json();

     

       1133
       -
       				const { email_notifications_enabled } = body;

     

       1134
       -
       				if (typeof email_notifications_enabled !== "boolean") {

     

       1135
       -
       					return Response.json({ error: "email_notifications_enabled must be a boolean" }, { status: 400 });

     

       1136
       -
       				}

     

       1137
        
       				try {

     

       1138
       -
       					db.run("UPDATE users SET email_notifications_enabled = ? WHERE id = ?", [email_notifications_enabled ? 1 : 0, user.id]);

     

       1139
       -
       					return Response.json({ success: true });

     

       1140
       -
       				} catch {

     

       1141
       -
       					return Response.json(

     

       1142
       -
       						{ error: "Failed to update notification settings" },

     

       1143
       -
       						{ status: 500 },

     

       1144
       -
       					);

     

       1145
       -
       				}

     

       1146
       -
       			},

     

       1147
       -
       		},

     

       1148
       -
       		"/api/billing/checkout": {

     

       1149
       -
       			POST: async (req) => {

     

       1150
       -
       				const sessionId = getSessionFromRequest(req);

     

       1151
       -
       				if (!sessionId) {

     

       1152
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1153
       -
       				}

     

       1154
       -
       				const user = getUserBySession(sessionId);

     

       1155
       -
       				if (!user) {

     

       1156
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1157
       -
       				}

     

       1158
        
       

     

       1159
       -
       				try {

     

       1160
       -
       					const { polar } = await import("./lib/polar");

     

       0
        
       
     

       0
        
       
     

       1161
        
       

     

       1162
       -
       					const productId = process.env.POLAR_PRODUCT_ID;

     

       1163
       -
       					if (!productId) {

     

       0
        
       
     

       1164
        
       						return Response.json(

     

       1165
       -
       							{ error: "Product not configured" },

     

       1166
       -
       							{ status: 500 },

     

       1167
        
       						);

     

       1168
        
       					}

     

       1169
       -
       

     

       1170
       -
       					const successUrl = process.env.POLAR_SUCCESS_URL;

     

       1171
       -
       					if (!successUrl) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1172
        
       						return Response.json(

     

       1173
       -
       							{ error: "Success URL not configured" },

     

       1174
        
       							{ status: 500 },

     

       1175
        
       						);

     

       1176
        
       					}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1177
        
       

     

       1178
        
       					const checkout = await polar.checkouts.create({

     

       1179
        
       						products: [productId],

     
···

       1186
        
       					});

     

       1187
        
       

     

       1188
        
       					return Response.json({ url: checkout.url });

     

       1189
       -
       				} catch (error) {

     

       1190
       -
       					console.error("Failed to create checkout:", error);

     

       1191
       -
       					return Response.json(

     

       1192
       -
       						{ error: "Failed to create checkout session" },

     

       1193
       -
       						{ status: 500 },

     

       1194
       -
       					);

     

       1195
        
       				}

     

       1196
        
       			},

     

       1197
        
       		},

     

       1198
        
       		"/api/billing/subscription": {

     

       1199
        
       			GET: async (req) => {

     

       1200
       -
       				const sessionId = getSessionFromRequest(req);

     

       1201
       -
       				if (!sessionId) {

     

       1202
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1203
       -
       				}

     

       1204
       -
       				const user = getUserBySession(sessionId);

     

       1205
       -
       				if (!user) {

     

       1206
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1207
       -
       				}

     

       1208
        
       

     

       1209
       -
       				try {

     

       1210
        
       					// Get subscription from database

     

       1211
        
       					const subscription = db

     

       1212
        
       						.query<

     
···

       1229
        
       					}

     

       1230
        
       

     

       1231
        
       					return Response.json({ subscription });

     

       1232
       -
       				} catch (error) {

     

       1233
       -
       					console.error("Failed to fetch subscription:", error);

     

       1234
       -
       					return Response.json(

     

       1235
       -
       						{ error: "Failed to fetch subscription" },

     

       1236
       -
       						{ status: 500 },

     

       1237
       -
       					);

     

       1238
        
       				}

     

       1239
        
       			},

     

       1240
        
       		},

     

       1241
        
       		"/api/billing/portal": {

     

       1242
        
       			POST: async (req) => {

     

       1243
       -
       				const sessionId = getSessionFromRequest(req);

     

       1244
       -
       				if (!sessionId) {

     

       1245
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1246
       -
       				}

     

       1247
       -
       				const user = getUserBySession(sessionId);

     

       1248
       -
       				if (!user) {

     

       1249
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1250
       -
       				}

     

       1251
        
       

     

       1252
       -
       				try {

     

       1253
        
       					const { polar } = await import("./lib/polar");

     

       1254
        
       

     

       1255
        
       					// Get subscription to find customer ID

     
···

       1277
        
       					});

     

       1278
        
       

     

       1279
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1280
       -
       				} catch (error) {

     

       1281
       -
       					console.error("Failed to create portal session:", error);

     

       1282
       -
       					return Response.json(

     

       1283
       -
       						{ error: "Failed to create portal session" },

     

       1284
       -
       						{ status: 500 },

     

       1285
       -
       					);

     

       1286
        
       				}

     

       1287
        
       			},

     

       1288
        
       		},

     

       1289
        
       		"/api/webhooks/polar": {

     

       1290
        
       			POST: async (req) => {

     

       1291
       -
       				try {

     

       1292
       -
       					const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1293
        
       

     

       1294
       -
       					// Get raw body as string

     

       1295
       -
       					const rawBody = await req.text();

     

       1296
       -
       					const headers = Object.fromEntries(req.headers.entries());

     

       1297
        
       

     

       1298
       -
       					// Validate webhook signature

     

       1299
       -
       					const webhookSecret = process.env.POLAR_WEBHOOK_SECRET;

     

       1300
       -
       					if (!webhookSecret) {

     

       1301
       -
       						console.error("[Webhook] POLAR_WEBHOOK_SECRET not configured");

     

       1302
       -
       						return Response.json(

     

       1303
       -
       							{ error: "Webhook secret not configured" },

     

       1304
       -
       							{ status: 500 },

     

       1305
       -
       						);

     

       1306
       -
       					}

     

       1307
       -
       

     

       1308
       -
       					const event = validateEvent(rawBody, headers, webhookSecret);

     

       1309
        
       

     

       1310
       -
       					console.log(`[Webhook] Received event: ${event.type}`);

     

       1311
        
       

     

       1312
       -
       					// Handle different event types

     

       0
        
       
     

       1313
        
       					switch (event.type) {

     

       1314
        
       						case "subscription.updated": {

     

       1315
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       1370
        
       

     

       1371
        
       					return Response.json({ received: true });

     

       1372
        
       				} catch (error) {

     

       1373
       -
       					console.error("[Webhook] Error processing webhook:", error);

     

       1374
       -
       					return Response.json(

     

       1375
       -
       						{ error: "Webhook processing failed" },

     

       1376
       -
       						{ status: 400 },

     

       1377
       -
       					);

     

       1378
        
       				}

     

       1379
        
       			},

     

       1380
        
       		},

     
···

       1385
        
       					const transcriptionId = req.params.id;

     

       1386
        
       					// Verify ownership

     

       1387
        
       					const transcription = db

     

       1388
       -
       						.query<{ id: string; user_id: number; class_id: string | null; status: string }, [string]>(

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1389
        
       							"SELECT id, user_id, class_id, status FROM transcriptions WHERE id = ?",

     

       1390
        
       						)

     

       1391
        
       						.get(transcriptionId);

     

       1392
       -
       					

     

       1393
        
       					if (!transcription) {

     

       1394
        
       						return Response.json(

     

       1395
        
       							{ error: "Transcription not found" },

     
···

       1404
        
       

     

       1405
        
       					// If transcription belongs to a class, check enrollment

     

       1406
        
       					if (transcription.class_id) {

     

       1407
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1408
        
       					}

     

       1409
        
       

     

       1410
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1411
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1412
       -
       						return Response.json(

     

       1413
       -
       							{ error: "Transcription not found" },

     

       1414
       -
       							{ status: 404 },

     

       1415
       -
       						);

     

       1416
        
       					}

     

       1417
        
       

     

       1418
        
       					// Require subscription only if accessing own transcription (not class)

     

       1419
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1420
        
       						throw AuthErrors.subscriptionRequired();

     

       1421
        
       					}

     

       1422
        
       					// Event-driven SSE stream with reconnection support

     

       1423
        
       					const stream = new ReadableStream({

     

       1424
        
       						async start(controller) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1425
        
       							const encoder = new TextEncoder();

     

       1426
        
       							let isClosed = false;

     

       1427
        
       							let lastEventId = Math.floor(Date.now() / 1000);

     
···

       1472
        
       								current?.status === "failed"

     

       1473
        
       							) {

     

       1474
        
       								isClosed = true;

     

       0
        
       
     

       1475
        
       								controller.close();

     

       1476
        
       								return;

     

       1477
        
       							}

     
···

       1502
        
       									isClosed = true;

     

       1503
        
       									clearInterval(heartbeatInterval);

     

       1504
        
       									transcriptionEvents.off(transcriptionId, updateHandler);

     

       0
        
       
     

       1505
        
       									controller.close();

     

       1506
        
       								}

     

       1507
        
       							};

     
···

       1511
        
       								isClosed = true;

     

       1512
        
       								clearInterval(heartbeatInterval);

     

       1513
        
       								transcriptionEvents.off(transcriptionId, updateHandler);

     

       0
        
       
     

       1514
        
       							};

     

       1515
        
       						},

     

       1516
        
       					});

     
···

       1526
        
       				}

     

       1527
        
       			},

     

       1528
        
       		},

     

       1529
       -
       		"/api/transcriptions/health": {

     

       1530
        
       			GET: async () => {

     

       1531
       -
       				const isHealthy = await whisperService.checkHealth();

     

       1532
       -
       				return Response.json({ available: isHealthy });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1533
        
       			},

     

       1534
        
       		},

     

       1535
        
       		"/api/transcriptions/:id": {

     
···

       1571
        
       

     

       1572
        
       					// If transcription belongs to a class, check enrollment

     

       1573
        
       					if (transcription.class_id) {

     

       1574
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1575
        
       					}

     

       1576
        
       

     

       1577
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1578
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1579
       -
       						return Response.json(

     

       1580
       -
       							{ error: "Transcription not found" },

     

       1581
       -
       							{ status: 404 },

     

       1582
       -
       						);

     

       1583
        
       					}

     

       1584
        
       

     

       1585
        
       					// Require subscription only if accessing own transcription (not class)

     

       1586
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1587
        
       						throw AuthErrors.subscriptionRequired();

     

       1588
        
       					}

     

       1589
        
       

     

       1590
        
       					if (transcription.status !== "completed") {

     

       1591
        
       						return Response.json(

     

       1592
        
       							{ error: "Transcription not completed yet" },

     

       1593
       -
       							{ status: 400 },

     

       1594
        
       						);

     

       1595
        
       					}

     

       1596
        
       

     
···

       1671
        
       

     

       1672
        
       					// If transcription belongs to a class, check enrollment

     

       1673
        
       					if (transcription.class_id) {

     

       1674
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1675
        
       					}

     

       1676
        
       

     

       1677
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1678
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1679
       -
       						return Response.json(

     

       1680
       -
       							{ error: "Transcription not found" },

     

       1681
       -
       							{ status: 404 },

     

       1682
       -
       						);

     

       1683
        
       					}

     

       1684
        
       

     

       1685
        
       					// Require subscription only if accessing own transcription (not class)

     

       1686
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1687
        
       						throw AuthErrors.subscriptionRequired();

     

       1688
        
       					}

     

       1689
        
       

     
···

       1746
        
       				}

     

       1747
        
       			},

     

       1748
        
       		},

     

       1749
       -
       		"/api/transcriptions": {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1750
        
       			GET: async (req) => {

     

       1751
        
       				try {

     

       1752
       -
       					const user = requireSubscription(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1753
        
       

     

       1754
       -
       					const transcriptions = db

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1755
        
       						.query<

     

       1756
       -
       							{

     

       1757
       -
       								id: string;

     

       1758
       -
       								filename: string;

     

       1759
       -
       								original_filename: string;

     

       1760
       -
       								class_id: string | null;

     

       1761
       -
       								status: string;

     

       1762
       -
       								progress: number;

     

       1763
       -
       								created_at: number;

     

       1764
       -
       							},

     

       1765
       -
       							[number]

     

       1766
        
       						>(

     

       1767
       -
       							"SELECT id, filename, original_filename, class_id, status, progress, created_at FROM transcriptions WHERE user_id = ? ORDER BY created_at DESC",

     

       1768
        
       						)

     

       1769
       -
       						.all(user.id);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1770
        
       

     

       1771
        
       					// Load transcripts from files for completed jobs

     

       1772
        
       					const jobs = await Promise.all(

     
···

       1782
        
       						}),

     

       1783
        
       					);

     

       1784
        
       

     

       1785
       -
       					return Response.json({ jobs });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1786
        
       				} catch (error) {

     

       1787
        
       					return handleError(error);

     

       1788
        
       				}

     
···

       1791
        
       				try {

     

       1792
        
       					const user = requireSubscription(req);

     

       1793
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1794
        
       					const formData = await req.formData();

     

       1795
        
       					const file = formData.get("audio") as File;

     

       1796
        
       					const classId = formData.get("class_id") as string | null;

     

       1797
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       0
        
       
     

       1798
        
       						| string

     

       1799
        
       						| null;

     

       1800
        
       

     
···

       1863
        
       					const uploadDir = "./uploads";

     

       1864
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       1865
        
       

     

       1866
       -
       					// Create database record

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1867
        
       					db.run(

     

       1868
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       1869
        
       						[

     

       1870
        
       							transcriptionId,

     

       1871
        
       							user.id,

     

       1872
        
       							classId,

     

       1873
       -
       							meetingTimeId,

     

       0
        
       
     

       1874
        
       							filename,

     

       1875
        
       							file.name,

     

       1876
        
       							"pending",

     

       0
        
       
     

       1877
        
       						],

     

       1878
        
       					);

     

       1879
        
       

     

       1880
        
       					// Don't auto-start transcription - admin will select recordings

     

       1881
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       1882
        
       

     

       1883
       -
       					return Response.json({

     

       1884
       -
       						id: transcriptionId,

     

       1885
       -
       						message: "Upload successful",

     

       1886
       -
       					});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1887
        
       				} catch (error) {

     

       1888
        
       					return handleError(error);

     

       1889
        
       				}

     
···

       1893
        
       			GET: async (req) => {

     

       1894
        
       				try {

     

       1895
        
       					requireAdmin(req);

     

       1896
       -
       					const transcriptions = getAllTranscriptions();

     

       1897
       -
       					return Response.json(transcriptions);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1898
        
       				} catch (error) {

     

       1899
        
       					return handleError(error);

     

       1900
        
       				}

     
···

       1904
        
       			GET: async (req) => {

     

       1905
        
       				try {

     

       1906
        
       					requireAdmin(req);

     

       1907
       -
       					const users = getAllUsersWithStats();

     

       1908
       -
       					return Response.json(users);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1909
        
       				} catch (error) {

     

       1910
        
       					return handleError(error);

     

       1911
        
       				}

     
···

       1939
        
       					requireAdmin(req);

     

       1940
        
       					const id = req.params.id;

     

       1941
        
       					deleteWaitlistEntry(id);

     

       1942
       -
       					return Response.json({ success: true });

     

       1943
        
       				} catch (error) {

     

       1944
        
       					return handleError(error);

     

       1945
        
       				}

     
···

       1951
        
       					requireAdmin(req);

     

       1952
        
       					const transcriptionId = req.params.id;

     

       1953
        
       					deleteTranscription(transcriptionId);

     

       1954
       -
       					return Response.json({ success: true });

     

       1955
        
       				} catch (error) {

     

       1956
        
       					return handleError(error);

     

       1957
        
       				}

     
···

       1966
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1967
        
       					}

     

       1968
        
       					await deleteUser(userId);

     

       1969
       -
       					return Response.json({ success: true });

     

       1970
        
       				} catch (error) {

     

       1971
        
       					return handleError(error);

     

       1972
        
       				}

     
···

       2059
        
       						.get(userId);

     

       2060
        
       

     

       2061
        
       					if (!user) {

     

       2062
       -
       						return Response.json(

     

       2063
       -
       							{ error: "User not found" },

     

       2064
       -
       							{ status: 404 },

     

       2065
       -
       						);

     

       2066
        
       					}

     

       2067
        
       

     

       2068
        
       					try {

     
···

       2162
        
       				}

     

       2163
        
       			},

     

       2164
        
       		},

     

       2165
       -
       		"/api/admin/users/:id/password": {

     

       2166
       -
       			PUT: async (req) => {

     

       2167
        
       				try {

     

       2168
        
       					requireAdmin(req);

     

       2169
        
       					const userId = Number.parseInt(req.params.id, 10);

     
···

       2171
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2172
        
       					}

     

       2173
        
       

     

       2174
       -
       					const body = await req.json();

     

       2175
       -
       					const { password } = body as { password: string };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2176
        
       

     

       2177
       -
       					if (!password || password.length < 8) {

     

       2178
       -
       						return Response.json(

     

       2179
       -
       							{ error: "Password must be at least 8 characters" },

     

       2180
       -
       							{ status: 400 },

     

       2181
       -
       						);

     

       2182
        
       					}

     

       2183
        
       

     

       2184
       -
       					await updateUserPassword(userId, password);

     

       2185
       -
       					return Response.json({ success: true });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2186
        
       				} catch (error) {

     

       0
        
       
     

       2187
        
       					return handleError(error);

     

       2188
        
       				}

     

       2189
        
       			},

     
···

       2199
        
       

     

       2200
        
       					const { passkeyId } = req.params;

     

       2201
        
       					deletePasskey(passkeyId, userId);

     

       2202
       -
       					return Response.json({ success: true });

     

       2203
        
       				} catch (error) {

     

       2204
        
       					return handleError(error);

     

       2205
        
       				}

     
···

       2217
        
       					const body = await req.json();

     

       2218
        
       					const { name } = body as { name: string };

     

       2219
        
       

     

       2220
       -
       					if (!name || name.trim().length === 0) {

     

       0
        
       
     

       2221
        
       						return Response.json(

     

       2222
       -
       							{ error: "Name cannot be empty" },

     

       2223
        
       							{ status: 400 },

     

       2224
        
       						);

     

       2225
        
       					}

     
···

       2241
        
       					}

     

       2242
        
       

     

       2243
        
       					const body = await req.json();

     

       2244
       -
       					const { email } = body as { email: string };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2245
        
       

     

       2246
       -
       					if (!email || !email.includes("@")) {

     

       0
        
       
     

       2247
        
       						return Response.json(

     

       2248
       -
       							{ error: "Invalid email address" },

     

       2249
        
       							{ status: 400 },

     

       2250
        
       						);

     

       2251
        
       					}

     
···

       2260
        
       					if (existing) {

     

       2261
        
       						return Response.json(

     

       2262
        
       							{ error: "Email already in use" },

     

       2263
       -
       							{ status: 400 },

     

       2264
        
       						);

     

       2265
        
       					}

     

       2266
        
       

     

       2267
       -
       					updateUserEmailAddress(userId, email);

     

       2268
       -
       					return Response.json({ success: true });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2269
        
       				} catch (error) {

     

       2270
        
       					return handleError(error);

     

       2271
        
       				}

     
···

       2295
        
       					}

     

       2296
        
       

     

       2297
        
       					deleteAllUserSessions(userId);

     

       2298
       -
       					return Response.json({ success: true });

     

       2299
        
       				} catch (error) {

     

       2300
        
       					return handleError(error);

     

       2301
        
       				}

     
···

       2320
        
       						);

     

       2321
        
       					}

     

       2322
        
       

     

       2323
       -
       					return Response.json({ success: true });

     

       2324
        
       				} catch (error) {

     

       2325
        
       					return handleError(error);

     

       2326
        
       				}

     
···

       2382
        
       			GET: async (req) => {

     

       2383
        
       				try {

     

       2384
        
       					const user = requireAuth(req);

     

       2385
       -
       					const classes = getClassesForUser(user.id, user.role === "admin");

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2386
        
       

     

       2387
       -
       					// Group by semester/year

     

       2388
        
       					const grouped: Record<

     

       2389
        
       						string,

     

       2390
        
       						Array<{

     
···

       2398
        
       						}>

     

       2399
        
       					> = {};

     

       2400
        
       

     

       2401
       -
       					for (const cls of classes) {

     

       2402
        
       						const key = `${cls.semester} ${cls.year}`;

     

       2403
        
       						if (!grouped[key]) {

     

       2404
        
       							grouped[key] = [];

     
···

       2414
        
       						});

     

       2415
        
       					}

     

       2416
        
       

     

       2417
       -
       					return Response.json({ classes: grouped });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2418
        
       				} catch (error) {

     

       2419
        
       					return handleError(error);

     

       2420
        
       				}

     
···

       2432
        
       						meeting_times,

     

       2433
        
       					} = body;

     

       2434
        
       

     

       2435
       -
       					if (!course_code || !name || !professor || !semester || !year) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2436
        
       						return Response.json(

     

       2437
       -
       							{ error: "Missing required fields" },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2438
        
       							{ status: 400 },

     

       2439
        
       						);

     

       2440
        
       					}

     
···

       2446
        
       						semester,

     

       2447
        
       						year,

     

       2448
        
       						meeting_times,

     

       0
        
       
     

       2449
        
       					});

     

       2450
        
       

     

       2451
       -
       					return Response.json(newClass);

     

       2452
        
       				} catch (error) {

     

       2453
        
       					return handleError(error);

     

       2454
        
       				}

     
···

       2475
        
       						.all(user.id)

     

       2476
        
       						.map((row) => row.class_id);

     

       2477
        
       

     

       2478
       -
       					// Add is_enrolled flag to each class

     

       2479
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       2480
        
       						...cls,

     

       2481
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       0
        
       
     

       2482
        
       					}));

     

       2483
        
       

     

       2484
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       2493
        
       					const user = requireAuth(req);

     

       2494
        
       					const body = await req.json();

     

       2495
        
       					const classId = body.class_id;

     

       0
        
       
     

       2496
        
       

     

       2497
       -
       					if (!classId || typeof classId !== "string") {

     

       0
        
       
     

       2498
        
       						return Response.json(

     

       2499
       -
       							{ error: "Class ID required" },

     

       2500
        
       							{ status: 400 },

     

       2501
        
       						);

     

       2502
        
       					}

     

       2503
        
       

     

       2504
       -
       					const result = joinClass(classId, user.id);

     

       2505
        
       

     

       2506
        
       					if (!result.success) {

     

       2507
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       2508
        
       					}

     

       2509
        
       

     

       2510
       -
       					return Response.json({ success: true });

     

       2511
        
       				} catch (error) {

     

       2512
        
       					return handleError(error);

     

       2513
        
       				}

     
···

       2529
        
       						meetingTimes,

     

       2530
        
       					} = body;

     

       2531
        
       

     

       2532
       -
       					if (!courseCode || !courseName || !professor || !semester || !year) {

     

       0
        
       
     

       0
        
       
     

       2533
        
       						return Response.json(

     

       2534
       -
       							{ error: "Missing required fields" },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2535
        
       							{ status: 400 },

     

       2536
        
       						);

     

       2537
        
       					}

     
···

       2547
        
       						meetingTimes || null,

     

       2548
        
       					);

     

       2549
        
       

     

       2550
       -
       					return Response.json({ success: true, id });

     

       2551
        
       				} catch (error) {

     

       2552
        
       					return handleError(error);

     

       2553
        
       				}

     
···

       2574
        
       					}

     

       2575
        
       

     

       2576
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       0
        
       
     

       2577
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       0
        
       
     

       2578
        
       

     

       2579
        
       					return Response.json({

     

       2580
        
       						class: classInfo,

     

       2581
        
       						meetingTimes,

     

       0
        
       
     

       0
        
       
     

       2582
        
       						transcriptions,

     

       2583
        
       					});

     

       2584
        
       				} catch (error) {

     
···

       2590
        
       					requireAdmin(req);

     

       2591
        
       					const classId = req.params.id;

     

       2592
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2593
        
       					deleteClass(classId);

     

       2594
       -
       					return Response.json({ success: true });

     

       2595
        
       				} catch (error) {

     

       2596
        
       					return handleError(error);

     

       2597
        
       				}

     
···

       2612
        
       						);

     

       2613
        
       					}

     

       2614
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2615
        
       					toggleClassArchive(classId, archived);

     

       2616
       -
       					return Response.json({ success: true });

     

       2617
        
       				} catch (error) {

     

       2618
        
       					return handleError(error);

     

       2619
        
       				}

     
···

       2642
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       2643
        
       					}

     

       2644
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2645
        
       					const user = getUserByEmail(email);

     

       2646
        
       					if (!user) {

     

       2647
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       2648
        
       					}

     

       2649
        
       

     

       2650
        
       					enrollUserInClass(user.id, classId);

     

       2651
       -
       					return Response.json({ success: true });

     

       2652
        
       				} catch (error) {

     

       2653
        
       					return handleError(error);

     

       2654
        
       				}

     
···

       2665
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2666
        
       					}

     

       2667
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2668
        
       					removeUserFromClass(userId, classId);

     

       2669
       -
       					return Response.json({ success: true });

     

       2670
        
       				} catch (error) {

     

       2671
        
       					return handleError(error);

     

       2672
        
       				}

     
···

       2704
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2705
        
       					}

     

       2706
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2707
        
       					const meetingTime = createMeetingTime(classId, label);

     

       2708
       -
       					return Response.json(meetingTime);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2709
        
       				} catch (error) {

     

       2710
        
       					return handleError(error);

     

       2711
        
       				}

     
···

       2723
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2724
        
       					}

     

       2725
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2726
        
       					updateMeetingTime(meetingId, label);

     

       2727
       -
       					return Response.json({ success: true });

     

       2728
        
       				} catch (error) {

     

       2729
        
       					return handleError(error);

     

       2730
        
       				}

     
···

       2734
        
       					requireAdmin(req);

     

       2735
        
       					const meetingId = req.params.id;

     

       2736
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2737
        
       					deleteMeetingTime(meetingId);

     

       2738
       -
       					return Response.json({ success: true });

     

       2739
        
       				} catch (error) {

     

       2740
        
       					return handleError(error);

     

       2741
        
       				}

     
···

       2746
        
       				try {

     

       2747
        
       					requireAdmin(req);

     

       2748
        
       					const transcriptId = req.params.id;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2749
        
       

     

       2750
        
       					// Update status to 'selected' and start transcription

     

       2751
        
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     
···

       2753
        
       						transcriptId,

     

       2754
        
       					]);

     

       2755
        
       

     

       2756
       -
       					// Get filename to start transcription

     

       2757
       -
       					const transcription = db

     

       2758
       -
       						.query<{ filename: string }, [string]>(

     

       2759
       -
       							"SELECT filename FROM transcriptions WHERE id = ?",

     

       2760
       -
       						)

     

       2761
       -
       						.get(transcriptId);

     

       2762
        
       

     

       2763
       -
       					if (transcription) {

     

       2764
       -
       						whisperService.startTranscription(

     

       2765
       -
       							transcriptId,

     

       2766
       -
       							transcription.filename,

     

       2767
       -
       						);

     

       2768
       -
       					}

     

       2769
       -
       

     

       2770
       -
       					return Response.json({ success: true });

     

       2771
        
       				} catch (error) {

     

       2772
        
       					return handleError(error);

     

       2773
        
       				}

     

       2774
        
       			},

     

       2775
        
       		},

     

       2776
        
       	},

     

       2777
       -
       	development: {

     

       2778
       -
       		hmr: true,

     

       2779
       -
       		console: true,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2780
        
       	},

     

       2781
        
       });

     

       2782
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       2
        
       import {

     

       3
        
       	authenticateUser,

     

       4
        
       	cleanupExpiredSessions,

     

       5
       +
       	consumeEmailChangeToken,

     

       6
       +
       	consumePasswordResetToken,

     

       7
       +
       	createEmailChangeToken,

     

       8
       +
       	createEmailVerificationToken,

     

       9
       +
       	createPasswordResetToken,

     

       10
        
       	createSession,

     

       11
        
       	createUser,

     

       12
        
       	deleteAllUserSessions,

     
···

       22
        
       	getUserByEmail,

     

       23
        
       	getUserBySession,

     

       24
        
       	getUserSessionsForUser,

     

       25
       +
       	getVerificationCodeSentAt,

     

       26
       +
       	isEmailVerified,

     

       27
        
       	type UserRole,

     

       28
        
       	updateUserAvatar,

     

       29
        
       	updateUserEmail,

     
···

       31
        
       	updateUserName,

     

       32
        
       	updateUserPassword,

     

       33
        
       	updateUserRole,

     

       34
       +
       	verifyEmailChangeToken,

     

       35
       +
       	verifyEmailCode,

     

       36
        
       	verifyEmailToken,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
       	verifyPasswordResetToken,

     

       0
        
       
     

       38
        
       } from "./lib/auth";

     

       39
        
       import {

     

       40
        
       	addToWaitlist,

     
···

       48
        
       	getClassById,

     

       49
        
       	getClassesForUser,

     

       50
        
       	getClassMembers,

     

       51
       +
       	getClassSections,

     

       52
       +
       	getMeetingById,

     

       53
        
       	getMeetingTimesForClass,

     

       54
        
       	getTranscriptionsForClass,

     

       55
       +
       	getUserSection,

     

       56
        
       	isUserEnrolledInClass,

     

       57
        
       	joinClass,

     

       58
        
       	removeUserFromClass,

     

       59
        
       	searchClassesByCourseCode,

     

       60
        
       	toggleClassArchive,

     

       61
        
       	updateMeetingTime,

     

       62
       +
       	createClassSection,

     

       63
        
       } from "./lib/classes";

     

       64
       +
       import { sendEmail } from "./lib/email";

     

       65
       +
       import {

     

       66
       +
       	emailChangeTemplate,

     

       67
       +
       	passwordResetTemplate,

     

       68
       +
       	verifyEmailTemplate,

     

       69
       +
       } from "./lib/email-templates";

     

       70
        
       import { AuthErrors, handleError, ValidationErrors } from "./lib/errors";

     

       71
        
       import {

     

       72
        
       	hasActiveSubscription,

     
···

       83
        
       	verifyAndAuthenticatePasskey,

     

       84
        
       	verifyAndCreatePasskey,

     

       85
        
       } from "./lib/passkey";

     

       86
       +
       import { clearRateLimit, enforceRateLimit } from "./lib/rate-limit";

     

       87
        
       import { getTranscriptVTT } from "./lib/transcript-storage";

     

       88
        
       import {

     

       89
        
       	MAX_FILE_SIZE,

     
···

       91
        
       	type TranscriptionUpdate,

     

       92
        
       	WhisperServiceManager,

     

       93
        
       } from "./lib/transcription";

     

       94
       +
       import {

     

       95
       +
       	findMatchingMeetingTime,

     

       96
       +
       	getDayName,

     

       97
       +
       } from "./lib/audio-metadata";

     

       98
       +
       import {

     

       99
       +
       	checkAutoSubmit,

     

       100
       +
       	deletePendingRecording,

     

       101
       +
       	getEnrolledUserCount,

     

       102
       +
       	getPendingRecordings,

     

       103
       +
       	getUserVoteForMeeting,

     

       104
       +
       	markAsAutoSubmitted,

     

       105
       +
       	removeVote,

     

       106
       +
       	voteForRecording,

     

       107
       +
       } from "./lib/voting";

     

       108
        
       import {

     

       109
       +
       	validateClassId,

     

       110
       +
       	validateCourseCode,

     

       111
       +
       	validateCourseName,

     

       112
       +
       	validateEmail,

     

       113
       +
       	validateName,

     

       114
       +
       	validatePasswordHash,

     

       115
       +
       	validateSemester,

     

       116
       +
       	validateYear,

     

       117
       +
       } from "./lib/validation";

     

       118
        
       import adminHTML from "./pages/admin.html";

     

       119
        
       import checkoutHTML from "./pages/checkout.html";

     

       120
        
       import classHTML from "./pages/class.html";

     
···

       124
        
       import settingsHTML from "./pages/settings.html";

     

       125
        
       import transcribeHTML from "./pages/transcribe.html";

     

       126
        
       

     

       127
       +
       // Validate required environment variables at startup

     

       128
       +
       function validateEnvVars() {

     

       129
       +
       	const required = [

     

       130
       +
       		"POLAR_ORGANIZATION_ID",

     

       131
       +
       		"POLAR_PRODUCT_ID",

     

       132
       +
       		"POLAR_SUCCESS_URL",

     

       133
       +
       		"POLAR_WEBHOOK_SECRET",

     

       134
       +
       		"MAILCHANNELS_API_KEY",

     

       135
       +
       		"DKIM_PRIVATE_KEY",

     

       136
       +
       		"LLM_API_KEY",

     

       137
       +
       		"LLM_API_BASE_URL",

     

       138
       +
       		"LLM_MODEL",

     

       139
       +
       	];

     

       140
       +
       

     

       141
       +
       	const missing = required.filter((key) => !process.env[key]);

     

       142
       +
       

     

       143
       +
       	if (missing.length > 0) {

     

       144
       +
       		console.error(

     

       145
       +
       			`[Startup] Missing required environment variables: ${missing.join(", ")}`,

     

       146
       +
       		);

     

       147
       +
       		console.error("[Startup] Please check your .env file");

     

       148
       +
       		process.exit(1);

     

       149
       +
       	}

     

       150
       +
       

     

       151
       +
       	// Validate ORIGIN is set for production

     

       152
       +
       	if (!process.env.ORIGIN) {

     

       153
       +
       		console.warn(

     

       154
       +
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       155
       +
       		);

     

       156
       +
       		console.warn("[Startup] Set ORIGIN in production for correct email links");

     

       157
       +
       	}

     

       158
       +
       

     

       159
       +
       	console.log("[Startup] Environment variable validation passed");

     

       160
       +
       }

     

       161
       +
       

     

       162
       +
       validateEnvVars();

     

       163
       +
       

     

       164
        
       // Environment variables

     

       165
        
       const WHISPER_SERVICE_URL =

     

       166
        
       	process.env.WHISPER_SERVICE_URL || "http://localhost:8000";

     
···

       180
        
       	transcriptionEvents,

     

       181
        
       );

     

       182
        
       

     

       183
       +
       // Clean up expired sessions every 15 minutes

     

       184
       +
       const sessionCleanupInterval = setInterval(

     

       185
       +
       	cleanupExpiredSessions,

     

       186
       +
       	15 * 60 * 1000,

     

       187
       +
       );

     

       188
        
       

     

       189
        
       // Helper function to sync user subscriptions from Polar

     

       190
        
       async function syncUserSubscriptionsFromPolar(

     

       191
        
       	userId: number,

     

       192
        
       	email: string,

     

       193
        
       ): Promise<void> {

     

       194
       +
       	// Skip Polar sync in test mode

     

       195
       +
       	if (

     

       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       +
       	) {

     

       199
       +
       		return;

     

       200
       +
       	}

     

       201
       +
       

     

       202
        
       	try {

     

       203
        
       		const { polar } = await import("./lib/polar");

     

       204
        
       

     

       205
       +
       		// Search for customer by email (validated at startup)

     

       206
        
       		const customers = await polar.customers.list({

     

       207
       +
       			organizationId: process.env.POLAR_ORGANIZATION_ID as string,

     

       208
        
       			query: email,

     

       209
        
       		});

     

       210
        
       

     
···

       220
        
       			customerId: customer.id,

     

       221
        
       		});

     

       222
        
       

     

       223
       +
       		if (

     

       224
       +
       			!subscriptions.result.items ||

     

       225
       +
       			subscriptions.result.items.length === 0

     

       226
       +
       		) {

     

       227
        
       			console.log(`[Sync] No subscriptions found for customer ${customer.id}`);

     

       228
        
       			return;

     

       229
        
       		}

     

       230
        
       

     

       231
       +
       		// Filter to only active/trialing/past_due subscriptions (not canceled/expired)

     

       232
       +
       		const currentSubscriptions = subscriptions.result.items.filter(

     

       233
       +
       			(sub) =>

     

       234
       +
       				sub.status === "active" ||

     

       235
       +
       				sub.status === "trialing" ||

     

       236
       +
       				sub.status === "past_due",

     

       237
       +
       		);

     

       238
       +
       

     

       239
       +
       		if (currentSubscriptions.length === 0) {

     

       240
       +
       			console.log(

     

       241
       +
       				`[Sync] No current subscriptions found for customer ${customer.id}`,

     

       242
       +
       			);

     

       243
       +
       			return;

     

       244
       +
       		}

     

       245
       +
       

     

       246
       +
       		// Update each current subscription in the database

     

       247
       +
       		for (const subscription of currentSubscriptions) {

     

       248
        
       			db.run(

     

       249
        
       				`INSERT INTO subscriptions (id, user_id, customer_id, status, current_period_start, current_period_end, cancel_at_period_end, canceled_at, updated_at)

     

       250
        
       				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

     
···

       281
        
       		}

     

       282
        
       

     

       283
        
       		console.log(

     

       284
       +
       			`[Sync] Linked ${currentSubscriptions.length} current subscription(s) to user ${userId} (${email})`,

     

       285
        
       		);

     

       286
        
       	} catch (error) {

     

       287
        
       		console.error(

     
···

       291
        
       		// Don't throw - registration should succeed even if sync fails

     

       292
        
       	}

     

       293
        
       }

     

       0
        
       
     

       294
        
       

     

       295
        
       // Sync with Whisper DB on startup

     

       296
        
       try {

     
···

       304
        
       }

     

       305
        
       

     

       306
        
       // Periodic sync every 5 minutes as backup (SSE handles real-time updates)

     

       307
       +
       const syncInterval = setInterval(

     

       308
        
       	async () => {

     

       309
        
       		try {

     

       310
        
       			await whisperService.syncWithWhisper();

     
···

       318
        
       	5 * 60 * 1000,

     

       319
        
       );

     

       320
        
       

     

       321
       +
       // Clean up stale files hourly

     

       322
       +
       const fileCleanupInterval = setInterval(

     

       323
       +
       	() => whisperService.cleanupStaleFiles(),

     

       324
       +
       	60 * 60 * 1000, // 1 hour

     

       325
       +
       );

     

       326
        
       

     

       327
        
       const server = Bun.serve({

     

       328
       +
       	port:

     

       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       +
       			? 3001

     

       331
       +
       			: process.env.PORT

     

       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       +
       				: 3000,

     

       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       335
        
       	routes: {

     

       336
        
       		"/": indexHTML,

     
···

       363
        
       							{ status: 400 },

     

       364
        
       						);

     

       365
        
       					}

     

       366
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       367
       +
       					const passwordValidation = validatePasswordHash(password);

     

       368
       +
       					if (!passwordValidation.valid) {

     

       369
        
       						return Response.json(

     

       370
       +
       							{ error: passwordValidation.error },

     

       371
        
       							{ status: 400 },

     

       372
        
       						);

     

       373
        
       					}

     

       374
        
       					const user = await createUser(email, password, name);

     

       375
       +
       

     

       376
        
       					// Send verification email - MUST succeed for registration to complete

     

       377
        
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       378
       +
       

     

       379
        
       					try {

     

       380
        
       						await sendEmail({

     

       381
        
       							to: user.email,

     
···

       389
        
       					} catch (err) {

     

       390
        
       						console.error("[Email] Failed to send verification email:", err);

     

       391
        
       						// Rollback user creation - direct DB delete since user was just created

     

       392
       +
       						db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [

     

       393
       +
       							user.id,

     

       394
       +
       						]);

     

       395
        
       						db.run("DELETE FROM sessions WHERE user_id = ?", [user.id]);

     

       396
        
       						db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       397
        
       						return Response.json(

     

       398
       +
       							{

     

       399
       +
       								error:

     

       400
       +
       									"Failed to send verification email. Please try again later.",

     

       401
       +
       							},

     

       402
        
       							{ status: 500 },

     

       403
        
       						);

     

       404
        
       					}

     

       405
       +
       

     

       406
        
       					// Attempt to sync existing Polar subscriptions (after email succeeds)

     

       407
        
       					syncUserSubscriptionsFromPolar(user.id, user.email).catch(() => {

     

       408
        
       						// Silent fail - don't block registration

     

       409
        
       					});

     

       410
       +
       

     

       411
        
       					// Clear rate limits on successful registration

     

       412
        
       					const ipAddress =

     

       413
        
       						req.headers.get("x-forwarded-for") ??

     

       414
        
       						req.headers.get("x-real-ip") ??

     

       415
        
       						"unknown";

     

       416
        
       					clearRateLimit("register", email, ipAddress);

     

       417
       +
       

     

       418
        
       					// Return success but indicate email verification is needed

     

       419
        
       					// Don't create session yet - they need to verify first

     

       420
        
       					return Response.json(

     

       421
       +
       						{

     

       422
        
       							user: { id: user.id, email: user.email },

     

       423
        
       							email_verification_required: true,

     

       424
        
       							verification_code_sent_at: sentAt,

     

       425
        
       						},

     

       426
       +
       						{ status: 201 },

     

       427
        
       					);

     

       428
        
       				} catch (err: unknown) {

     

       429
        
       					const error = err as { message?: string };

     

       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       431
        
       						return Response.json(

     

       432
        
       							{ error: "Email already registered" },

     

       433
       +
       							{ status: 409 },

     

       434
        
       						);

     

       435
        
       					}

     

       436
        
       					console.error("[Auth] Registration error:", err);

     
···

       460
        
       					});

     

       461
        
       					if (rateLimitError) return rateLimitError;

     

       462
        
       

     

       463
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       464
       +
       					const passwordValidation = validatePasswordHash(password);

     

       465
       +
       					if (!passwordValidation.valid) {

     

       466
        
       						return Response.json(

     

       467
       +
       							{ error: passwordValidation.error },

     

       468
        
       							{ status: 400 },

     

       469
        
       						);

     

       470
        
       					}

     
···

       475
        
       							{ status: 401 },

     

       476
        
       						);

     

       477
        
       					}

     

       478
       +
       

     

       479
        
       					// Clear rate limits on successful authentication

     

       480
        
       					const ipAddress =

     

       481
        
       						req.headers.get("x-forwarded-for") ??

     

       482
        
       						req.headers.get("x-real-ip") ??

     

       483
        
       						"unknown";

     

       484
        
       					clearRateLimit("login", email, ipAddress);

     

       485
       +
       

     

       486
        
       					// Check if email is verified

     

       487
        
       					if (!isEmailVerified(user.id)) {

     

       488
        
       						let codeSentAt = getVerificationCodeSentAt(user.id);

     

       489
       +
       

     

       490
        
       						// If no verification code exists, auto-send one

     

       491
        
       						if (!codeSentAt) {

     

       492
       +
       							const { code, token, sentAt } = createEmailVerificationToken(

     

       493
       +
       								user.id,

     

       494
       +
       							);

     

       495
        
       							codeSentAt = sentAt;

     

       496
       +
       

     

       497
        
       							try {

     

       498
        
       								await sendEmail({

     

       499
        
       									to: user.email,

     
···

       505
        
       									}),

     

       506
        
       								});

     

       507
        
       							} catch (err) {

     

       508
       +
       								console.error(

     

       509
       +
       									"[Email] Failed to send verification email on login:",

     

       510
       +
       									err,

     

       511
       +
       								);

     

       512
        
       								// Don't fail login - just return null timestamp so client can try resend

     

       513
        
       								codeSentAt = null;

     

       514
        
       							}

     

       515
        
       						}

     

       516
       +
       

     

       517
        
       						return Response.json(

     

       518
       +
       							{

     

       519
        
       								user: { id: user.id, email: user.email },

     

       520
        
       								email_verification_required: true,

     

       521
        
       								verification_code_sent_at: codeSentAt,

     
···

       523
        
       							{ status: 200 },

     

       524
        
       						);

     

       525
        
       					}

     

       526
       +
       

     

       527
        
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       528
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       529
        
       					return Response.json(

     
···

       568
        
       					return new Response(null, {

     

       569
        
       						status: 302,

     

       570
        
       						headers: {

     

       571
       +
       							Location: "/classes",

     

       572
        
       							"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       573
        
       						},

     

       574
        
       					});

     
···

       592
        
       					// Get user by email

     

       593
        
       					const user = getUserByEmail(email);

     

       594
        
       					if (!user) {

     

       595
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       596
        
       					}

     

       597
        
       

     

       598
        
       					// Check if already verified

     
···

       621
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       622
        
       

     

       623
        
       					return Response.json(

     

       624
       +
       						{

     

       625
       +
       							success: true,

     

       626
        
       							message: "Email verified successfully",

     

       627
        
       							email_verified: true,

     

       628
        
       							user: { id: user.id, email: user.email },

     
···

       642
        
       			POST: async (req) => {

     

       643
        
       				try {

     

       644
        
       					const user = requireAuth(req);

     

       645
       +
       

     

       646
        
       					// Rate limiting

     

       647
        
       					const rateLimitError = enforceRateLimit(req, "resend-verification", {

     

       648
        
       						account: { max: 3, windowSeconds: 60 * 60, email: user.email },

     
···

       670
        
       						}),

     

       671
        
       					});

     

       672
        
       

     

       673
       +
       					return Response.json({

     

       674
       +
       						success: true,

     

       675
       +
       						message: "Verification email sent",

     

       676
       +
       					});

     

       677
        
       				} catch (error) {

     

       678
        
       					return handleError(error);

     

       679
        
       				}

     
···

       690
        
       					}

     

       691
        
       

     

       692
        
       					// Rate limiting by email

     

       693
       +
       					const rateLimitError = enforceRateLimit(

     

       694
       +
       						req,

     

       695
       +
       						"resend-verification-code",

     

       696
       +
       						{

     

       697
       +
       							account: { max: 3, windowSeconds: 5 * 60, email },

     

       698
       +
       						},

     

       699
       +
       					);

     

       700
        
       					if (rateLimitError) return rateLimitError;

     

       701
        
       

     

       702
        
       					// Get user by email

     

       703
        
       					const user = getUserByEmail(email);

     

       704
        
       					if (!user) {

     

       705
        
       						// Don't reveal if user exists

     

       706
       +
       						return Response.json({

     

       707
       +
       							success: true,

     

       708
       +
       							message:

     

       709
       +
       								"If an account exists with that email, a verification code has been sent",

     

       710
       +
       						});

     

       711
        
       					}

     

       712
        
       

     

       713
        
       					// Check if already verified

     
···

       731
        
       						}),

     

       732
        
       					});

     

       733
        
       

     

       734
       +
       					return Response.json({

     

       735
       +
       						success: true,

     

       736
        
       						message: "Verification code sent",

     

       737
        
       						verification_code_sent_at: sentAt,

     

       738
        
       					});

     
···

       760
        
       					// Always return success to prevent email enumeration

     

       761
        
       					const user = getUserByEmail(email);

     

       762
        
       					if (user) {

     

       763
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       0
        
       
     

       764
        
       						const resetToken = createPasswordResetToken(user.id);

     

       765
        
       						const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       766
        
       

     
···

       777
        
       					}

     

       778
        
       

     

       779
        
       					return Response.json({

     

       780
       +
       						success: true,

     

       781
        
       						message:

     

       782
        
       							"If an account exists with that email, a password reset link has been sent",

     

       783
        
       					});

     
···

       791
        
       			},

     

       792
        
       		},

     

       793
        
       		"/api/auth/reset-password": {

     

       794
       +
       			GET: async (req) => {

     

       795
       +
       				try {

     

       796
       +
       					const url = new URL(req.url);

     

       797
       +
       					const token = url.searchParams.get("token");

     

       798
       +
       

     

       799
       +
       					if (!token) {

     

       800
       +
       						return Response.json({ error: "Token required" }, { status: 400 });

     

       801
       +
       					}

     

       802
       +
       

     

       803
       +
       					const userId = verifyPasswordResetToken(token);

     

       804
       +
       					if (!userId) {

     

       805
       +
       						return Response.json(

     

       806
       +
       							{ error: "Invalid or expired reset token" },

     

       807
       +
       							{ status: 400 },

     

       808
       +
       						);

     

       809
       +
       					}

     

       810
       +
       

     

       811
       +
       					// Get user's email for client-side password hashing

     

       812
       +
       					const user = db

     

       813
       +
       						.query<{ email: string }, [number]>(

     

       814
       +
       							"SELECT email FROM users WHERE id = ?",

     

       815
       +
       						)

     

       816
       +
       						.get(userId);

     

       817
       +
       

     

       818
       +
       					if (!user) {

     

       819
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       820
       +
       					}

     

       821
       +
       

     

       822
       +
       					return Response.json({ email: user.email });

     

       823
       +
       				} catch (error) {

     

       824
       +
       					console.error("[Email] Get reset token info error:", error);

     

       825
       +
       					return Response.json(

     

       826
       +
       						{ error: "Failed to verify token" },

     

       827
       +
       						{ status: 500 },

     

       828
       +
       					);

     

       829
       +
       				}

     

       830
       +
       			},

     

       831
        
       			POST: async (req) => {

     

       832
        
       				try {

     

       833
        
       					const body = await req.json();

     
···

       841
        
       					}

     

       842
        
       

     

       843
        
       					// Validate password format (client-side hashed PBKDF2)

     

       844
       +
       					const passwordValidation = validatePasswordHash(password);

     

       845
       +
       					if (!passwordValidation.valid) {

     

       846
        
       						return Response.json(

     

       847
       +
       							{ error: passwordValidation.error },

     

       848
        
       							{ status: 400 },

     

       849
        
       						);

     

       850
        
       					}

     
···

       861
        
       					await updateUserPassword(userId, password);

     

       862
        
       					consumePasswordResetToken(token);

     

       863
        
       

     

       864
       +
       					return Response.json({

     

       865
       +
       						success: true,

     

       866
       +
       						message: "Password reset successfully",

     

       867
       +
       					});

     

       868
        
       				} catch (error) {

     

       869
        
       					console.error("[Email] Reset password error:", error);

     

       870
        
       					return Response.json(

     
···

       893
        
       		},

     

       894
        
       		"/api/auth/me": {

     

       895
        
       			GET: (req) => {

     

       896
       +
       				try {

     

       897
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       898
        
       

     

       899
       +
       					// Check subscription status

     

       900
       +
       					const subscription = db

     

       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       +
       						)

     

       904
       +
       						.get(user.id);

     

       905
        
       

     

       906
       +
       					// Get notification preferences

     

       907
       +
       					const prefs = db

     

       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       +
       						)

     

       911
       +
       						.get(user.id);

     

       912
        
       

     

       913
       +
       					return Response.json({

     

       914
       +
       						email: user.email,

     

       915
       +
       						name: user.name,

     

       916
       +
       						avatar: user.avatar,

     

       917
       +
       						created_at: user.created_at,

     

       918
       +
       						role: user.role,

     

       919
       +
       						has_subscription: !!subscription,

     

       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       +
       						email_notifications_enabled:

     

       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       +
       					});

     

       924
       +
       				} catch (err) {

     

       925
       +
       					return handleError(err);

     

       926
       +
       				}

     

       927
        
       			},

     

       928
        
       		},

     

       929
        
       		"/api/passkeys/register/options": {

     

       930
        
       			POST: async (req) => {

     

       931
        
       				try {

     

       932
        
       					const user = requireAuth(req);

     

       933
       +
       

     

       934
       +
       					const rateLimitError = enforceRateLimit(

     

       935
       +
       						req,

     

       936
       +
       						"passkey-register-options",

     

       937
       +
       						{

     

       938
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       939
       +
       						},

     

       940
       +
       					);

     

       941
       +
       					if (rateLimitError) return rateLimitError;

     

       942
       +
       

     

       943
        
       					const options = await createRegistrationOptions(user);

     

       944
        
       					return Response.json(options);

     

       945
        
       				} catch (err) {

     
···

       951
        
       			POST: async (req) => {

     

       952
        
       				try {

     

       953
        
       					const _user = requireAuth(req);

     

       954
       +
       

     

       955
       +
       					const rateLimitError = enforceRateLimit(

     

       956
       +
       						req,

     

       957
       +
       						"passkey-register-verify",

     

       958
       +
       						{

     

       959
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       960
       +
       						},

     

       961
       +
       					);

     

       962
       +
       					if (rateLimitError) return rateLimitError;

     

       963
       +
       

     

       964
        
       					const body = await req.json();

     

       965
        
       					const { response: credentialResponse, challenge, name } = body;

     

       966
        
       

     
···

       986
        
       		"/api/passkeys/authenticate/options": {

     

       987
        
       			POST: async (req) => {

     

       988
        
       				try {

     

       989
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-options", {

     

       990
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       991
       +
       					});

     

       992
       +
       					if (rateLimitError) return rateLimitError;

     

       993
       +
       

     

       994
        
       					const body = await req.json();

     

       995
        
       					const { email } = body;

     

       996
        
       

     
···

       1004
        
       		"/api/passkeys/authenticate/verify": {

     

       1005
        
       			POST: async (req) => {

     

       1006
        
       				try {

     

       1007
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-verify", {

     

       1008
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1009
       +
       					});

     

       1010
       +
       					if (rateLimitError) return rateLimitError;

     

       1011
       +
       

     

       1012
        
       					const body = await req.json();

     

       1013
        
       					const { response: credentialResponse, challenge } = body;

     

       1014
        
       

     
···

       1074
        
       			PUT: async (req) => {

     

       1075
        
       				try {

     

       1076
        
       					const user = requireAuth(req);

     

       1077
       +
       

     

       1078
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-update", {

     

       1079
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1080
       +
       					});

     

       1081
       +
       					if (rateLimitError) return rateLimitError;

     

       1082
       +
       

     

       1083
        
       					const body = await req.json();

     

       1084
        
       					const { name } = body;

     

       1085
        
       					const passkeyId = req.params.id;

     
···

       1089
        
       					}

     

       1090
        
       

     

       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       1092
       +
       					return new Response(null, { status: 204 });

     

       1093
        
       				} catch (err) {

     

       1094
        
       					return handleError(err);

     

       1095
        
       				}

     
···

       1097
        
       			DELETE: async (req) => {

     

       1098
        
       				try {

     

       1099
        
       					const user = requireAuth(req);

     

       1100
       +
       

     

       1101
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-delete", {

     

       1102
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1103
       +
       					});

     

       1104
       +
       					if (rateLimitError) return rateLimitError;

     

       1105
       +
       

     

       1106
        
       					const passkeyId = req.params.id;

     

       1107
        
       					deletePasskey(passkeyId, user.id);

     

       1108
       +
       					return new Response(null, { status: 204 });

     

       1109
        
       				} catch (err) {

     

       1110
        
       					return handleError(err);

     

       1111
        
       				}

     
···

       1113
        
       		},

     

       1114
        
       		"/api/sessions": {

     

       1115
        
       			GET: (req) => {

     

       1116
       +
       				try {

     

       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       +
       					if (!sessionId) {

     

       1119
       +
       						return Response.json(

     

       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       +
       							{ status: 401 },

     

       1122
       +
       						);

     

       1123
       +
       					}

     

       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       +
       					if (!user) {

     

       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       +
       					}

     

       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       +
       					return Response.json({

     

       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       +
       							id: s.id,

     

       1132
       +
       							ip_address: s.ip_address,

     

       1133
       +
       							user_agent: s.user_agent,

     

       1134
       +
       							created_at: s.created_at,

     

       1135
       +
       							expires_at: s.expires_at,

     

       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       +
       						})),

     

       1138
       +
       					});

     

       1139
       +
       				} catch (err) {

     

       1140
       +
       					return handleError(err);

     

       1141
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1142
        
       			},

     

       1143
        
       			DELETE: async (req) => {

     

       1144
       +
       				try {

     

       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       +
       					if (!currentSessionId) {

     

       1147
       +
       						return Response.json(

     

       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       +
       							{ status: 401 },

     

       1150
       +
       						);

     

       1151
       +
       					}

     

       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       +
       					if (!user) {

     

       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       +
       					}

     

       1156
       +
       

     

       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       +
       					});

     

       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1161
       +
       

     

       1162
       +
       					const body = await req.json();

     

       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       +
       					if (!targetSessionId) {

     

       1165
       +
       						return Response.json(

     

       1166
       +
       							{ error: "Session ID required" },

     

       1167
       +
       							{ status: 400 },

     

       1168
       +
       						);

     

       1169
       +
       					}

     

       1170
       +
       					// Prevent deleting current session

     

       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       +
       						return Response.json(

     

       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       +
       							{ status: 400 },

     

       1175
       +
       						);

     

       1176
       +
       					}

     

       1177
       +
       					// Verify the session belongs to the user

     

       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       +
       					}

     

       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       +
       				} catch (err) {

     

       1185
       +
       					return handleError(err);

     

       1186
        
       				}

     

       0
        
       
     

       0
        
       
     

       1187
        
       			},

     

       1188
        
       		},

     

       1189
        
       		"/api/user": {

     

       1190
        
       			DELETE: async (req) => {

     

       1191
       +
       				try {

     

       1192
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1193
        
       

     

       1194
       +
       					// Rate limiting

     

       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       +
       					});

     

       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       1199
        
       

     

       1200
       +
       					await deleteUser(user.id);

     

       1201
       +
       					return new Response(null, {

     

       1202
       +
       						status: 204,

     

       0
        
       
     

       1203
        
       						headers: {

     

       1204
        
       							"Set-Cookie":

     

       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       1206
        
       						},

     

       1207
       +
       					});

     

       1208
       +
       				} catch (err) {

     

       1209
       +
       					return handleError(err);

     

       1210
       +
       				}

     

       1211
        
       			},

     

       1212
        
       		},

     

       1213
        
       		"/api/user/email": {

     

       1214
        
       			PUT: async (req) => {

     

       1215
       +
       				try {

     

       1216
       +
       					const user = requireAuth(req);

     

       1217
       +
       

     

       1218
       +
       					// Rate limiting

     

       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       +
       					});

     

       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       1223
        
       

     

       1224
       +
       					const body = await req.json();

     

       1225
       +
       					const { email } = body;

     

       1226
       +
       					if (!email) {

     

       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       +
       					}

     

       1229
        
       

     

       1230
       +
       					// Check if email is already in use

     

       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       +
       					if (existingUser) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1233
        
       						return Response.json(

     

       1234
        
       							{ error: "Email already in use" },

     

       1235
       +
       							{ status: 409 },

     

       1236
       +
       						);

     

       1237
       +
       					}

     

       1238
       +
       

     

       1239
       +
       					try {

     

       1240
       +
       						// Create email change token

     

       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1242
       +
       

     

       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1246
       +
       

     

       1247
       +
       						await sendEmail({

     

       1248
       +
       							to: user.email,

     

       1249
       +
       							subject: "Verify your email change",

     

       1250
       +
       							html: emailChangeTemplate({

     

       1251
       +
       								name: user.name,

     

       1252
       +
       								currentEmail: user.email,

     

       1253
       +
       								newEmail: email,

     

       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       +
       							}),

     

       1256
       +
       						});

     

       1257
       +
       

     

       1258
       +
       						return Response.json({

     

       1259
       +
       							success: true,

     

       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       +
       							pendingEmail: email,

     

       1262
       +
       						});

     

       1263
       +
       					} catch (error) {

     

       1264
       +
       						console.error(

     

       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       +
       							error,

     

       1267
       +
       						);

     

       1268
       +
       						return Response.json(

     

       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       +
       							{ status: 500 },

     

       1271
        
       						);

     

       1272
        
       					}

     

       1273
       +
       				} catch (err) {

     

       1274
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       1275
        
       				}

     

       1276
        
       			},

     

       1277
        
       		},

     

       1278
       +
       		"/api/user/email/verify": {

     

       1279
       +
       			GET: async (req) => {

     

       1280
       +
       				try {

     

       1281
       +
       					const url = new URL(req.url);

     

       1282
       +
       					const token = url.searchParams.get("token");

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1283
        
       

     

       1284
       +
       					if (!token) {

     

       1285
       +
       						return Response.redirect(

     

       1286
       +
       							"/settings?tab=account&error=invalid-token",

     

       1287
       +
       							302,

     

       1288
       +
       						);

     

       1289
       +
       					}

     

       1290
        
       

     

       1291
       +
       					const result = verifyEmailChangeToken(token);

     

       1292
       +
       

     

       1293
       +
       					if (!result) {

     

       1294
       +
       						return Response.redirect(

     

       1295
       +
       							"/settings?tab=account&error=expired-token",

     

       1296
       +
       							302,

     

       1297
       +
       						);

     

       1298
       +
       					}

     

       1299
       +
       

     

       1300
       +
       					// Update the user's email

     

       1301
       +
       					updateUserEmail(result.userId, result.newEmail);

     

       1302
       +
       

     

       1303
       +
       					// Consume the token

     

       1304
       +
       					consumeEmailChangeToken(token);

     

       1305
       +
       

     

       1306
       +
       					// Redirect to settings with success message

     

       1307
       +
       					return Response.redirect(

     

       1308
       +
       						"/settings?tab=account&success=email-changed",

     

       1309
       +
       						302,

     

       1310
       +
       					);

     

       1311
       +
       				} catch (error) {

     

       1312
       +
       					console.error("[Email] Email change verification error:", error);

     

       1313
       +
       					return Response.redirect(

     

       1314
       +
       						"/settings?tab=account&error=verification-failed",

     

       1315
       +
       						302,

     

       1316
        
       					);

     

       1317
        
       				}

     

       1318
       +
       			},

     

       1319
       +
       		},

     

       1320
       +
       		"/api/user/password": {

     

       1321
       +
       			PUT: async (req) => {

     

       1322
        
       				try {

     

       1323
       +
       					const user = requireAuth(req);

     

       1324
       +
       

     

       1325
       +
       					// Rate limiting

     

       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       +
       					});

     

       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       1330
       +
       

     

       1331
       +
       					const body = await req.json();

     

       1332
       +
       					const { password } = body;

     

       1333
       +
       					if (!password) {

     

       1334
       +
       						return Response.json(

     

       1335
       +
       							{ error: "Password required" },

     

       1336
       +
       							{ status: 400 },

     

       1337
       +
       						);

     

       1338
       +
       					}

     

       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       +
       						return Response.json(

     

       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       +
       							{ status: 400 },

     

       1345
       +
       						);

     

       1346
       +
       					}

     

       1347
       +
       					try {

     

       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       +
       						return Response.json({ success: true });

     

       1350
       +
       					} catch {

     

       1351
       +
       						return Response.json(

     

       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       +
       							{ status: 500 },

     

       1354
       +
       						);

     

       1355
       +
       					}

     

       1356
       +
       				} catch (err) {

     

       1357
       +
       					return handleError(err);

     

       1358
        
       				}

     

       1359
        
       			},

     

       1360
        
       		},

     

       1361
        
       		"/api/user/name": {

     

       1362
        
       			PUT: async (req) => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1363
        
       				try {

     

       1364
       +
       					const user = requireAuth(req);

     

       1365
       +
       

     

       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       +
       					});

     

       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1370
       +
       

     

       1371
       +
       					const body = await req.json();

     

       1372
       +
       					const { name } = body;

     

       1373
       +
       					if (!name) {

     

       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       +
       					}

     

       1376
       +
       					try {

     

       1377
       +
       						updateUserName(user.id, name);

     

       1378
       +
       						return Response.json({ success: true });

     

       1379
       +
       					} catch {

     

       1380
       +
       						return Response.json(

     

       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       +
       							{ status: 500 },

     

       1383
       +
       						);

     

       1384
       +
       					}

     

       1385
       +
       				} catch (err) {

     

       1386
       +
       					return handleError(err);

     

       1387
        
       				}

     

       1388
        
       			},

     

       1389
        
       		},

     

       1390
        
       		"/api/user/avatar": {

     

       1391
        
       			PUT: async (req) => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1392
        
       				try {

     

       1393
       +
       					const user = requireAuth(req);

     

       1394
       +
       

     

       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       +
       					});

     

       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1399
       +
       

     

       1400
       +
       					const body = await req.json();

     

       1401
       +
       					const { avatar } = body;

     

       1402
       +
       					if (!avatar) {

     

       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       +
       					}

     

       1405
       +
       					try {

     

       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       +
       						return Response.json({ success: true });

     

       1408
       +
       					} catch {

     

       1409
       +
       						return Response.json(

     

       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       +
       							{ status: 500 },

     

       1412
       +
       						);

     

       1413
       +
       					}

     

       1414
       +
       				} catch (err) {

     

       1415
       +
       					return handleError(err);

     

       1416
        
       				}

     

       1417
        
       			},

     

       1418
        
       		},

     

       1419
        
       		"/api/user/notifications": {

     

       1420
        
       			PUT: async (req) => {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1421
        
       				try {

     

       1422
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1423
        
       

     

       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       +
       					});

     

       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       1428
        
       

     

       1429
       +
       					const body = await req.json();

     

       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       1432
        
       						return Response.json(

     

       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       +
       							{ status: 400 },

     

       1435
        
       						);

     

       1436
        
       					}

     

       1437
       +
       					try {

     

       1438
       +
       						db.run(

     

       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       +
       						);

     

       1442
       +
       						return Response.json({ success: true });

     

       1443
       +
       					} catch {

     

       1444
        
       						return Response.json(

     

       1445
       +
       							{ error: "Failed to update notification settings" },

     

       1446
        
       							{ status: 500 },

     

       1447
        
       						);

     

       1448
        
       					}

     

       1449
       +
       				} catch (err) {

     

       1450
       +
       					return handleError(err);

     

       1451
       +
       				}

     

       1452
       +
       			},

     

       1453
       +
       		},

     

       1454
       +
       		"/api/billing/checkout": {

     

       1455
       +
       			POST: async (req) => {

     

       1456
       +
       				try {

     

       1457
       +
       					const user = requireAuth(req);

     

       1458
       +
       

     

       1459
       +
       					const { polar } = await import("./lib/polar");

     

       1460
       +
       

     

       1461
       +
       					// Validated at startup

     

       1462
       +
       					const productId = process.env.POLAR_PRODUCT_ID as string;

     

       1463
       +
       					const successUrl =

     

       1464
       +
       						process.env.POLAR_SUCCESS_URL || "http://localhost:3000";

     

       1465
        
       

     

       1466
        
       					const checkout = await polar.checkouts.create({

     

       1467
        
       						products: [productId],

     
···

       1474
        
       					});

     

       1475
        
       

     

       1476
        
       					return Response.json({ url: checkout.url });

     

       1477
       +
       				} catch (err) {

     

       1478
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1479
        
       				}

     

       1480
        
       			},

     

       1481
        
       		},

     

       1482
        
       		"/api/billing/subscription": {

     

       1483
        
       			GET: async (req) => {

     

       1484
       +
       				try {

     

       1485
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1486
        
       

     

       0
        
       
     

       1487
        
       					// Get subscription from database

     

       1488
        
       					const subscription = db

     

       1489
        
       						.query<

     
···

       1506
        
       					}

     

       1507
        
       

     

       1508
        
       					return Response.json({ subscription });

     

       1509
       +
       				} catch (err) {

     

       1510
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1511
        
       				}

     

       1512
        
       			},

     

       1513
        
       		},

     

       1514
        
       		"/api/billing/portal": {

     

       1515
        
       			POST: async (req) => {

     

       1516
       +
       				try {

     

       1517
       +
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1518
        
       

     

       0
        
       
     

       1519
        
       					const { polar } = await import("./lib/polar");

     

       1520
        
       

     

       1521
        
       					// Get subscription to find customer ID

     
···

       1543
        
       					});

     

       1544
        
       

     

       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1546
       +
       				} catch (err) {

     

       1547
       +
       					return handleError(err);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1548
        
       				}

     

       1549
        
       			},

     

       1550
        
       		},

     

       1551
        
       		"/api/webhooks/polar": {

     

       1552
        
       			POST: async (req) => {

     

       1553
       +
       				const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       0
        
       
     

       1554
        
       

     

       1555
       +
       				// Get raw body as string

     

       1556
       +
       				const rawBody = await req.text();

     

       1557
       +
       				const headers = Object.fromEntries(req.headers.entries());

     

       1558
        
       

     

       1559
       +
       				// Validate webhook signature (validated at startup)

     

       1560
       +
       				const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1561
       +
       				let event: ReturnType<typeof validateEvent>;

     

       1562
       +
       				try {

     

       1563
       +
       					event = validateEvent(rawBody, headers, webhookSecret);

     

       1564
       +
       				} catch (error) {

     

       1565
       +
       					// Validation failed - log but return generic response

     

       1566
       +
       					console.error("[Webhook] Signature validation failed:", error);

     

       1567
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1568
       +
       				}

     

       0
        
       
     

       1569
        
       

     

       1570
       +
       				console.log(`[Webhook] Received event: ${event.type}`);

     

       1571
        
       

     

       1572
       +
       				// Handle different event types

     

       1573
       +
       				try {

     

       1574
        
       					switch (event.type) {

     

       1575
        
       						case "subscription.updated": {

     

       1576
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       1631
        
       

     

       1632
        
       					return Response.json({ received: true });

     

       1633
        
       				} catch (error) {

     

       1634
       +
       					// Processing failed - log with detail but return generic response

     

       1635
       +
       					console.error("[Webhook] Event processing failed:", error);

     

       1636
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       0
        
       
     

       0
        
       
     

       1637
        
       				}

     

       1638
        
       			},

     

       1639
        
       		},

     
···

       1644
        
       					const transcriptionId = req.params.id;

     

       1645
        
       					// Verify ownership

     

       1646
        
       					const transcription = db

     

       1647
       +
       						.query<

     

       1648
       +
       							{

     

       1649
       +
       								id: string;

     

       1650
       +
       								user_id: number;

     

       1651
       +
       								class_id: string | null;

     

       1652
       +
       								status: string;

     

       1653
       +
       							},

     

       1654
       +
       							[string]

     

       1655
       +
       						>(

     

       1656
        
       							"SELECT id, user_id, class_id, status FROM transcriptions WHERE id = ?",

     

       1657
        
       						)

     

       1658
        
       						.get(transcriptionId);

     

       1659
       +
       

     

       1660
        
       					if (!transcription) {

     

       1661
        
       						return Response.json(

     

       1662
        
       							{ error: "Transcription not found" },

     
···

       1671
        
       

     

       1672
        
       					// If transcription belongs to a class, check enrollment

     

       1673
        
       					if (transcription.class_id) {

     

       1674
       +
       						isClassMember = isUserEnrolledInClass(

     

       1675
       +
       							user.id,

     

       1676
       +
       							transcription.class_id,

     

       1677
       +
       						);

     

       1678
        
       					}

     

       1679
        
       

     

       1680
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1681
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1683
        
       					}

     

       1684
        
       

     

       1685
        
       					// Require subscription only if accessing own transcription (not class)

     

       1686
       +
       					if (

     

       1687
       +
       						isOwner &&

     

       1688
       +
       						!transcription.class_id &&

     

       1689
       +
       						!isAdmin &&

     

       1690
       +
       						!hasActiveSubscription(user.id)

     

       1691
       +
       					) {

     

       1692
        
       						throw AuthErrors.subscriptionRequired();

     

       1693
        
       					}

     

       1694
        
       					// Event-driven SSE stream with reconnection support

     

       1695
        
       					const stream = new ReadableStream({

     

       1696
        
       						async start(controller) {

     

       1697
       +
       							// Track this stream for graceful shutdown

     

       1698
       +
       							activeSSEStreams.add(controller);

     

       1699
       +
       

     

       1700
        
       							const encoder = new TextEncoder();

     

       1701
        
       							let isClosed = false;

     

       1702
        
       							let lastEventId = Math.floor(Date.now() / 1000);

     
···

       1747
        
       								current?.status === "failed"

     

       1748
        
       							) {

     

       1749
        
       								isClosed = true;

     

       1750
       +
       								activeSSEStreams.delete(controller);

     

       1751
        
       								controller.close();

     

       1752
        
       								return;

     

       1753
        
       							}

     
···

       1778
        
       									isClosed = true;

     

       1779
        
       									clearInterval(heartbeatInterval);

     

       1780
        
       									transcriptionEvents.off(transcriptionId, updateHandler);

     

       1781
       +
       									activeSSEStreams.delete(controller);

     

       1782
        
       									controller.close();

     

       1783
        
       								}

     

       1784
        
       							};

     
···

       1788
        
       								isClosed = true;

     

       1789
        
       								clearInterval(heartbeatInterval);

     

       1790
        
       								transcriptionEvents.off(transcriptionId, updateHandler);

     

       1791
       +
       								activeSSEStreams.delete(controller);

     

       1792
        
       							};

     

       1793
        
       						},

     

       1794
        
       					});

     
···

       1804
        
       				}

     

       1805
        
       			},

     

       1806
        
       		},

     

       1807
       +
       		"/api/health": {

     

       1808
        
       			GET: async () => {

     

       1809
       +
       				const health = {

     

       1810
       +
       					status: "healthy",

     

       1811
       +
       					timestamp: new Date().toISOString(),

     

       1812
       +
       					services: {

     

       1813
       +
       						database: false,

     

       1814
       +
       						whisper: false,

     

       1815
       +
       						storage: false,

     

       1816
       +
       					},

     

       1817
       +
       					details: {} as Record<string, unknown>,

     

       1818
       +
       				};

     

       1819
       +
       

     

       1820
       +
       				// Check database

     

       1821
       +
       				try {

     

       1822
       +
       					db.query("SELECT 1").get();

     

       1823
       +
       					health.services.database = true;

     

       1824
       +
       				} catch (error) {

     

       1825
       +
       					health.status = "unhealthy";

     

       1826
       +
       					health.details.databaseError =

     

       1827
       +
       						error instanceof Error ? error.message : String(error);

     

       1828
       +
       				}

     

       1829
       +
       

     

       1830
       +
       				// Check Whisper service

     

       1831
       +
       				try {

     

       1832
       +
       					const whisperHealthy = await whisperService.checkHealth();

     

       1833
       +
       					health.services.whisper = whisperHealthy;

     

       1834
       +
       					if (!whisperHealthy) {

     

       1835
       +
       						health.status = "degraded";

     

       1836
       +
       						health.details.whisperNote = "Whisper service unavailable";

     

       1837
       +
       					}

     

       1838
       +
       				} catch (error) {

     

       1839
       +
       					health.status = "degraded";

     

       1840
       +
       					health.details.whisperError =

     

       1841
       +
       						error instanceof Error ? error.message : String(error);

     

       1842
       +
       				}

     

       1843
       +
       

     

       1844
       +
       				// Check storage (uploads and transcripts directories)

     

       1845
       +
       				try {

     

       1846
       +
       					const fs = await import("node:fs/promises");

     

       1847
       +
       					const uploadsExists = await fs

     

       1848
       +
       						.access("./uploads")

     

       1849
       +
       						.then(() => true)

     

       1850
       +
       						.catch(() => false);

     

       1851
       +
       					const transcriptsExists = await fs

     

       1852
       +
       						.access("./transcripts")

     

       1853
       +
       						.then(() => true)

     

       1854
       +
       						.catch(() => false);

     

       1855
       +
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1856
       +
       					if (!health.services.storage) {

     

       1857
       +
       						health.status = "unhealthy";

     

       1858
       +
       						health.details.storageNote = `Missing directories: ${[

     

       1859
       +
       							!uploadsExists && "uploads",

     

       1860
       +
       							!transcriptsExists && "transcripts",

     

       1861
       +
       						]

     

       1862
       +
       							.filter(Boolean)

     

       1863
       +
       							.join(", ")}`;

     

       1864
       +
       					}

     

       1865
       +
       				} catch (error) {

     

       1866
       +
       					health.status = "unhealthy";

     

       1867
       +
       					health.details.storageError =

     

       1868
       +
       						error instanceof Error ? error.message : String(error);

     

       1869
       +
       				}

     

       1870
       +
       

     

       1871
       +
       				const statusCode = health.status === "healthy" ? 200 : 503;

     

       1872
       +
       				return Response.json(health, { status: statusCode });

     

       1873
        
       			},

     

       1874
        
       		},

     

       1875
        
       		"/api/transcriptions/:id": {

     
···

       1911
        
       

     

       1912
        
       					// If transcription belongs to a class, check enrollment

     

       1913
        
       					if (transcription.class_id) {

     

       1914
       +
       						isClassMember = isUserEnrolledInClass(

     

       1915
       +
       							user.id,

     

       1916
       +
       							transcription.class_id,

     

       1917
       +
       						);

     

       1918
        
       					}

     

       1919
        
       

     

       1920
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1921
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1923
        
       					}

     

       1924
        
       

     

       1925
        
       					// Require subscription only if accessing own transcription (not class)

     

       1926
       +
       					if (

     

       1927
       +
       						isOwner &&

     

       1928
       +
       						!transcription.class_id &&

     

       1929
       +
       						!isAdmin &&

     

       1930
       +
       						!hasActiveSubscription(user.id)

     

       1931
       +
       					) {

     

       1932
        
       						throw AuthErrors.subscriptionRequired();

     

       1933
        
       					}

     

       1934
        
       

     

       1935
        
       					if (transcription.status !== "completed") {

     

       1936
        
       						return Response.json(

     

       1937
        
       							{ error: "Transcription not completed yet" },

     

       1938
       +
       							{ status: 409 },

     

       1939
        
       						);

     

       1940
        
       					}

     

       1941
        
       

     
···

       2016
        
       

     

       2017
        
       					// If transcription belongs to a class, check enrollment

     

       2018
        
       					if (transcription.class_id) {

     

       2019
       +
       						isClassMember = isUserEnrolledInClass(

     

       2020
       +
       							user.id,

     

       2021
       +
       							transcription.class_id,

     

       2022
       +
       						);

     

       2023
        
       					}

     

       2024
        
       

     

       2025
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       2026
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2028
        
       					}

     

       2029
        
       

     

       2030
        
       					// Require subscription only if accessing own transcription (not class)

     

       2031
       +
       					if (

     

       2032
       +
       						isOwner &&

     

       2033
       +
       						!transcription.class_id &&

     

       2034
       +
       						!isAdmin &&

     

       2035
       +
       						!hasActiveSubscription(user.id)

     

       2036
       +
       					) {

     

       2037
        
       						throw AuthErrors.subscriptionRequired();

     

       2038
        
       					}

     

       2039
        
       

     
···

       2096
        
       				}

     

       2097
        
       			},

     

       2098
        
       		},

     

       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       +
       			POST: async (req) => {

     

       2101
       +
       				try {

     

       2102
       +
       					const user = requireAuth(req);

     

       2103
       +
       

     

       2104
       +
       					const formData = await req.formData();

     

       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       +
       						| string

     

       2109
       +
       						| null;

     

       2110
       +
       

     

       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       +
       

     

       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       +
       						return Response.json(

     

       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       +
       							{ status: 403 },

     

       2120
       +
       						);

     

       2121
       +
       					}

     

       2122
       +
       

     

       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       +
       

     

       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       +
       					if (fileTimestampStr) {

     

       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       +
       							console.log(

     

       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       +
       							);

     

       2133
       +
       						}

     

       2134
       +
       					}

     

       2135
       +
       

     

       2136
       +
       					if (!creationDate) {

     

       2137
       +
       						return Response.json({

     

       2138
       +
       							detected: false,

     

       2139
       +
       							meeting_time_id: null,

     

       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       +
       						});

     

       2142
       +
       					}

     

       2143
       +
       

     

       2144
       +
       					// Get meeting times for this class

     

       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       +
       

     

       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       +
       						return Response.json({

     

       2149
       +
       							detected: false,

     

       2150
       +
       							meeting_time_id: null,

     

       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       +
       						});

     

       2153
       +
       					}

     

       2154
       +
       

     

       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       +
       						creationDate,

     

       2158
       +
       						meetingTimes,

     

       2159
       +
       					);

     

       2160
       +
       

     

       2161
       +
       					if (matchedId) {

     

       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       +
       						return Response.json({

     

       2164
       +
       							detected: true,

     

       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       +
       							day: dayName,

     

       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       +
       						});

     

       2169
       +
       					}

     

       2170
       +
       

     

       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       +
       					return Response.json({

     

       2173
       +
       						detected: false,

     

       2174
       +
       						meeting_time_id: null,

     

       2175
       +
       						day: dayName,

     

       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       +
       					});

     

       2179
       +
       				} catch (error) {

     

       2180
       +
       					return handleError(error);

     

       2181
       +
       				}

     

       2182
       +
       			},

     

       2183
       +
       		},

     

       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       +
       			PATCH: async (req) => {

     

       2186
       +
       				try {

     

       2187
       +
       					const user = requireAuth(req);

     

       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       +
       

     

       2190
       +
       					const body = await req.json();

     

       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       +
       					const sectionId = body.section_id;

     

       2193
       +
       

     

       2194
       +
       					if (!meetingTimeId) {

     

       2195
       +
       						return Response.json(

     

       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       +
       							{ status: 400 },

     

       2198
       +
       						);

     

       2199
       +
       					}

     

       2200
       +
       

     

       2201
       +
       					// Verify transcription ownership

     

       2202
       +
       					const transcription = db

     

       2203
       +
       						.query<

     

       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       +
       							[string]

     

       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       +
       						.get(transcriptionId);

     

       2208
       +
       

     

       2209
       +
       					if (!transcription) {

     

       2210
       +
       						return Response.json(

     

       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       +
       							{ status: 404 },

     

       2213
       +
       						);

     

       2214
       +
       					}

     

       2215
       +
       

     

       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       +
       					}

     

       2219
       +
       

     

       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       +
       					if (transcription.class_id) {

     

       2222
       +
       						const meetingTime = db

     

       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       +
       							)

     

       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       +
       

     

       2228
       +
       						if (!meetingTime) {

     

       2229
       +
       							return Response.json(

     

       2230
       +
       								{

     

       2231
       +
       									error:

     

       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       +
       								},

     

       2234
       +
       								{ status: 400 },

     

       2235
       +
       							);

     

       2236
       +
       						}

     

       2237
       +
       					}

     

       2238
       +
       

     

       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       +
       						db.run(

     

       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       +
       						);

     

       2245
       +
       					} else {

     

       2246
       +
       						db.run(

     

       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       +
       						);

     

       2250
       +
       					}

     

       2251
       +
       

     

       2252
       +
       					return Response.json({

     

       2253
       +
       						success: true,

     

       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       +
       					});

     

       2256
       +
       				} catch (error) {

     

       2257
       +
       					return handleError(error);

     

       2258
       +
       				}

     

       2259
       +
       			},

     

       2260
       +
       		},

     

       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       2262
        
       			GET: async (req) => {

     

       2263
        
       				try {

     

       2264
       +
       					const user = requireAuth(req);

     

       2265
       +
       					const classId = req.params.classId;

     

       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       2267
       +
       

     

       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       +
       						return Response.json(

     

       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       +
       							{ status: 403 },

     

       2274
       +
       						);

     

       2275
       +
       					}

     

       2276
       +
       

     

       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       +
       					const url = new URL(req.url);

     

       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       +
       					const sectionFilter =

     

       2281
       +
       						sectionParam !== null

     

       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       +
       							: user.role === "admin"

     

       2284
       +
       								? null

     

       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
        
       

     

       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       +
       						classId,

     

       2289
       +
       						meetingTimeId,

     

       2290
       +
       						sectionFilter,

     

       2291
       +
       					);

     

       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       +
       						user.id,

     

       2295
       +
       						classId,

     

       2296
       +
       						meetingTimeId,

     

       2297
       +
       					);

     

       2298
       +
       

     

       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       +
       						classId,

     

       2302
       +
       						meetingTimeId,

     

       2303
       +
       						sectionFilter,

     

       2304
       +
       					);

     

       2305
       +
       

     

       2306
       +
       					return Response.json({

     

       2307
       +
       						recordings,

     

       2308
       +
       						total_users: totalUsers,

     

       2309
       +
       						user_vote: userVote,

     

       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       +
       						winning_recording_id: winningId,

     

       2312
       +
       					});

     

       2313
       +
       				} catch (error) {

     

       2314
       +
       					return handleError(error);

     

       2315
       +
       				}

     

       2316
       +
       			},

     

       2317
       +
       		},

     

       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       +
       			POST: async (req) => {

     

       2320
       +
       				try {

     

       2321
       +
       					const user = requireAuth(req);

     

       2322
       +
       					const recordingId = req.params.id;

     

       2323
       +
       

     

       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       +
       					const recording = db

     

       2326
        
       						.query<

     

       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       +
       							[string]

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2329
        
       						>(

     

       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       2331
        
       						)

     

       2332
       +
       						.get(recordingId);

     

       2333
       +
       

     

       2334
       +
       					if (!recording) {

     

       2335
       +
       						return Response.json(

     

       2336
       +
       							{ error: "Recording not found" },

     

       2337
       +
       							{ status: 404 },

     

       2338
       +
       						);

     

       2339
       +
       					}

     

       2340
       +
       

     

       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       +
       						return Response.json(

     

       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       +
       							{ status: 400 },

     

       2345
       +
       						);

     

       2346
       +
       					}

     

       2347
       +
       

     

       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       +
       						return Response.json(

     

       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       +
       							{ status: 403 },

     

       2353
       +
       						);

     

       2354
       +
       					}

     

       2355
       +
       

     

       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       +
       						user.id,

     

       2359
       +
       						recording.class_id,

     

       2360
       +
       						recording.meeting_time_id,

     

       2361
       +
       					);

     

       2362
       +
       					if (existingVote) {

     

       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       +
       					}

     

       2365
       +
       

     

       2366
       +
       					// Add new vote

     

       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       +
       

     

       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       +
       					const userSection =

     

       2371
       +
       						user.role === "admin"

     

       2372
       +
       							? null

     

       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       +
       

     

       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       +
       						recording.class_id,

     

       2378
       +
       						recording.meeting_time_id,

     

       2379
       +
       						userSection,

     

       2380
       +
       					);

     

       2381
       +
       					if (winningId) {

     

       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       +
       						// Start transcription

     

       2384
       +
       						const winningRecording = db

     

       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       +
       							)

     

       2388
       +
       							.get(winningId);

     

       2389
       +
       						if (winningRecording) {

     

       2390
       +
       							whisperService.startTranscription(

     

       2391
       +
       								winningId,

     

       2392
       +
       								winningRecording.filename,

     

       2393
       +
       							);

     

       2394
       +
       						}

     

       2395
       +
       					}

     

       2396
       +
       

     

       2397
       +
       					return Response.json({

     

       2398
       +
       						success,

     

       2399
       +
       						winning_recording_id: winningId,

     

       2400
       +
       					});

     

       2401
       +
       				} catch (error) {

     

       2402
       +
       					return handleError(error);

     

       2403
       +
       				}

     

       2404
       +
       			},

     

       2405
       +
       		},

     

       2406
       +
       		"/api/recordings/:id": {

     

       2407
       +
       			DELETE: async (req) => {

     

       2408
       +
       				try {

     

       2409
       +
       					const user = requireAuth(req);

     

       2410
       +
       					const recordingId = req.params.id;

     

       2411
       +
       

     

       2412
       +
       					const success = deletePendingRecording(

     

       2413
       +
       						recordingId,

     

       2414
       +
       						user.id,

     

       2415
       +
       						user.role === "admin",

     

       2416
       +
       					);

     

       2417
       +
       

     

       2418
       +
       					if (!success) {

     

       2419
       +
       						return Response.json(

     

       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       +
       							{ status: 403 },

     

       2422
       +
       						);

     

       2423
       +
       					}

     

       2424
       +
       

     

       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       +
       				} catch (error) {

     

       2427
       +
       					return handleError(error);

     

       2428
       +
       				}

     

       2429
       +
       			},

     

       2430
       +
       		},

     

       2431
       +
       		"/api/transcriptions": {

     

       2432
       +
       			GET: async (req) => {

     

       2433
       +
       				try {

     

       2434
       +
       					const user = requireSubscription(req);

     

       2435
       +
       					const url = new URL(req.url);

     

       2436
       +
       

     

       2437
       +
       					// Parse pagination params

     

       2438
       +
       					const limit = Math.min(

     

       2439
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2440
       +
       						100,

     

       2441
       +
       					);

     

       2442
       +
       					const cursorParam = url.searchParams.get("cursor");

     

       2443
       +
       

     

       2444
       +
       					let transcriptions: Array<{

     

       2445
       +
       						id: string;

     

       2446
       +
       						filename: string;

     

       2447
       +
       						original_filename: string;

     

       2448
       +
       						class_id: string | null;

     

       2449
       +
       						status: string;

     

       2450
       +
       						progress: number;

     

       2451
       +
       						created_at: number;

     

       2452
       +
       					}>;

     

       2453
       +
       

     

       2454
       +
       					if (cursorParam) {

     

       2455
       +
       						// Decode cursor

     

       2456
       +
       						const { decodeCursor } = await import("./lib/cursor");

     

       2457
       +
       						const parts = decodeCursor(cursorParam);

     

       2458
       +
       

     

       2459
       +
       						if (parts.length !== 2) {

     

       2460
       +
       							return Response.json(

     

       2461
       +
       								{ error: "Invalid cursor format" },

     

       2462
       +
       								{ status: 400 },

     

       2463
       +
       							);

     

       2464
       +
       						}

     

       2465
       +
       

     

       2466
       +
       						const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       2467
       +
       						const id = parts[1] || "";

     

       2468
       +
       

     

       2469
       +
       						if (Number.isNaN(cursorTime) || !id) {

     

       2470
       +
       							return Response.json(

     

       2471
       +
       								{ error: "Invalid cursor format" },

     

       2472
       +
       								{ status: 400 },

     

       2473
       +
       							);

     

       2474
       +
       						}

     

       2475
       +
       

     

       2476
       +
       						transcriptions = db

     

       2477
       +
       							.query<

     

       2478
       +
       								{

     

       2479
       +
       									id: string;

     

       2480
       +
       									filename: string;

     

       2481
       +
       									original_filename: string;

     

       2482
       +
       									class_id: string | null;

     

       2483
       +
       									status: string;

     

       2484
       +
       									progress: number;

     

       2485
       +
       									created_at: number;

     

       2486
       +
       								},

     

       2487
       +
       								[number, number, string, number]

     

       2488
       +
       							>(

     

       2489
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2490
       +
       								FROM transcriptions 

     

       2491
       +
       								WHERE user_id = ? AND (created_at < ? OR (created_at = ? AND id < ?))

     

       2492
       +
       								ORDER BY created_at DESC, id DESC 

     

       2493
       +
       								LIMIT ?`,

     

       2494
       +
       							)

     

       2495
       +
       							.all(user.id, cursorTime, cursorTime, id, limit + 1);

     

       2496
       +
       					} else {

     

       2497
       +
       						transcriptions = db

     

       2498
       +
       							.query<

     

       2499
       +
       								{

     

       2500
       +
       									id: string;

     

       2501
       +
       									filename: string;

     

       2502
       +
       									original_filename: string;

     

       2503
       +
       									class_id: string | null;

     

       2504
       +
       									status: string;

     

       2505
       +
       									progress: number;

     

       2506
       +
       									created_at: number;

     

       2507
       +
       								},

     

       2508
       +
       								[number, number]

     

       2509
       +
       							>(

     

       2510
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2511
       +
       								FROM transcriptions 

     

       2512
       +
       								WHERE user_id = ? 

     

       2513
       +
       								ORDER BY created_at DESC, id DESC 

     

       2514
       +
       								LIMIT ?`,

     

       2515
       +
       							)

     

       2516
       +
       							.all(user.id, limit + 1);

     

       2517
       +
       					}

     

       2518
       +
       

     

       2519
       +
       					// Check if there are more results

     

       2520
       +
       					const hasMore = transcriptions.length > limit;

     

       2521
       +
       					if (hasMore) {

     

       2522
       +
       						transcriptions.pop(); // Remove extra item

     

       2523
       +
       					}

     

       2524
       +
       

     

       2525
       +
       					// Build next cursor

     

       2526
       +
       					let nextCursor: string | null = null;

     

       2527
       +
       					if (hasMore && transcriptions.length > 0) {

     

       2528
       +
       						const { encodeCursor } = await import("./lib/cursor");

     

       2529
       +
       						const last = transcriptions[transcriptions.length - 1];

     

       2530
       +
       						if (last) {

     

       2531
       +
       							nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       2532
       +
       						}

     

       2533
       +
       					}

     

       2534
        
       

     

       2535
        
       					// Load transcripts from files for completed jobs

     

       2536
        
       					const jobs = await Promise.all(

     
···

       2546
        
       						}),

     

       2547
        
       					);

     

       2548
        
       

     

       2549
       +
       					return Response.json({

     

       2550
       +
       						jobs,

     

       2551
       +
       						pagination: {

     

       2552
       +
       							limit,

     

       2553
       +
       							hasMore,

     

       2554
       +
       							nextCursor,

     

       2555
       +
       						},

     

       2556
       +
       					});

     

       2557
        
       				} catch (error) {

     

       2558
        
       					return handleError(error);

     

       2559
        
       				}

     
···

       2562
        
       				try {

     

       2563
        
       					const user = requireSubscription(req);

     

       2564
        
       

     

       2565
       +
       					const rateLimitError = enforceRateLimit(req, "upload-transcription", {

     

       2566
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       2567
       +
       					});

     

       2568
       +
       					if (rateLimitError) return rateLimitError;

     

       2569
       +
       

     

       2570
        
       					const formData = await req.formData();

     

       2571
        
       					const file = formData.get("audio") as File;

     

       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       2575
        
       						| string

     

       2576
        
       						| null;

     

       2577
        
       

     
···

       2640
        
       					const uploadDir = "./uploads";

     

       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       2642
        
       

     

       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       +
       

     

       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       2649
        
       					db.run(

     

       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       2651
        
       						[

     

       2652
        
       							transcriptionId,

     

       2653
        
       							user.id,

     

       2654
        
       							classId,

     

       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       +
       							sectionId,

     

       2657
        
       							filename,

     

       2658
        
       							file.name,

     

       2659
        
       							"pending",

     

       2660
       +
       							recordingDate,

     

       2661
        
       						],

     

       2662
        
       					);

     

       2663
        
       

     

       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       2666
        
       

     

       2667
       +
       					return Response.json(

     

       2668
       +
       						{

     

       2669
       +
       							id: transcriptionId,

     

       2670
       +
       							message: "Upload successful",

     

       2671
       +
       						},

     

       2672
       +
       						{ status: 201 },

     

       2673
       +
       					);

     

       2674
        
       				} catch (error) {

     

       2675
        
       					return handleError(error);

     

       2676
        
       				}

     
···

       2680
        
       			GET: async (req) => {

     

       2681
        
       				try {

     

       2682
        
       					requireAdmin(req);

     

       2683
       +
       					const url = new URL(req.url);

     

       2684
       +
       

     

       2685
       +
       					const limit = Math.min(

     

       2686
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2687
       +
       						100,

     

       2688
       +
       					);

     

       2689
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2690
       +
       

     

       2691
       +
       					const result = getAllTranscriptions(limit, cursor);

     

       2692
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       2693
        
       				} catch (error) {

     

       2694
        
       					return handleError(error);

     

       2695
        
       				}

     
···

       2699
        
       			GET: async (req) => {

     

       2700
        
       				try {

     

       2701
        
       					requireAdmin(req);

     

       2702
       +
       					const url = new URL(req.url);

     

       2703
       +
       

     

       2704
       +
       					const limit = Math.min(

     

       2705
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2706
       +
       						100,

     

       2707
       +
       					);

     

       2708
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2709
       +
       

     

       2710
       +
       					const result = getAllUsersWithStats(limit, cursor);

     

       2711
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       2712
        
       				} catch (error) {

     

       2713
        
       					return handleError(error);

     

       2714
        
       				}

     
···

       2742
        
       					requireAdmin(req);

     

       2743
        
       					const id = req.params.id;

     

       2744
        
       					deleteWaitlistEntry(id);

     

       2745
       +
       					return new Response(null, { status: 204 });

     

       2746
        
       				} catch (error) {

     

       2747
        
       					return handleError(error);

     

       2748
        
       				}

     
···

       2754
        
       					requireAdmin(req);

     

       2755
        
       					const transcriptionId = req.params.id;

     

       2756
        
       					deleteTranscription(transcriptionId);

     

       2757
       +
       					return new Response(null, { status: 204 });

     

       2758
        
       				} catch (error) {

     

       2759
        
       					return handleError(error);

     

       2760
        
       				}

     
···

       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2770
        
       					}

     

       2771
        
       					await deleteUser(userId);

     

       2772
       +
       					return new Response(null, { status: 204 });

     

       2773
        
       				} catch (error) {

     

       2774
        
       					return handleError(error);

     

       2775
        
       				}

     
···

       2862
        
       						.get(userId);

     

       2863
        
       

     

       2864
        
       					if (!user) {

     

       2865
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2866
        
       					}

     

       2867
        
       

     

       2868
        
       					try {

     
···

       2962
        
       				}

     

       2963
        
       			},

     

       2964
        
       		},

     

       2965
       +
       		"/api/admin/users/:id/password-reset": {

     

       2966
       +
       			POST: async (req) => {

     

       2967
        
       				try {

     

       2968
        
       					requireAdmin(req);

     

       2969
        
       					const userId = Number.parseInt(req.params.id, 10);

     
···

       2971
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2972
        
       					}

     

       2973
        
       

     

       2974
       +
       					// Get user details

     

       2975
       +
       					const user = db

     

       2976
       +
       						.query<

     

       2977
       +
       							{ id: number; email: string; name: string | null },

     

       2978
       +
       							[number]

     

       2979
       +
       						>("SELECT id, email, name FROM users WHERE id = ?")

     

       2980
       +
       						.get(userId);

     

       2981
        
       

     

       2982
       +
       					if (!user) {

     

       2983
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2984
        
       					}

     

       2985
        
       

     

       2986
       +
       					// Create password reset token

     

       2987
       +
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       2988
       +
       					const resetToken = createPasswordResetToken(user.id);

     

       2989
       +
       					const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       2990
       +
       

     

       2991
       +
       					// Send password reset email

     

       2992
       +
       					await sendEmail({

     

       2993
       +
       						to: user.email,

     

       2994
       +
       						subject: "Reset your password - Thistle",

     

       2995
       +
       						html: passwordResetTemplate({

     

       2996
       +
       							name: user.name,

     

       2997
       +
       							resetLink,

     

       2998
       +
       						}),

     

       2999
       +
       					});

     

       3000
       +
       

     

       3001
       +
       					return Response.json({

     

       3002
       +
       						success: true,

     

       3003
       +
       						message: "Password reset email sent",

     

       3004
       +
       					});

     

       3005
        
       				} catch (error) {

     

       3006
       +
       					console.error("[Admin] Password reset error:", error);

     

       3007
        
       					return handleError(error);

     

       3008
        
       				}

     

       3009
        
       			},

     
···

       3019
        
       

     

       3020
        
       					const { passkeyId } = req.params;

     

       3021
        
       					deletePasskey(passkeyId, userId);

     

       3022
       +
       					return new Response(null, { status: 204 });

     

       3023
        
       				} catch (error) {

     

       3024
        
       					return handleError(error);

     

       3025
        
       				}

     
···

       3037
        
       					const body = await req.json();

     

       3038
        
       					const { name } = body as { name: string };

     

       3039
        
       

     

       3040
       +
       					const nameValidation = validateName(name);

     

       3041
       +
       					if (!nameValidation.valid) {

     

       3042
        
       						return Response.json(

     

       3043
       +
       							{ error: nameValidation.error },

     

       3044
        
       							{ status: 400 },

     

       3045
        
       						);

     

       3046
        
       					}

     
···

       3062
        
       					}

     

       3063
        
       

     

       3064
        
       					const body = await req.json();

     

       3065
       +
       					const { email, skipVerification } = body as {

     

       3066
       +
       						email: string;

     

       3067
       +
       						skipVerification?: boolean;

     

       3068
       +
       					};

     

       3069
        
       

     

       3070
       +
       					const emailValidation = validateEmail(email);

     

       3071
       +
       					if (!emailValidation.valid) {

     

       3072
        
       						return Response.json(

     

       3073
       +
       							{ error: emailValidation.error },

     

       3074
        
       							{ status: 400 },

     

       3075
        
       						);

     

       3076
        
       					}

     
···

       3085
        
       					if (existing) {

     

       3086
        
       						return Response.json(

     

       3087
        
       							{ error: "Email already in use" },

     

       3088
       +
       							{ status: 409 },

     

       3089
        
       						);

     

       3090
        
       					}

     

       3091
        
       

     

       3092
       +
       					if (skipVerification) {

     

       3093
       +
       						// Admin override: change email immediately without verification

     

       3094
       +
       						updateUserEmailAddress(userId, email);

     

       3095
       +
       						return Response.json({

     

       3096
       +
       							success: true,

     

       3097
       +
       							message: "Email updated immediately (verification skipped)",

     

       3098
       +
       						});

     

       3099
       +
       					}

     

       3100
       +
       

     

       3101
       +
       					// Get user's current email

     

       3102
       +
       					const user = db

     

       3103
       +
       						.query<{ email: string; name: string | null }, [number]>(

     

       3104
       +
       							"SELECT email, name FROM users WHERE id = ?",

     

       3105
       +
       						)

     

       3106
       +
       						.get(userId);

     

       3107
       +
       

     

       3108
       +
       					if (!user) {

     

       3109
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3110
       +
       					}

     

       3111
       +
       

     

       3112
       +
       					// Send verification email to user's current email

     

       3113
       +
       					try {

     

       3114
       +
       						const token = createEmailChangeToken(userId, email);

     

       3115
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       3116
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       3117
       +
       

     

       3118
       +
       						await sendEmail({

     

       3119
       +
       							to: user.email,

     

       3120
       +
       							subject: "Verify your email change",

     

       3121
       +
       							html: emailChangeTemplate({

     

       3122
       +
       								name: user.name,

     

       3123
       +
       								currentEmail: user.email,

     

       3124
       +
       								newEmail: email,

     

       3125
       +
       								verifyLink: verifyUrl,

     

       3126
       +
       							}),

     

       3127
       +
       						});

     

       3128
       +
       

     

       3129
       +
       						return Response.json({

     

       3130
       +
       							success: true,

     

       3131
       +
       							message: `Verification email sent to ${user.email}`,

     

       3132
       +
       							pendingEmail: email,

     

       3133
       +
       						});

     

       3134
       +
       					} catch (emailError) {

     

       3135
       +
       						console.error(

     

       3136
       +
       							"[Admin] Failed to send email change verification:",

     

       3137
       +
       							emailError,

     

       3138
       +
       						);

     

       3139
       +
       						return Response.json(

     

       3140
       +
       							{ error: "Failed to send verification email" },

     

       3141
       +
       							{ status: 500 },

     

       3142
       +
       						);

     

       3143
       +
       					}

     

       3144
        
       				} catch (error) {

     

       3145
        
       					return handleError(error);

     

       3146
        
       				}

     
···

       3170
        
       					}

     

       3171
        
       

     

       3172
        
       					deleteAllUserSessions(userId);

     

       3173
       +
       					return new Response(null, { status: 204 });

     

       3174
        
       				} catch (error) {

     

       3175
        
       					return handleError(error);

     

       3176
        
       				}

     
···

       3195
        
       						);

     

       3196
        
       					}

     

       3197
        
       

     

       3198
       +
       					return new Response(null, { status: 204 });

     

       3199
        
       				} catch (error) {

     

       3200
        
       					return handleError(error);

     

       3201
        
       				}

     
···

       3257
        
       			GET: async (req) => {

     

       3258
        
       				try {

     

       3259
        
       					const user = requireAuth(req);

     

       3260
       +
       					const url = new URL(req.url);

     

       3261
       +
       

     

       3262
       +
       					const limit = Math.min(

     

       3263
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       3264
       +
       						100,

     

       3265
       +
       					);

     

       3266
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       3267
       +
       

     

       3268
       +
       					const result = getClassesForUser(

     

       3269
       +
       						user.id,

     

       3270
       +
       						user.role === "admin",

     

       3271
       +
       						limit,

     

       3272
       +
       						cursor,

     

       3273
       +
       					);

     

       3274
        
       

     

       3275
       +
       					// Group by semester/year for all users

     

       3276
        
       					const grouped: Record<

     

       3277
        
       						string,

     

       3278
        
       						Array<{

     
···

       3286
        
       						}>

     

       3287
        
       					> = {};

     

       3288
        
       

     

       3289
       +
       					for (const cls of result.data) {

     

       3290
        
       						const key = `${cls.semester} ${cls.year}`;

     

       3291
        
       						if (!grouped[key]) {

     

       3292
        
       							grouped[key] = [];

     
···

       3302
        
       						});

     

       3303
        
       					}

     

       3304
        
       

     

       3305
       +
       					return Response.json({

     

       3306
       +
       						classes: grouped,

     

       3307
       +
       						pagination: result.pagination,

     

       3308
       +
       					});

     

       3309
        
       				} catch (error) {

     

       3310
        
       					return handleError(error);

     

       3311
        
       				}

     
···

       3323
        
       						meeting_times,

     

       3324
        
       					} = body;

     

       3325
        
       

     

       3326
       +
       					// Validate all required fields

     

       3327
       +
       					const courseCodeValidation = validateCourseCode(course_code);

     

       3328
       +
       					if (!courseCodeValidation.valid) {

     

       3329
       +
       						return Response.json(

     

       3330
       +
       							{ error: courseCodeValidation.error },

     

       3331
       +
       							{ status: 400 },

     

       3332
       +
       						);

     

       3333
       +
       					}

     

       3334
       +
       

     

       3335
       +
       					const nameValidation = validateCourseName(name);

     

       3336
       +
       					if (!nameValidation.valid) {

     

       3337
       +
       						return Response.json(

     

       3338
       +
       							{ error: nameValidation.error },

     

       3339
       +
       							{ status: 400 },

     

       3340
       +
       						);

     

       3341
       +
       					}

     

       3342
       +
       

     

       3343
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3344
       +
       					if (!professorValidation.valid) {

     

       3345
        
       						return Response.json(

     

       3346
       +
       							{ error: professorValidation.error },

     

       3347
       +
       							{ status: 400 },

     

       3348
       +
       						);

     

       3349
       +
       					}

     

       3350
       +
       

     

       3351
       +
       					const semesterValidation = validateSemester(semester);

     

       3352
       +
       					if (!semesterValidation.valid) {

     

       3353
       +
       						return Response.json(

     

       3354
       +
       							{ error: semesterValidation.error },

     

       3355
       +
       							{ status: 400 },

     

       3356
       +
       						);

     

       3357
       +
       					}

     

       3358
       +
       

     

       3359
       +
       					const yearValidation = validateYear(year);

     

       3360
       +
       					if (!yearValidation.valid) {

     

       3361
       +
       						return Response.json(

     

       3362
       +
       							{ error: yearValidation.error },

     

       3363
        
       							{ status: 400 },

     

       3364
        
       						);

     

       3365
        
       					}

     
···

       3371
        
       						semester,

     

       3372
        
       						year,

     

       3373
        
       						meeting_times,

     

       3374
       +
       						sections: body.sections,

     

       3375
        
       					});

     

       3376
        
       

     

       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       3378
        
       				} catch (error) {

     

       3379
        
       					return handleError(error);

     

       3380
        
       				}

     
···

       3401
        
       						.all(user.id)

     

       3402
        
       						.map((row) => row.class_id);

     

       3403
        
       

     

       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       3406
        
       						...cls,

     

       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       +
       						sections: getClassSections(cls.id),

     

       3409
        
       					}));

     

       3410
        
       

     

       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       3420
        
       					const user = requireAuth(req);

     

       3421
        
       					const body = await req.json();

     

       3422
        
       					const classId = body.class_id;

     

       3423
       +
       					const sectionId = body.section_id || null;

     

       3424
        
       

     

       3425
       +
       					const classIdValidation = validateClassId(classId);

     

       3426
       +
       					if (!classIdValidation.valid) {

     

       3427
        
       						return Response.json(

     

       3428
       +
       							{ error: classIdValidation.error },

     

       3429
        
       							{ status: 400 },

     

       3430
        
       						);

     

       3431
        
       					}

     

       3432
        
       

     

       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       3434
        
       

     

       3435
        
       					if (!result.success) {

     

       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       3437
        
       					}

     

       3438
        
       

     

       3439
       +
       					return new Response(null, { status: 204 });

     

       3440
        
       				} catch (error) {

     

       3441
        
       					return handleError(error);

     

       3442
        
       				}

     
···

       3458
        
       						meetingTimes,

     

       3459
        
       					} = body;

     

       3460
        
       

     

       3461
       +
       					// Validate all required fields

     

       3462
       +
       					const courseCodeValidation = validateCourseCode(courseCode);

     

       3463
       +
       					if (!courseCodeValidation.valid) {

     

       3464
        
       						return Response.json(

     

       3465
       +
       							{ error: courseCodeValidation.error },

     

       3466
       +
       							{ status: 400 },

     

       3467
       +
       						);

     

       3468
       +
       					}

     

       3469
       +
       

     

       3470
       +
       					const nameValidation = validateCourseName(courseName);

     

       3471
       +
       					if (!nameValidation.valid) {

     

       3472
       +
       						return Response.json(

     

       3473
       +
       							{ error: nameValidation.error },

     

       3474
       +
       							{ status: 400 },

     

       3475
       +
       						);

     

       3476
       +
       					}

     

       3477
       +
       

     

       3478
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3479
       +
       					if (!professorValidation.valid) {

     

       3480
       +
       						return Response.json(

     

       3481
       +
       							{ error: professorValidation.error },

     

       3482
       +
       							{ status: 400 },

     

       3483
       +
       						);

     

       3484
       +
       					}

     

       3485
       +
       

     

       3486
       +
       					const semesterValidation = validateSemester(semester);

     

       3487
       +
       					if (!semesterValidation.valid) {

     

       3488
       +
       						return Response.json(

     

       3489
       +
       							{ error: semesterValidation.error },

     

       3490
       +
       							{ status: 400 },

     

       3491
       +
       						);

     

       3492
       +
       					}

     

       3493
       +
       

     

       3494
       +
       					const yearValidation = validateYear(

     

       3495
       +
       						typeof year === "string" ? Number.parseInt(year, 10) : year,

     

       3496
       +
       					);

     

       3497
       +
       					if (!yearValidation.valid) {

     

       3498
       +
       						return Response.json(

     

       3499
       +
       							{ error: yearValidation.error },

     

       3500
        
       							{ status: 400 },

     

       3501
        
       						);

     

       3502
        
       					}

     
···

       3512
        
       						meetingTimes || null,

     

       3513
        
       					);

     

       3514
        
       

     

       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       3516
        
       				} catch (error) {

     

       3517
        
       					return handleError(error);

     

       3518
        
       				}

     
···

       3539
        
       					}

     

       3540
        
       

     

       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       +
       					const sections = getClassSections(classId);

     

       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       3545
        
       

     

       3546
        
       					return Response.json({

     

       3547
        
       						class: classInfo,

     

       3548
        
       						meetingTimes,

     

       3549
       +
       						sections,

     

       3550
       +
       						userSection,

     

       3551
        
       						transcriptions,

     

       3552
        
       					});

     

       3553
        
       				} catch (error) {

     
···

       3559
        
       					requireAdmin(req);

     

       3560
        
       					const classId = req.params.id;

     

       3561
        
       

     

       3562
       +
       					// Verify class exists

     

       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       +
       					if (!existingClass) {

     

       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       +
       					}

     

       3567
       +
       

     

       3568
        
       					deleteClass(classId);

     

       3569
       +
       					return new Response(null, { status: 204 });

     

       3570
        
       				} catch (error) {

     

       3571
        
       					return handleError(error);

     

       3572
        
       				}

     
···

       3587
        
       						);

     

       3588
        
       					}

     

       3589
        
       

     

       3590
       +
       					// Verify class exists

     

       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       +
       					if (!existingClass) {

     

       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
       +
       					}

     

       3595
       +
       

     

       3596
        
       					toggleClassArchive(classId, archived);

     

       3597
       +
       					return new Response(null, { status: 204 });

     

       3598
        
       				} catch (error) {

     

       3599
        
       					return handleError(error);

     

       3600
        
       				}

     
···

       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       3624
        
       					}

     

       3625
        
       

     

       3626
       +
       					// Verify class exists

     

       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       +
       					if (!existingClass) {

     

       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       +
       					}

     

       3631
       +
       

     

       3632
        
       					const user = getUserByEmail(email);

     

       3633
        
       					if (!user) {

     

       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3635
        
       					}

     

       3636
        
       

     

       3637
        
       					enrollUserInClass(user.id, classId);

     

       3638
       +
       					return new Response(null, { status: 201 });

     

       3639
        
       				} catch (error) {

     

       3640
        
       					return handleError(error);

     

       3641
        
       				}

     
···

       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       3653
        
       					}

     

       3654
        
       

     

       3655
       +
       					// Verify class exists

     

       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       +
       					if (!existingClass) {

     

       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       +
       					}

     

       3660
       +
       

     

       3661
        
       					removeUserFromClass(userId, classId);

     

       3662
       +
       					return new Response(null, { status: 204 });

     

       3663
        
       				} catch (error) {

     

       3664
        
       					return handleError(error);

     

       3665
        
       				}

     
···

       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3698
        
       					}

     

       3699
        
       

     

       3700
       +
       					// Verify class exists

     

       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       +
       					if (!existingClass) {

     

       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       +
       					}

     

       3705
       +
       

     

       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       +
       				} catch (error) {

     

       3709
       +
       					return handleError(error);

     

       3710
       +
       				}

     

       3711
       +
       			},

     

       3712
       +
       		},

     

       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       +
       			POST: async (req) => {

     

       3715
       +
       				try {

     

       3716
       +
       					requireAdmin(req);

     

       3717
       +
       					const classId = req.params.id;

     

       3718
       +
       					const body = await req.json();

     

       3719
       +
       					const { section_number } = body;

     

       3720
       +
       

     

       3721
       +
       					if (!section_number) {

     

       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       +
       					}

     

       3724
       +
       

     

       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       +
       					return Response.json(section);

     

       3727
       +
       				} catch (error) {

     

       3728
       +
       					return handleError(error);

     

       3729
       +
       				}

     

       3730
       +
       			},

     

       3731
       +
       		},

     

       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       +
       			DELETE: async (req) => {

     

       3734
       +
       				try {

     

       3735
       +
       					requireAdmin(req);

     

       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       +
       

     

       3738
       +
       					// Check if any students are in this section

     

       3739
       +
       					const studentsInSection = db

     

       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       +
       						)

     

       3743
       +
       						.get(sectionId);

     

       3744
       +
       

     

       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       +
       						return Response.json(

     

       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       +
       							{ status: 400 },

     

       3749
       +
       						);

     

       3750
       +
       					}

     

       3751
       +
       

     

       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       +
       					return new Response(null, { status: 204 });

     

       3754
        
       				} catch (error) {

     

       3755
        
       					return handleError(error);

     

       3756
        
       				}

     
···

       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3769
        
       					}

     

       3770
        
       

     

       3771
       +
       					// Verify meeting exists

     

       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       +
       					if (!existingMeeting) {

     

       3774
       +
       						return Response.json(

     

       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       +
       							{ status: 404 },

     

       3777
       +
       						);

     

       3778
       +
       					}

     

       3779
       +
       

     

       3780
        
       					updateMeetingTime(meetingId, label);

     

       3781
       +
       					return new Response(null, { status: 204 });

     

       3782
        
       				} catch (error) {

     

       3783
        
       					return handleError(error);

     

       3784
        
       				}

     
···

       3788
        
       					requireAdmin(req);

     

       3789
        
       					const meetingId = req.params.id;

     

       3790
        
       

     

       3791
       +
       					// Verify meeting exists

     

       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       +
       					if (!existingMeeting) {

     

       3794
       +
       						return Response.json(

     

       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       +
       							{ status: 404 },

     

       3797
       +
       						);

     

       3798
       +
       					}

     

       3799
       +
       

     

       3800
        
       					deleteMeetingTime(meetingId);

     

       3801
       +
       					return new Response(null, { status: 204 });

     

       3802
        
       				} catch (error) {

     

       3803
        
       					return handleError(error);

     

       3804
        
       				}

     
···

       3809
        
       				try {

     

       3810
        
       					requireAdmin(req);

     

       3811
        
       					const transcriptId = req.params.id;

     

       3812
       +
       

     

       3813
       +
       					// Check if transcription exists and get its current status

     

       3814
       +
       					const transcription = db

     

       3815
       +
       						.query<{ filename: string; status: string }, [string]>(

     

       3816
       +
       							"SELECT filename, status FROM transcriptions WHERE id = ?",

     

       3817
       +
       						)

     

       3818
       +
       						.get(transcriptId);

     

       3819
       +
       

     

       3820
       +
       					if (!transcription) {

     

       3821
       +
       						return Response.json(

     

       3822
       +
       							{ error: "Transcription not found" },

     

       3823
       +
       							{ status: 404 },

     

       3824
       +
       						);

     

       3825
       +
       					}

     

       3826
       +
       

     

       3827
       +
       					// Validate that status is appropriate for selection (e.g., 'uploading' or 'pending')

     

       3828
       +
       					const validStatuses = ["uploading", "pending", "failed"];

     

       3829
       +
       					if (!validStatuses.includes(transcription.status)) {

     

       3830
       +
       						return Response.json(

     

       3831
       +
       							{

     

       3832
       +
       								error: `Cannot select transcription with status: ${transcription.status}`,

     

       3833
       +
       							},

     

       3834
       +
       							{ status: 400 },

     

       3835
       +
       						);

     

       3836
       +
       					}

     

       3837
        
       

     

       3838
        
       					// Update status to 'selected' and start transcription

     

       3839
        
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     
···

       3841
        
       						transcriptId,

     

       3842
        
       					]);

     

       3843
        
       

     

       3844
       +
       					whisperService.startTranscription(

     

       3845
       +
       						transcriptId,

     

       3846
       +
       						transcription.filename,

     

       3847
       +
       					);

     

       0
        
       
     

       0
        
       
     

       3848
        
       

     

       3849
       +
       					return new Response(null, { status: 204 });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3850
        
       				} catch (error) {

     

       3851
        
       					return handleError(error);

     

       3852
        
       				}

     

       3853
        
       			},

     

       3854
        
       		},

     

       3855
        
       	},

     

       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       +
       	fetch(req, server) {

     

       3858
       +
       		const response = server.fetch(req);

     

       3859
       +
       

     

       3860
       +
       		// Add security headers to all responses

     

       3861
       +
       		if (response instanceof Response) {

     

       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       +
       

     

       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       +
       			headers.set(

     

       3871
       +
       				"Content-Security-Policy",

     

       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       +
       			);

     

       3874
       +
       

     

       3875
       +
       			return new Response(response.body, {

     

       3876
       +
       				status: response.status,

     

       3877
       +
       				statusText: response.statusText,

     

       3878
       +
       				headers,

     

       3879
       +
       			});

     

       3880
       +
       		}

     

       3881
       +
       

     

       3882
       +
       		return response;

     

       3883
        
       	},

     

       3884
        
       });

     

       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     

       3886
       +
       

     

       3887
       +
       // Track active SSE streams for graceful shutdown

     

       3888
       +
       const activeSSEStreams = new Set<ReadableStreamDefaultController>();

     

       3889
       +
       

     

       3890
       +
       // Graceful shutdown handler

     

       3891
       +
       let isShuttingDown = false;

     

       3892
       +
       

     

       3893
       +
       async function shutdown(signal: string) {

     

       3894
       +
       	if (isShuttingDown) return;

     

       3895
       +
       	isShuttingDown = true;

     

       3896
       +
       

     

       3897
       +
       	console.log(`\n${signal} received, starting graceful shutdown...`);

     

       3898
       +
       

     

       3899
       +
       	// 1. Stop accepting new requests

     

       3900
       +
       	console.log("[Shutdown] Closing server...");

     

       3901
       +
       	server.stop();

     

       3902
       +
       

     

       3903
       +
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3904
       +
       	console.log(

     

       3905
       +
       		`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`,

     

       3906
       +
       	);

     

       3907
       +
       	for (const controller of activeSSEStreams) {

     

       3908
       +
       		try {

     

       3909
       +
       			controller.close();

     

       3910
       +
       		} catch {

     

       3911
       +
       			// Already closed

     

       3912
       +
       		}

     

       3913
       +
       	}

     

       3914
       +
       	activeSSEStreams.clear();

     

       3915
       +
       

     

       3916
       +
       	// 3. Stop transcription service (closes streams to Murmur)

     

       3917
       +
       	whisperService.stop();

     

       3918
       +
       

     

       3919
       +
       	// 4. Stop cleanup intervals

     

       3920
       +
       	console.log("[Shutdown] Stopping cleanup intervals...");

     

       3921
       +
       	clearInterval(sessionCleanupInterval);

     

       3922
       +
       	clearInterval(syncInterval);

     

       3923
       +
       	clearInterval(fileCleanupInterval);

     

       3924
       +
       

     

       3925
       +
       	// 5. Close database connections

     

       3926
       +
       	console.log("[Shutdown] Closing database...");

     

       3927
       +
       	db.close();

     

       3928
       +
       

     

       3929
       +
       	console.log("[Shutdown] Complete");

     

       3930
       +
       	process.exit(0);

     

       3931
       +
       }

     

       3932
       +
       

     

       3933
       +
       // Register shutdown handlers

     

       3934
       +
       process.on("SIGTERM", () => shutdown("SIGTERM"));

     

       3935
       +
       process.on("SIGINT", () => shutdown("SIGINT"));

+136

src/lib/api-response-format.test.ts

···

       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       +
       

     

       3
       +
       /**

     

       4
       +
        * API Response Format Standards

     

       5
       +
        *

     

       6
       +
        * This test documents the standardized response formats across the API.

     

       7
       +
        * All endpoints should follow these patterns for consistency.

     

       8
       +
        */

     

       9
       +
       

     

       10
       +
       describe("API Response Format Standards", () => {

     

       11
       +
       	test("success responses should include success: true", () => {

     

       12
       +
       		// Success-only responses (no data returned)

     

       13
       +
       		const successOnly = { success: true };

     

       14
       +
       		expect(successOnly).toHaveProperty("success", true);

     

       15
       +
       

     

       16
       +
       		// Success with message

     

       17
       +
       		const successWithMessage = {

     

       18
       +
       			success: true,

     

       19
       +
       			message: "Operation completed successfully",

     

       20
       +
       		};

     

       21
       +
       		expect(successWithMessage).toHaveProperty("success", true);

     

       22
       +
       		expect(successWithMessage).toHaveProperty("message");

     

       23
       +
       

     

       24
       +
       		// Success with data

     

       25
       +
       		const successWithData = {

     

       26
       +
       			success: true,

     

       27
       +
       			data: { id: 1, name: "Test" },

     

       28
       +
       		};

     

       29
       +
       		expect(successWithData).toHaveProperty("success", true);

     

       30
       +
       		expect(successWithData).toHaveProperty("data");

     

       31
       +
       	});

     

       32
       +
       

     

       33
       +
       	test("error responses should use error field", () => {

     

       34
       +
       		const errorResponse = { error: "Something went wrong" };

     

       35
       +
       		expect(errorResponse).toHaveProperty("error");

     

       36
       +
       		expect(typeof errorResponse.error).toBe("string");

     

       37
       +
       	});

     

       38
       +
       

     

       39
       +
       	test("data responses can return data directly", () => {

     

       40
       +
       		// Direct data return (common pattern for GET endpoints)

     

       41
       +
       		const userData = {

     

       42
       +
       			user: { id: 1, email: "test@example.com" },

     

       43
       +
       			has_subscription: true,

     

       44
       +
       		};

     

       45
       +
       		expect(userData).toHaveProperty("user");

     

       46
       +
       

     

       47
       +
       		// List responses

     

       48
       +
       		const listData = {

     

       49
       +
       			jobs: [{ id: "1" }, { id: "2" }],

     

       50
       +
       			pagination: { limit: 50, hasMore: false, nextCursor: null },

     

       51
       +
       		};

     

       52
       +
       		expect(listData).toHaveProperty("jobs");

     

       53
       +
       		expect(listData).toHaveProperty("pagination");

     

       54
       +
       	});

     

       55
       +
       

     

       56
       +
       	test("message-only responses are converted to success+message", () => {

     

       57
       +
       		// OLD (deprecated): { message: "..." }

     

       58
       +
       		// NEW (standard): { success: true, message: "..." }

     

       59
       +
       

     

       60
       +
       		const newFormat = {

     

       61
       +
       			success: true,

     

       62
       +
       			message: "Verification email sent",

     

       63
       +
       		};

     

       64
       +
       

     

       65
       +
       		expect(newFormat).toHaveProperty("success", true);

     

       66
       +
       		expect(newFormat).toHaveProperty("message");

     

       67
       +
       	});

     

       68
       +
       });

     

       69
       +
       

     

       70
       +
       describe("API Response Patterns", () => {

     

       71
       +
       	test("authentication responses", () => {

     

       72
       +
       		// Login success

     

       73
       +
       		const login = {

     

       74
       +
       			user: { id: 1, email: "test@example.com" },

     

       75
       +
       			email_verification_required: false,

     

       76
       +
       		};

     

       77
       +
       		expect(login).toHaveProperty("user");

     

       78
       +
       

     

       79
       +
       		// Logout success

     

       80
       +
       		const logout = { success: true };

     

       81
       +
       		expect(logout.success).toBe(true);

     

       82
       +
       

     

       83
       +
       		// Email verified

     

       84
       +
       		const verified = {

     

       85
       +
       			success: true,

     

       86
       +
       			message: "Email verified successfully",

     

       87
       +
       			email_verified: true,

     

       88
       +
       			user: { id: 1, email: "test@example.com" },

     

       89
       +
       		};

     

       90
       +
       		expect(verified.success).toBe(true);

     

       91
       +
       		expect(verified).toHaveProperty("message");

     

       92
       +
       	});

     

       93
       +
       

     

       94
       +
       	test("CRUD operation responses", () => {

     

       95
       +
       		// Create (returns created object)

     

       96
       +
       		const created = {

     

       97
       +
       			id: "123",

     

       98
       +
       			name: "New Item",

     

       99
       +
       			created_at: Date.now(),

     

       100
       +
       		};

     

       101
       +
       		expect(created).toHaveProperty("id");

     

       102
       +
       

     

       103
       +
       		// Update (returns success)

     

       104
       +
       		const updated = { success: true };

     

       105
       +
       		expect(updated.success).toBe(true);

     

       106
       +
       

     

       107
       +
       		// Delete (returns success)

     

       108
       +
       		const deleted = { success: true };

     

       109
       +
       		expect(deleted.success).toBe(true);

     

       110
       +
       

     

       111
       +
       		// Get (returns data directly)

     

       112
       +
       		const fetched = {

     

       113
       +
       			id: "123",

     

       114
       +
       			name: "Item",

     

       115
       +
       		};

     

       116
       +
       		expect(fetched).toHaveProperty("id");

     

       117
       +
       	});

     

       118
       +
       

     

       119
       +
       	test("paginated list responses", () => {

     

       120
       +
       		const paginatedList = {

     

       121
       +
       			data: [{ id: "1" }, { id: "2" }],

     

       122
       +
       			pagination: {

     

       123
       +
       				limit: 50,

     

       124
       +
       				hasMore: true,

     

       125
       +
       				nextCursor: "MTczMjM5NjgwMHx0cmFucy0xMjM",

     

       126
       +
       			},

     

       127
       +
       		};

     

       128
       +
       

     

       129
       +
       		expect(paginatedList).toHaveProperty("data");

     

       130
       +
       		expect(Array.isArray(paginatedList.data)).toBe(true);

     

       131
       +
       		expect(paginatedList).toHaveProperty("pagination");

     

       132
       +
       		expect(paginatedList.pagination).toHaveProperty("limit");

     

       133
       +
       		expect(paginatedList.pagination).toHaveProperty("hasMore");

     

       134
       +
       		expect(paginatedList.pagination).toHaveProperty("nextCursor");

     

       135
       +
       	});

     

       136
       +
       });

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       +
       

     

       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       +
       

     

       7
       +
       	// Clean up test file after tests

     

       8
       +
       	afterAll(async () => {

     

       9
       +
       		try {

     

       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       +
       				if (exists) {

     

       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       +
       				}

     

       14
       +
       			});

     

       15
       +
       		} catch {

     

       16
       +
       			// Ignore cleanup errors

     

       17
       +
       		}

     

       18
       +
       	});

     

       19
       +
       

     

       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       +
       

     

       25
       +
       		// Create the file with metadata

     

       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       +
       

     

       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       +
       

     

       30
       +
       		expect(date).not.toBeNull();

     

       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       +
       	});

     

       35
       +
       

     

       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       +
       		// Create audio file without metadata

     

       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       +
       

     

       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       +
       

     

       42
       +
       		// Should use file modification time as fallback

     

       43
       +
       		expect(date).not.toBeNull();

     

       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       +
       		// Should be very recent (within last minute)

     

       46
       +
       		const now = new Date();

     

       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       +
       	});

     

       50
       +
       

     

       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       +
       		expect(date).toBeNull();

     

       54
       +
       	});

     

       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       +
       import {

     

       3
       +
       	findMatchingMeetingTime,

     

       4
       +
       	getDayName,

     

       5
       +
       	getDayOfWeek,

     

       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       +
       } from "./audio-metadata";

     

       8
       +
       

     

       9
       +
       describe("getDayOfWeek", () => {

     

       10
       +
       	test("returns correct day number", () => {

     

       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       +
       

     

       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       +
       

     

       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       +
       	});

     

       23
       +
       });

     

       24
       +
       

     

       25
       +
       describe("getDayName", () => {

     

       26
       +
       	test("returns correct day name", () => {

     

       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       +
       	});

     

       35
       +
       });

     

       36
       +
       

     

       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       +
       	test("matches full day names", () => {

     

       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       +
       			true,

     

       43
       +
       		);

     

       44
       +
       	});

     

       45
       +
       

     

       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       +
       			true,

     

       51
       +
       		);

     

       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       +
       	});

     

       57
       +
       

     

       58
       +
       	test("is case insensitive", () => {

     

       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       +
       	});

     

       63
       +
       

     

       64
       +
       	test("does not match wrong days", () => {

     

       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       +
       	});

     

       69
       +
       

     

       70
       +
       	test("handles labels without day names", () => {

     

       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       +
       	});

     

       75
       +
       });

     

       76
       +
       

     

       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       +
       	const meetingTimes = [

     

       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       +
       	];

     

       83
       +
       

     

       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       +
       

     

       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       +
       

     

       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       +
       	});

     

       94
       +
       

     

       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       +
       		const abbrevMeetingTimes = [

     

       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       +
       		];

     

       101
       +
       

     

       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       +
       	});

     

       105
       +
       

     

       106
       +
       	test("returns null when no match found", () => {

     

       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       +
       

     

       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       +
       	});

     

       113
       +
       

     

       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       +
       	});

     

       118
       +
       

     

       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       +
       		const duplicateMeetingTimes = [

     

       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       +
       		];

     

       124
       +
       

     

       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       +
       	});

     

       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       +
       import { $ } from "bun";

     

       2
       +
       

     

       3
       +
       /**

     

       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       +
        * @param filePath Path to audio file

     

       7
       +
        * @returns Date object or null if not found

     

       8
       +
        */

     

       9
       +
       export async function extractAudioCreationDate(

     

       10
       +
       	filePath: string,

     

       11
       +
       ): Promise<Date | null> {

     

       12
       +
       	try {

     

       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       +
       		// -v quiet: suppress verbose output

     

       15
       +
       		// -print_format json: output as JSON

     

       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       +
       		const result =

     

       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       +
       

     

       20
       +
       		const metadata = JSON.parse(result);

     

       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       +
       

     

       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       +
       		const dateFields = [

     

       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       +
       			tags.date, // Common date field

     

       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       +
       			tags.year, // Year field

     

       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       +
       		];

     

       34
       +
       

     

       35
       +
       		for (const dateField of dateFields) {

     

       36
       +
       			if (dateField) {

     

       37
       +
       				const date = new Date(dateField);

     

       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       +
       					console.log(

     

       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       +
       					);

     

       42
       +
       					return date;

     

       43
       +
       				}

     

       44
       +
       			}

     

       45
       +
       		}

     

       46
       +
       

     

       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       +
       		console.log(

     

       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       +
       		);

     

       52
       +
       		const file = Bun.file(filePath);

     

       53
       +
       		const stat = await file.stat();

     

       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       +
       		console.log(

     

       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       +
       		);

     

       58
       +
       		return date;

     

       59
       +
       	} catch (error) {

     

       60
       +
       		console.error(

     

       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       +
       		);

     

       64
       +
       		return null;

     

       65
       +
       	}

     

       66
       +
       }

     

       67
       +
       

     

       68
       +
       /**

     

       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       +
        */

     

       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       +
       	return date.getDay();

     

       73
       +
       }

     

       74
       +
       

     

       75
       +
       /**

     

       76
       +
        * Gets day name from a date

     

       77
       +
        */

     

       78
       +
       export function getDayName(date: Date): string {

     

       79
       +
       	const days = [

     

       80
       +
       		"Sunday",

     

       81
       +
       		"Monday",

     

       82
       +
       		"Tuesday",

     

       83
       +
       		"Wednesday",

     

       84
       +
       		"Thursday",

     

       85
       +
       		"Friday",

     

       86
       +
       		"Saturday",

     

       87
       +
       	];

     

       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       +
       }

     

       90
       +
       

     

       91
       +
       /**

     

       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       +
        */

     

       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       +
       	label: string,

     

       97
       +
       	dayName: string,

     

       98
       +
       ): boolean {

     

       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       +
       

     

       102
       +
       	// Check for full day name

     

       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       +
       		return true;

     

       105
       +
       	}

     

       106
       +
       

     

       107
       +
       	// Check for 3-letter abbreviations

     

       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       +
       		return true;

     

       111
       +
       	}

     

       112
       +
       

     

       113
       +
       	return false;

     

       114
       +
       }

     

       115
       +
       

     

       116
       +
       /**

     

       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       +
        * @param date Date from audio metadata

     

       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       +
        */

     

       122
       +
       export function findMatchingMeetingTime(

     

       123
       +
       	date: Date,

     

       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       +
       ): string | null {

     

       126
       +
       	const dayName = getDayName(date);

     

       127
       +
       

     

       128
       +
       	// Find meeting time that matches the day

     

       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       +
       	);

     

       132
       +
       

     

       133
       +
       	if (match) {

     

       134
       +
       		console.log(

     

       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       +
       		);

     

       137
       +
       		return match.id;

     

       138
       +
       	}

     

       139
       +
       

     

       140
       +
       	console.log(

     

       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       +
       	);

     

       143
       +
       	return null;

     

       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
        
       	};

     

       131
        
       	expect(typeof result.count).toBe("number");

     

       132
        
       });

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       130
        
       	};

     

       131
        
       	expect(typeof result.count).toBe("number");

     

       132
        
       });

     

       133
       +
       

     

       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       +
       	const userId = 999;

     

       136
       +
       

     

       137
       +
       	// Clean up any existing sessions for this user

     

       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       +
       

     

       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       +
       	const sessionIds: string[] = [];

     

       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       +
       		sessionIds.push(sessionId);

     

       145
       +
       	}

     

       146
       +
       

     

       147
       +
       	// Count total sessions for user

     

       148
       +
       	const sessionCount = db

     

       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       +
       		)

     

       152
       +
       		.get(userId);

     

       153
       +
       

     

       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       +
       

     

       156
       +
       	// First session should be deleted (oldest)

     

       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       +
       	expect(firstSession).toBeNull();

     

       159
       +
       

     

       160
       +
       	// Last session should exist (newest)

     

       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       +
       

     

       164
       +
       	// Cleanup

     

       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       +
       });

+300 -81

src/lib/auth.ts

···

       1
        
       import db from "../db/schema";

     

       2
        
       

     

       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       0
        
       
     

       4
        
       

     

       5
        
       export type UserRole = "user" | "admin";

     

       6
        
       

     
···

       30
        
       ): string {

     

       31
        
       	const sessionId = crypto.randomUUID();

     

       32
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       33
        
       

     

       34
        
       	db.run(

     

       35
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       190
        
       

     

       191
        
       	// Get user's subscription if they have one

     

       192
        
       	const subscription = db

     

       193
       -
       		.query<{ id: string }, [number]>(

     

       194
       -
       			"SELECT id FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       195
        
       		)

     

       196
        
       		.get(userId);

     

       197
        
       

     

       198
       -
       	// Cancel subscription if it exists (soft cancel - keeps access until period end)

     

       199
       -
       	if (subscription) {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       200
        
       		try {

     

       201
        
       			const { polar } = await import("./polar");

     

       202
        
       			await polar.subscriptions.update({

     
···

       213
        
       			);

     

       214
        
       			// Continue with user deletion even if subscription cancellation fails

     

       215
        
       		}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       216
        
       	}

     

       217
        
       

     

       218
        
       	// Reassign class transcriptions to ghost user (id=0)

     
···

       221
        
       		"UPDATE transcriptions SET user_id = 0 WHERE user_id = ? AND class_id IS NOT NULL",

     

       222
        
       		[userId],

     

       223
        
       	);

     

       224
       -
       	db.run(

     

       225
       -
       		"DELETE FROM transcriptions WHERE user_id = ? AND class_id IS NULL",

     

       226
       -
       		[userId],

     

       227
       -
       	);

     

       228
        
       

     

       229
        
       	// Delete user (CASCADE will handle sessions, passkeys, subscriptions, class_members)

     

       230
        
       	db.run("DELETE FROM users WHERE id = ?", [userId]);

     
···

       257
        
        * Email verification functions

     

       258
        
        */

     

       259
        
       

     

       260
       -
       export function createEmailVerificationToken(userId: number): { code: string; token: string; sentAt: number } {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       261
        
       	// Generate a 6-digit code for user to enter

     

       262
        
       	const code = Math.floor(100000 + Math.random() * 900000).toString();

     

       263
        
       	const id = crypto.randomUUID();

     
···

       273
        
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       274
        
       		[id, userId, code, expiresAt],

     

       275
        
       	);

     

       276
       -
       	

     

       277
        
       	// Store the URL token as a separate entry

     

       278
        
       	db.run(

     

       279
        
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     
···

       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       290
        
       

     

       291
        
       	const result = db

     

       292
       -
       		.query<

     

       293
       -
       			{ user_id: number; email: string },

     

       294
       -
       			[string, number]

     

       295
       -
       		>(

     

       296
        
       			`SELECT evt.user_id, u.email 

     

       297
        
              FROM email_verification_tokens evt

     

       298
        
              JOIN users u ON evt.user_id = u.id

     
···

       311
        
       	return { userId: result.user_id, email: result.email };

     

       312
        
       }

     

       313
        
       

     

       314
       -
       export function verifyEmailCode(

     

       315
       -
       	userId: number,

     

       316
       -
       	code: string,

     

       317
       -
       ): boolean {

     

       318
        
       	const now = Math.floor(Date.now() / 1000);

     

       319
        
       

     

       320
        
       	const result = db

     

       321
       -
       		.query<

     

       322
       -
       			{ user_id: number },

     

       323
       -
       			[number, string, number]

     

       324
       -
       		>(

     

       325
        
       			`SELECT user_id 

     

       326
        
              FROM email_verification_tokens

     

       327
        
              WHERE user_id = ? AND token = ? AND expires_at > ?`,

     
···

       395
        
       	db.run("DELETE FROM password_reset_tokens WHERE token = ?", [token]);

     

       396
        
       }

     

       397
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       398
        
       export function isUserAdmin(userId: number): boolean {

     

       399
        
       	const result = db

     

       400
        
       		.query<{ role: UserRole }, [number]>("SELECT role FROM users WHERE id = ?")

     
···

       433
        
       		.all();

     

       434
        
       }

     

       435
        
       

     

       436
       -
       export function getAllTranscriptions(): Array<{

     

       437
       -
       	id: string;

     

       438
       -
       	user_id: number;

     

       439
       -
       	user_email: string;

     

       440
       -
       	user_name: string | null;

     

       441
       -
       	original_filename: string;

     

       442
       -
       	status: string;

     

       443
       -
       	created_at: number;

     

       444
       -
       	error_message: string | null;

     

       445
       -
       }> {

     

       446
       -
       	return db

     

       447
       -
       		.query<

     

       448
       -
       			{

     

       449
       -
       				id: string;

     

       450
       -
       				user_id: number;

     

       451
       -
       				user_email: string;

     

       452
       -
       				user_name: string | null;

     

       453
       -
       				original_filename: string;

     

       454
       -
       				status: string;

     

       455
       -
       				created_at: number;

     

       456
       -
       				error_message: string | null;

     

       457
       -
       			},

     

       458
       -
       			[]

     

       459
       -
       		>(

     

       460
       -
       			`SELECT 

     

       461
       -
               t.id, 

     

       462
       -
               t.user_id, 

     

       463
       -
               u.email as user_email, 

     

       464
       -
               u.name as user_name, 

     

       465
       -
               t.original_filename, 

     

       466
       -
               t.status, 

     

       467
       -
               t.created_at,

     

       468
       -
               t.error_message

     

       469
       -
             FROM transcriptions t

     

       470
       -
             LEFT JOIN users u ON t.user_id = u.id

     

       471
       -
             ORDER BY t.created_at DESC`,

     

       472
       -
       		)

     

       473
       -
       		.all();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       474
        
       }

     

       475
        
       

     

       476
        
       export function deleteTranscription(transcriptionId: string): void {

     
···

       556
        
       	subscription_id: string | null;

     

       557
        
       }

     

       558
        
       

     

       559
       -
       export function getAllUsersWithStats(): UserWithStats[] {

     

       560
       -
       	return db

     

       561
       -
       		.query<UserWithStats, []>(

     

       562
       -
       			`SELECT 

     

       563
       -
               u.id, 

     

       564
       -
               u.email, 

     

       565
       -
               u.name, 

     

       566
       -
               u.avatar, 

     

       567
       -
               u.created_at, 

     

       568
       -
               u.role,

     

       569
       -
               u.last_login,

     

       570
       -
               COUNT(DISTINCT t.id) as transcription_count,

     

       571
       -
               s.status as subscription_status,

     

       572
       -
               s.id as subscription_id

     

       573
       -
             FROM users u

     

       574
       -
             LEFT JOIN transcriptions t ON u.id = t.user_id

     

       575
       -
             LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       576
       -
             GROUP BY u.id

     

       577
       -
             ORDER BY u.created_at DESC`,

     

       578
       -
       		)

     

       579
       -
       		.all();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       580
        
       }

···

       1
        
       import db from "../db/schema";

     

       2
        
       

     

       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       5
        
       

     

       6
        
       export type UserRole = "user" | "admin";

     

       7
        
       

     
···

       31
        
       ): string {

     

       32
        
       	const sessionId = crypto.randomUUID();

     

       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       +
       

     

       35
       +
       	// Check current session count for user

     

       36
       +
       	const sessionCount = db

     

       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       +
       		)

     

       40
       +
       		.get(userId);

     

       41
       +
       

     

       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       +
       		db.run(

     

       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       +
       				SELECT id FROM sessions 

     

       48
       +
       				WHERE user_id = ? 

     

       49
       +
       				ORDER BY created_at ASC 

     

       50
       +
       				LIMIT ?

     

       51
       +
       			)`,

     

       52
       +
       			[userId, sessionsToDelete],

     

       53
       +
       		);

     

       54
       +
       	}

     

       55
        
       

     

       56
        
       	db.run(

     

       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       212
        
       

     

       213
        
       	// Get user's subscription if they have one

     

       214
        
       	const subscription = db

     

       215
       +
       		.query<

     

       216
       +
       			{ id: string; status: string; cancel_at_period_end: number },

     

       217
       +
       			[number]

     

       218
       +
       		>(

     

       219
       +
       			"SELECT id, status, cancel_at_period_end FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       220
        
       		)

     

       221
        
       		.get(userId);

     

       222
        
       

     

       223
       +
       	// Cancel subscription if it exists and is not already canceled or scheduled to cancel

     

       224
       +
       	if (

     

       225
       +
       		subscription &&

     

       226
       +
       		subscription.status !== "canceled" &&

     

       227
       +
       		subscription.status !== "expired" &&

     

       228
       +
       		!subscription.cancel_at_period_end

     

       229
       +
       	) {

     

       230
        
       		try {

     

       231
        
       			const { polar } = await import("./polar");

     

       232
        
       			await polar.subscriptions.update({

     
···

       243
        
       			);

     

       244
        
       			// Continue with user deletion even if subscription cancellation fails

     

       245
        
       		}

     

       246
       +
       	} else if (subscription) {

     

       247
       +
       		console.log(

     

       248
       +
       			`[User Delete] Skipping cancellation for subscription ${subscription.id} (status: ${subscription.status}, cancel_at_period_end: ${subscription.cancel_at_period_end})`,

     

       249
       +
       		);

     

       250
        
       	}

     

       251
        
       

     

       252
        
       	// Reassign class transcriptions to ghost user (id=0)

     
···

       255
        
       		"UPDATE transcriptions SET user_id = 0 WHERE user_id = ? AND class_id IS NOT NULL",

     

       256
        
       		[userId],

     

       257
        
       	);

     

       258
       +
       	db.run("DELETE FROM transcriptions WHERE user_id = ? AND class_id IS NULL", [

     

       259
       +
       		userId,

     

       260
       +
       	]);

     

       0
        
       
     

       261
        
       

     

       262
        
       	// Delete user (CASCADE will handle sessions, passkeys, subscriptions, class_members)

     

       263
        
       	db.run("DELETE FROM users WHERE id = ?", [userId]);

     
···

       290
        
        * Email verification functions

     

       291
        
        */

     

       292
        
       

     

       293
       +
       export function createEmailVerificationToken(userId: number): {

     

       294
       +
       	code: string;

     

       295
       +
       	token: string;

     

       296
       +
       	sentAt: number;

     

       297
       +
       } {

     

       298
        
       	// Generate a 6-digit code for user to enter

     

       299
        
       	const code = Math.floor(100000 + Math.random() * 900000).toString();

     

       300
        
       	const id = crypto.randomUUID();

     
···

       310
        
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       311
        
       		[id, userId, code, expiresAt],

     

       312
        
       	);

     

       313
       +
       

     

       314
        
       	// Store the URL token as a separate entry

     

       315
        
       	db.run(

     

       316
        
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     
···

       326
        
       	const now = Math.floor(Date.now() / 1000);

     

       327
        
       

     

       328
        
       	const result = db

     

       329
       +
       		.query<{ user_id: number; email: string }, [string, number]>(

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       330
        
       			`SELECT evt.user_id, u.email 

     

       331
        
              FROM email_verification_tokens evt

     

       332
        
              JOIN users u ON evt.user_id = u.id

     
···

       345
        
       	return { userId: result.user_id, email: result.email };

     

       346
        
       }

     

       347
        
       

     

       348
       +
       export function verifyEmailCode(userId: number, code: string): boolean {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       349
        
       	const now = Math.floor(Date.now() / 1000);

     

       350
        
       

     

       351
        
       	const result = db

     

       352
       +
       		.query<{ user_id: number }, [number, string, number]>(

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       353
        
       			`SELECT user_id 

     

       354
        
              FROM email_verification_tokens

     

       355
        
              WHERE user_id = ? AND token = ? AND expires_at > ?`,

     
···

       423
        
       	db.run("DELETE FROM password_reset_tokens WHERE token = ?", [token]);

     

       424
        
       }

     

       425
        
       

     

       426
       +
       /**

     

       427
       +
        * Email change functions

     

       428
       +
        */

     

       429
       +
       

     

       430
       +
       export function createEmailChangeToken(

     

       431
       +
       	userId: number,

     

       432
       +
       	newEmail: string,

     

       433
       +
       ): string {

     

       434
       +
       	const token = crypto.randomUUID();

     

       435
       +
       	const id = crypto.randomUUID();

     

       436
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 24 * 60 * 60; // 24 hours

     

       437
       +
       

     

       438
       +
       	// Delete any existing email change tokens for this user

     

       439
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [userId]);

     

       440
       +
       

     

       441
       +
       	db.run(

     

       442
       +
       		"INSERT INTO email_change_tokens (id, user_id, new_email, token, expires_at) VALUES (?, ?, ?, ?, ?)",

     

       443
       +
       		[id, userId, newEmail, token, expiresAt],

     

       444
       +
       	);

     

       445
       +
       

     

       446
       +
       	return token;

     

       447
       +
       }

     

       448
       +
       

     

       449
       +
       export function verifyEmailChangeToken(

     

       450
       +
       	token: string,

     

       451
       +
       ): { userId: number; newEmail: string } | null {

     

       452
       +
       	const now = Math.floor(Date.now() / 1000);

     

       453
       +
       

     

       454
       +
       	const result = db

     

       455
       +
       		.query<{ user_id: number; new_email: string }, [string, number]>(

     

       456
       +
       			"SELECT user_id, new_email FROM email_change_tokens WHERE token = ? AND expires_at > ?",

     

       457
       +
       		)

     

       458
       +
       		.get(token, now);

     

       459
       +
       

     

       460
       +
       	if (!result) return null;

     

       461
       +
       

     

       462
       +
       	return { userId: result.user_id, newEmail: result.new_email };

     

       463
       +
       }

     

       464
       +
       

     

       465
       +
       export function consumeEmailChangeToken(token: string): void {

     

       466
       +
       	db.run("DELETE FROM email_change_tokens WHERE token = ?", [token]);

     

       467
       +
       }

     

       468
       +
       

     

       469
        
       export function isUserAdmin(userId: number): boolean {

     

       470
        
       	const result = db

     

       471
        
       		.query<{ role: UserRole }, [number]>("SELECT role FROM users WHERE id = ?")

     
···

       504
        
       		.all();

     

       505
        
       }

     

       506
        
       

     

       507
       +
       export function getAllTranscriptions(

     

       508
       +
       	limit = 50,

     

       509
       +
       	cursor?: string,

     

       510
       +
       ): {

     

       511
       +
       	data: Array<{

     

       512
       +
       		id: string;

     

       513
       +
       		user_id: number;

     

       514
       +
       		user_email: string;

     

       515
       +
       		user_name: string | null;

     

       516
       +
       		original_filename: string;

     

       517
       +
       		status: string;

     

       518
       +
       		created_at: number;

     

       519
       +
       		error_message: string | null;

     

       520
       +
       	}>;

     

       521
       +
       	pagination: {

     

       522
       +
       		limit: number;

     

       523
       +
       		hasMore: boolean;

     

       524
       +
       		nextCursor: string | null;

     

       525
       +
       	};

     

       526
       +
       } {

     

       527
       +
       	type TranscriptionRow = {

     

       528
       +
       		id: string;

     

       529
       +
       		user_id: number;

     

       530
       +
       		user_email: string;

     

       531
       +
       		user_name: string | null;

     

       532
       +
       		original_filename: string;

     

       533
       +
       		status: string;

     

       534
       +
       		created_at: number;

     

       535
       +
       		error_message: string | null;

     

       536
       +
       	};

     

       537
       +
       

     

       538
       +
       	let transcriptions: TranscriptionRow[];

     

       539
       +
       

     

       540
       +
       	if (cursor) {

     

       541
       +
       		const { decodeCursor } = require("./cursor");

     

       542
       +
       		const parts = decodeCursor(cursor);

     

       543
       +
       

     

       544
       +
       		if (parts.length !== 2) {

     

       545
       +
       			throw new Error("Invalid cursor format");

     

       546
       +
       		}

     

       547
       +
       

     

       548
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       549
       +
       		const id = parts[1] || "";

     

       550
       +
       

     

       551
       +
       		if (Number.isNaN(cursorTime) || !id) {

     

       552
       +
       			throw new Error("Invalid cursor format");

     

       553
       +
       		}

     

       554
       +
       

     

       555
       +
       		transcriptions = db

     

       556
       +
       			.query<TranscriptionRow, [number, number, string, number]>(

     

       557
       +
       				`SELECT 

     

       558
       +
       					t.id, 

     

       559
       +
       					t.user_id, 

     

       560
       +
       					u.email as user_email, 

     

       561
       +
       					u.name as user_name, 

     

       562
       +
       					t.original_filename, 

     

       563
       +
       					t.status, 

     

       564
       +
       					t.created_at,

     

       565
       +
       					t.error_message

     

       566
       +
       				FROM transcriptions t

     

       567
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       568
       +
       				WHERE t.created_at < ? OR (t.created_at = ? AND t.id < ?)

     

       569
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       570
       +
       				LIMIT ?`,

     

       571
       +
       			)

     

       572
       +
       			.all(cursorTime, cursorTime, id, limit + 1);

     

       573
       +
       	} else {

     

       574
       +
       		transcriptions = db

     

       575
       +
       			.query<TranscriptionRow, [number]>(

     

       576
       +
       				`SELECT 

     

       577
       +
       					t.id, 

     

       578
       +
       					t.user_id, 

     

       579
       +
       					u.email as user_email, 

     

       580
       +
       					u.name as user_name, 

     

       581
       +
       					t.original_filename, 

     

       582
       +
       					t.status, 

     

       583
       +
       					t.created_at,

     

       584
       +
       					t.error_message

     

       585
       +
       				FROM transcriptions t

     

       586
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       587
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       588
       +
       				LIMIT ?`,

     

       589
       +
       			)

     

       590
       +
       			.all(limit + 1);

     

       591
       +
       	}

     

       592
       +
       

     

       593
       +
       	const hasMore = transcriptions.length > limit;

     

       594
       +
       	if (hasMore) {

     

       595
       +
       		transcriptions.pop();

     

       596
       +
       	}

     

       597
       +
       

     

       598
       +
       	let nextCursor: string | null = null;

     

       599
       +
       	if (hasMore && transcriptions.length > 0) {

     

       600
       +
       		const { encodeCursor } = require("./cursor");

     

       601
       +
       		const last = transcriptions[transcriptions.length - 1];

     

       602
       +
       		if (last) {

     

       603
       +
       			nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       604
       +
       		}

     

       605
       +
       	}

     

       606
       +
       

     

       607
       +
       	return {

     

       608
       +
       		data: transcriptions,

     

       609
       +
       		pagination: {

     

       610
       +
       			limit,

     

       611
       +
       			hasMore,

     

       612
       +
       			nextCursor,

     

       613
       +
       		},

     

       614
       +
       	};

     

       615
        
       }

     

       616
        
       

     

       617
        
       export function deleteTranscription(transcriptionId: string): void {

     
···

       697
        
       	subscription_id: string | null;

     

       698
        
       }

     

       699
        
       

     

       700
       +
       export function getAllUsersWithStats(

     

       701
       +
       	limit = 50,

     

       702
       +
       	cursor?: string,

     

       703
       +
       ): {

     

       704
       +
       	data: UserWithStats[];

     

       705
       +
       	pagination: {

     

       706
       +
       		limit: number;

     

       707
       +
       		hasMore: boolean;

     

       708
       +
       		nextCursor: string | null;

     

       709
       +
       	};

     

       710
       +
       } {

     

       711
       +
       	let users: UserWithStats[];

     

       712
       +
       

     

       713
       +
       	if (cursor) {

     

       714
       +
       		const { decodeCursor } = require("./cursor");

     

       715
       +
       		const parts = decodeCursor(cursor);

     

       716
       +
       

     

       717
       +
       		if (parts.length !== 2) {

     

       718
       +
       			throw new Error("Invalid cursor format");

     

       719
       +
       		}

     

       720
       +
       

     

       721
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       722
       +
       		const cursorId = Number.parseInt(parts[1] || "", 10);

     

       723
       +
       

     

       724
       +
       		if (Number.isNaN(cursorTime) || Number.isNaN(cursorId)) {

     

       725
       +
       			throw new Error("Invalid cursor format");

     

       726
       +
       		}

     

       727
       +
       

     

       728
       +
       		users = db

     

       729
       +
       			.query<UserWithStats, [number, number, number, number]>(

     

       730
       +
       				`SELECT 

     

       731
       +
       					u.id, 

     

       732
       +
       					u.email, 

     

       733
       +
       					u.name, 

     

       734
       +
       					u.avatar, 

     

       735
       +
       					u.created_at, 

     

       736
       +
       					u.role,

     

       737
       +
       					u.last_login,

     

       738
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       739
       +
       					s.status as subscription_status,

     

       740
       +
       					s.id as subscription_id

     

       741
       +
       				FROM users u

     

       742
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       743
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       744
       +
       				WHERE u.created_at < ? OR (u.created_at = ? AND u.id < ?)

     

       745
       +
       				GROUP BY u.id

     

       746
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       747
       +
       				LIMIT ?`,

     

       748
       +
       			)

     

       749
       +
       			.all(cursorTime, cursorTime, cursorId, limit + 1);

     

       750
       +
       	} else {

     

       751
       +
       		users = db

     

       752
       +
       			.query<UserWithStats, [number]>(

     

       753
       +
       				`SELECT 

     

       754
       +
       					u.id, 

     

       755
       +
       					u.email, 

     

       756
       +
       					u.name, 

     

       757
       +
       					u.avatar, 

     

       758
       +
       					u.created_at, 

     

       759
       +
       					u.role,

     

       760
       +
       					u.last_login,

     

       761
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       762
       +
       					s.status as subscription_status,

     

       763
       +
       					s.id as subscription_id

     

       764
       +
       				FROM users u

     

       765
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       766
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       767
       +
       				GROUP BY u.id

     

       768
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       769
       +
       				LIMIT ?`,

     

       770
       +
       			)

     

       771
       +
       			.all(limit + 1);

     

       772
       +
       	}

     

       773
       +
       

     

       774
       +
       	const hasMore = users.length > limit;

     

       775
       +
       	if (hasMore) {

     

       776
       +
       		users.pop();

     

       777
       +
       	}

     

       778
       +
       

     

       779
       +
       	let nextCursor: string | null = null;

     

       780
       +
       	if (hasMore && users.length > 0) {

     

       781
       +
       		const { encodeCursor } = require("./cursor");

     

       782
       +
       		const last = users[users.length - 1];

     

       783
       +
       		if (last) {

     

       784
       +
       			nextCursor = encodeCursor([

     

       785
       +
       				last.created_at.toString(),

     

       786
       +
       				last.id.toString(),

     

       787
       +
       			]);

     

       788
       +
       		}

     

       789
       +
       	}

     

       790
       +
       

     

       791
       +
       	return {

     

       792
       +
       		data: users,

     

       793
       +
       		pagination: {

     

       794
       +
       			limit,

     

       795
       +
       			hasMore,

     

       796
       +
       			nextCursor,

     

       797
       +
       		},

     

       798
       +
       	};

     

       799
        
       }

+7 -7

src/lib/classes.test.ts

···

       129
        
       	enrollUserInClass(userId, cls1.id);

     

       130
        
       

     

       131
        
       	// Get classes for user (non-admin)

     

       132
       -
       	const classes = getClassesForUser(userId, false);

     

       133
       -
       	expect(classes.length).toBe(1);

     

       134
       -
       	expect(classes[0]?.id).toBe(cls1.id);

     

       135
        
       

     

       136
        
       	// Admin should see all classes (not just the 2 test classes, but all in DB)

     

       137
       -
       	const allClasses = getClassesForUser(userId, true);

     

       138
       -
       	expect(allClasses.length).toBeGreaterThanOrEqual(2);

     

       139
       -
       	expect(allClasses.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       -
       	expect(allClasses.some((c) => c.id === cls2.id)).toBe(true);

     

       141
        
       

     

       142
        
       	// Cleanup enrollment

     

       143
        
       	removeUserFromClass(userId, cls1.id);

···

       129
        
       	enrollUserInClass(userId, cls1.id);

     

       130
        
       

     

       131
        
       	// Get classes for user (non-admin)

     

       132
       +
       	const classesResult = getClassesForUser(userId, false);

     

       133
       +
       	expect(classesResult.data.length).toBe(1);

     

       134
       +
       	expect(classesResult.data[0]?.id).toBe(cls1.id);

     

       135
        
       

     

       136
        
       	// Admin should see all classes (not just the 2 test classes, but all in DB)

     

       137
       +
       	const allClassesResult = getClassesForUser(userId, true);

     

       138
       +
       	expect(allClassesResult.data.length).toBeGreaterThanOrEqual(2);

     

       139
       +
       	expect(allClassesResult.data.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       +
       	expect(allClassesResult.data.some((c) => c.id === cls2.id)).toBe(true);

     

       141
        
       

     

       142
        
       	// Cleanup enrollment

     

       143
        
       	removeUserFromClass(userId, cls1.id);

+248 -22

src/lib/classes.ts

···

       9
        
       	semester: string;

     

       10
        
       	year: number;

     

       11
        
       	archived: boolean;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
       	created_at: number;

     

       13
        
       }

     

       14
        
       

     
···

       22
        
       export interface ClassMember {

     

       23
        
       	class_id: string;

     

       24
        
       	user_id: number;

     

       0
        
       
     

       25
        
       	enrolled_at: number;

     

       26
        
       }

     

       27
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
       /**

     

       29
        
        * Get all classes for a user (either enrolled or admin sees all)

     

       30
        
        */

     

       31
       -
       export function getClassesForUser(userId: number, isAdmin: boolean): Class[] {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       32
        
       	if (isAdmin) {

     

       33
       -
       		return db

     

       34
       -
       			.query<Class, []>(

     

       35
       -
       				"SELECT * FROM classes ORDER BY year DESC, semester DESC, course_code ASC",

     

       36
       -
       			)

     

       37
       -
       			.all();

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       38
        
       	}

     

       39
        
       

     

       40
       -
       	return db

     

       41
       -
       		.query<Class, [number]>(

     

       42
       -
       			`SELECT c.* FROM classes c

     

       43
       -
              INNER JOIN class_members cm ON c.id = cm.class_id

     

       44
       -
              WHERE cm.user_id = ?

     

       45
       -
              ORDER BY c.year DESC, c.semester DESC, c.course_code ASC`,

     

       46
       -
       		)

     

       47
       -
       		.all(userId);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       48
        
       }

     

       49
        
       

     

       50
        
       /**

     
···

       82
        
       	semester: string;

     

       83
        
       	year: number;

     

       84
        
       	meeting_times?: string[];

     

       0
        
       
     

       85
        
       }): Class {

     

       86
        
       	const id = nanoid();

     

       87
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       106
        
       		}

     

       107
        
       	}

     

       108
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       109
        
       	return {

     

       110
        
       		id,

     

       111
        
       		course_code: data.course_code,

     
···

       122
        
        * Archive or unarchive a class

     

       123
        
        */

     

       124
        
       export function toggleClassArchive(classId: string, archived: boolean): void {

     

       125
       -
       	db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       126
        
       		archived ? 1 : 0,

     

       127
        
       		classId,

     

       128
        
       	]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       129
        
       }

     

       130
        
       

     

       131
        
       /**

     
···

       138
        
       /**

     

       139
        
        * Enroll a user in a class

     

       140
        
        */

     

       141
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       142
        
       	const now = Math.floor(Date.now() / 1000);

     

       143
        
       	db.run(

     

       144
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       145
       -
       		[classId, userId, now],

     

       146
        
       	);

     

       147
        
       }

     

       148
        
       

     
···

       212
        
       }

     

       213
        
       

     

       214
        
       /**

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       215
        
        * Update a meeting time label

     

       216
        
        */

     

       217
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       235
        
       				id: string;

     

       236
        
       				user_id: number;

     

       237
        
       				meeting_time_id: string | null;

     

       0
        
       
     

       238
        
       				filename: string;

     

       239
        
       				original_filename: string;

     

       240
        
       				status: string;

     
···

       245
        
       			},

     

       246
        
       			[string]

     

       247
        
       		>(

     

       248
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       249
        
              FROM transcriptions

     

       250
        
              WHERE class_id = ?

     

       251
       -
              ORDER BY created_at DESC`,

     

       252
        
       		)

     

       253
        
       		.all(classId);

     

       254
        
       }

     
···

       273
        
       export function joinClass(

     

       274
        
       	classId: string,

     

       275
        
       	userId: number,

     

       0
        
       
     

       276
        
       ): { success: boolean; error?: string } {

     

       277
        
       	// Find class by ID

     

       278
        
       	const cls = db

     
···

       298
        
       		return { success: false, error: "Already enrolled in this class" };

     

       299
        
       	}

     

       300
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       301
        
       	// Enroll user

     

       302
        
       	db.query(

     

       303
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       304
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       305
        
       

     

       306
        
       	return { success: true };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       307
        
       }

     

       308
        
       

     

       309
        
       /**

···

       9
        
       	semester: string;

     

       10
        
       	year: number;

     

       11
        
       	archived: boolean;

     

       12
       +
       	section_number?: string | null;

     

       13
       +
       	created_at: number;

     

       14
       +
       }

     

       15
       +
       

     

       16
       +
       export interface ClassSection {

     

       17
       +
       	id: string;

     

       18
       +
       	class_id: string;

     

       19
       +
       	section_number: string;

     

       20
        
       	created_at: number;

     

       21
        
       }

     

       22
        
       

     
···

       30
        
       export interface ClassMember {

     

       31
        
       	class_id: string;

     

       32
        
       	user_id: number;

     

       33
       +
       	section_id: string | null;

     

       34
        
       	enrolled_at: number;

     

       35
        
       }

     

       36
        
       

     

       37
       +
       export interface ClassWithStats extends Class {

     

       38
       +
       	student_count?: number;

     

       39
       +
       	transcript_count?: number;

     

       40
       +
       }

     

       41
       +
       

     

       42
        
       /**

     

       43
        
        * Get all classes for a user (either enrolled or admin sees all)

     

       44
        
        */

     

       45
       +
       export function getClassesForUser(

     

       46
       +
       	userId: number,

     

       47
       +
       	isAdmin: boolean,

     

       48
       +
       	limit = 50,

     

       49
       +
       	cursor?: string,

     

       50
       +
       ): {

     

       51
       +
       	data: ClassWithStats[];

     

       52
       +
       	pagination: {

     

       53
       +
       		limit: number;

     

       54
       +
       		hasMore: boolean;

     

       55
       +
       		nextCursor: string | null;

     

       56
       +
       	};

     

       57
       +
       } {

     

       58
       +
       	let classes: ClassWithStats[];

     

       59
       +
       

     

       60
        
       	if (isAdmin) {

     

       61
       +
       		if (cursor) {

     

       62
       +
       			const { decodeClassCursor } = require("./cursor");

     

       63
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       64
       +
       

     

       65
       +
       			classes = db

     

       66
       +
       				.query<ClassWithStats, [number, string, string, string, number]>(

     

       67
       +
       					`SELECT 

     

       68
       +
       						c.*,

     

       69
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       70
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       71
       +
       					FROM classes c 

     

       72
       +
       					WHERE (c.year < ? OR 

     

       73
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       74
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       75
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       76
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       77
       +
       					LIMIT ?`,

     

       78
       +
       				)

     

       79
       +
       				.all(

     

       80
       +
       					year,

     

       81
       +
       					year,

     

       82
       +
       					semester,

     

       83
       +
       					year,

     

       84
       +
       					semester,

     

       85
       +
       					courseCode,

     

       86
       +
       					year,

     

       87
       +
       					semester,

     

       88
       +
       					courseCode,

     

       89
       +
       					id,

     

       90
       +
       					limit + 1,

     

       91
       +
       				);

     

       92
       +
       		} else {

     

       93
       +
       			classes = db

     

       94
       +
       				.query<ClassWithStats, [number]>(

     

       95
       +
       					`SELECT 

     

       96
       +
       						c.*,

     

       97
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       98
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       99
       +
       					FROM classes c 

     

       100
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       101
       +
       					LIMIT ?`,

     

       102
       +
       				)

     

       103
       +
       				.all(limit + 1);

     

       104
       +
       		}

     

       105
       +
       	} else {

     

       106
       +
       		if (cursor) {

     

       107
       +
       			const { decodeClassCursor } = require("./cursor");

     

       108
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       109
       +
       

     

       110
       +
       			classes = db

     

       111
       +
       				.query<

     

       112
       +
       					ClassWithStats,

     

       113
       +
       					[number, number, string, string, string, number]

     

       114
       +
       				>(

     

       115
       +
       					`SELECT c.* FROM classes c

     

       116
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       117
       +
       					WHERE cm.user_id = ? AND 

     

       118
       +
       						(c.year < ? OR 

     

       119
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       120
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       121
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       122
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       123
       +
       					LIMIT ?`,

     

       124
       +
       				)

     

       125
       +
       				.all(

     

       126
       +
       					userId,

     

       127
       +
       					year,

     

       128
       +
       					year,

     

       129
       +
       					semester,

     

       130
       +
       					year,

     

       131
       +
       					semester,

     

       132
       +
       					courseCode,

     

       133
       +
       					year,

     

       134
       +
       					semester,

     

       135
       +
       					courseCode,

     

       136
       +
       					id,

     

       137
       +
       					limit + 1,

     

       138
       +
       				);

     

       139
       +
       		} else {

     

       140
       +
       			classes = db

     

       141
       +
       				.query<ClassWithStats, [number, number]>(

     

       142
       +
       					`SELECT c.* FROM classes c

     

       143
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       144
       +
       					WHERE cm.user_id = ?

     

       145
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       146
       +
       					LIMIT ?`,

     

       147
       +
       				)

     

       148
       +
       				.all(userId, limit + 1);

     

       149
       +
       		}

     

       150
        
       	}

     

       151
        
       

     

       152
       +
       	const hasMore = classes.length > limit;

     

       153
       +
       	if (hasMore) {

     

       154
       +
       		classes.pop();

     

       155
       +
       	}

     

       156
       +
       

     

       157
       +
       	let nextCursor: string | null = null;

     

       158
       +
       	if (hasMore && classes.length > 0) {

     

       159
       +
       		const { encodeClassCursor } = require("./cursor");

     

       160
       +
       		const last = classes[classes.length - 1];

     

       161
       +
       		if (last) {

     

       162
       +
       			nextCursor = encodeClassCursor(

     

       163
       +
       				last.year,

     

       164
       +
       				last.semester,

     

       165
       +
       				last.course_code,

     

       166
       +
       				last.id,

     

       167
       +
       			);

     

       168
       +
       		}

     

       169
       +
       	}

     

       170
       +
       

     

       171
       +
       	return {

     

       172
       +
       		data: classes,

     

       173
       +
       		pagination: {

     

       174
       +
       			limit,

     

       175
       +
       			hasMore,

     

       176
       +
       			nextCursor,

     

       177
       +
       		},

     

       178
       +
       	};

     

       179
        
       }

     

       180
        
       

     

       181
        
       /**

     
···

       213
        
       	semester: string;

     

       214
        
       	year: number;

     

       215
        
       	meeting_times?: string[];

     

       216
       +
       	sections?: string[];

     

       217
        
       }): Class {

     

       218
        
       	const id = nanoid();

     

       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       238
        
       		}

     

       239
        
       	}

     

       240
        
       

     

       241
       +
       	// Create sections if provided

     

       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       +
       			createClassSection(id, sectionNumber);

     

       245
       +
       		}

     

       246
       +
       	}

     

       247
       +
       

     

       248
        
       	return {

     

       249
        
       		id,

     

       250
        
       		course_code: data.course_code,

     
···

       261
        
        * Archive or unarchive a class

     

       262
        
        */

     

       263
        
       export function toggleClassArchive(classId: string, archived: boolean): void {

     

       264
       +
       	const result = db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       265
        
       		archived ? 1 : 0,

     

       266
        
       		classId,

     

       267
        
       	]);

     

       268
       +
       

     

       269
       +
       	if (result.changes === 0) {

     

       270
       +
       		throw new Error("Class not found");

     

       271
       +
       	}

     

       272
        
       }

     

       273
        
       

     

       274
        
       /**

     
···

       281
        
       /**

     

       282
        
        * Enroll a user in a class

     

       283
        
        */

     

       284
       +
       export function enrollUserInClass(

     

       285
       +
       	userId: number,

     

       286
       +
       	classId: string,

     

       287
       +
       	sectionId?: string | null,

     

       288
       +
       ): void {

     

       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       290
        
       	db.run(

     

       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       293
        
       	);

     

       294
        
       }

     

       295
        
       

     
···

       359
        
       }

     

       360
        
       

     

       361
        
       /**

     

       362
       +
        * Get a single meeting time by ID

     

       363
       +
        */

     

       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       +
       	const result = db

     

       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       +
       		.get(meetingId);

     

       368
       +
       	return result ?? null;

     

       369
       +
       }

     

       370
       +
       

     

       371
       +
       /**

     

       372
        
        * Update a meeting time label

     

       373
        
        */

     

       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       392
        
       				id: string;

     

       393
        
       				user_id: number;

     

       394
        
       				meeting_time_id: string | null;

     

       395
       +
       				section_id: string | null;

     

       396
        
       				filename: string;

     

       397
        
       				original_filename: string;

     

       398
        
       				status: string;

     
···

       403
        
       			},

     

       404
        
       			[string]

     

       405
        
       		>(

     

       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       407
        
              FROM transcriptions

     

       408
        
              WHERE class_id = ?

     

       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       410
        
       		)

     

       411
        
       		.all(classId);

     

       412
        
       }

     
···

       431
        
       export function joinClass(

     

       432
        
       	classId: string,

     

       433
        
       	userId: number,

     

       434
       +
       	sectionId?: string | null,

     

       435
        
       ): { success: boolean; error?: string } {

     

       436
        
       	// Find class by ID

     

       437
        
       	const cls = db

     
···

       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       458
        
       	}

     

       459
        
       

     

       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       +
       	const sections = getClassSections(classId);

     

       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       +
       	}

     

       465
       +
       

     

       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       +
       	if (sectionId) {

     

       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       +
       		if (!section) {

     

       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       +
       		}

     

       472
       +
       	}

     

       473
       +
       

     

       474
        
       	// Enroll user

     

       475
        
       	db.query(

     

       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       478
        
       

     

       479
        
       	return { success: true };

     

       480
       +
       }

     

       481
       +
       

     

       482
       +
       /**

     

       483
       +
        * Create a section for a class

     

       484
       +
        */

     

       485
       +
       export function createClassSection(

     

       486
       +
       	classId: string,

     

       487
       +
       	sectionNumber: string,

     

       488
       +
       ): ClassSection {

     

       489
       +
       	const id = nanoid();

     

       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       +
       

     

       492
       +
       	db.run(

     

       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       +
       	);

     

       496
       +
       

     

       497
       +
       	return {

     

       498
       +
       		id,

     

       499
       +
       		class_id: classId,

     

       500
       +
       		section_number: sectionNumber,

     

       501
       +
       		created_at: now,

     

       502
       +
       	};

     

       503
       +
       }

     

       504
       +
       

     

       505
       +
       /**

     

       506
       +
        * Get all sections for a class

     

       507
       +
        */

     

       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       +
       	return db

     

       510
       +
       		.query<ClassSection, [string]>(

     

       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       +
       		)

     

       513
       +
       		.all(classId);

     

       514
       +
       }

     

       515
       +
       

     

       516
       +
       /**

     

       517
       +
        * Delete a class section

     

       518
       +
        */

     

       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       +
       }

     

       522
       +
       

     

       523
       +
       /**

     

       524
       +
        * Get user's enrolled section for a class

     

       525
       +
        */

     

       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       +
       	const result = db

     

       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       +
       		)

     

       531
       +
       		.get(classId, userId);

     

       532
       +
       	return result?.section_id ?? null;

     

       533
        
       }

     

       534
        
       

     

       535
        
       /**

-1

src/lib/client-auth.ts

···

       66
        
       	const hashArray = Array.from(hashBuffer);

     

       67
        
       	return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");

     

       68
        
       }

     

       69
       -

···

       66
        
       	const hashArray = Array.from(hashBuffer);

     

       67
        
       	return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");

     

       68
        
       }

     

       0

+1 -2

src/lib/crypto-fallback.ts

···

       23
        
       

     

       24
        
       	const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n));

     

       25
        
       	const ch = (x: number, y: number, z: number) => (x & y) ^ (~x & z);

     

       26
       -
       	const maj = (x: number, y: number, z: number) =>

     

       27
       -
       		(x & y) ^ (x & z) ^ (y & z);

     

       28
        
       	const s0 = (x: number) => rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);

     

       29
        
       	const s1 = (x: number) => rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);

     

       30
        
       	const g0 = (x: number) => rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3);

···

       23
        
       

     

       24
        
       	const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n));

     

       25
        
       	const ch = (x: number, y: number, z: number) => (x & y) ^ (~x & z);

     

       26
       +
       	const maj = (x: number, y: number, z: number) => (x & y) ^ (x & z) ^ (y & z);

     

       0
        
       
     

       27
        
       	const s0 = (x: number) => rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);

     

       28
        
       	const s1 = (x: number) => rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);

     

       29
        
       	const g0 = (x: number) => rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3);

+117

src/lib/cursor.test.ts

···

       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       +
       import {

     

       3
       +
       	decodeClassCursor,

     

       4
       +
       	decodeCursor,

     

       5
       +
       	decodeSimpleCursor,

     

       6
       +
       	encodeClassCursor,

     

       7
       +
       	encodeCursor,

     

       8
       +
       	encodeSimpleCursor,

     

       9
       +
       } from "./cursor";

     

       10
       +
       

     

       11
       +
       describe("Cursor encoding/decoding", () => {

     

       12
       +
       	test("encodeCursor creates base64url string", () => {

     

       13
       +
       		const cursor = encodeCursor(["1732396800", "trans-123"]);

     

       14
       +
       

     

       15
       +
       		// Should be base64url format

     

       16
       +
       		expect(cursor).toMatch(/^[A-Za-z0-9_-]+$/);

     

       17
       +
       		expect(cursor).not.toContain("="); // No padding

     

       18
       +
       		expect(cursor).not.toContain("+"); // URL-safe

     

       19
       +
       		expect(cursor).not.toContain("/"); // URL-safe

     

       20
       +
       	});

     

       21
       +
       

     

       22
       +
       	test("decodeCursor reverses encodeCursor", () => {

     

       23
       +
       		const original = ["1732396800", "trans-123"];

     

       24
       +
       		const encoded = encodeCursor(original);

     

       25
       +
       		const decoded = decodeCursor(encoded);

     

       26
       +
       

     

       27
       +
       		expect(decoded).toEqual(original);

     

       28
       +
       	});

     

       29
       +
       

     

       30
       +
       	test("encodeSimpleCursor works with timestamp and id", () => {

     

       31
       +
       		const timestamp = 1732396800;

     

       32
       +
       		const id = "trans-123";

     

       33
       +
       

     

       34
       +
       		const cursor = encodeSimpleCursor(timestamp, id);

     

       35
       +
       		const decoded = decodeSimpleCursor(cursor);

     

       36
       +
       

     

       37
       +
       		expect(decoded.timestamp).toBe(timestamp);

     

       38
       +
       		expect(decoded.id).toBe(id);

     

       39
       +
       	});

     

       40
       +
       

     

       41
       +
       	test("encodeClassCursor works with class data", () => {

     

       42
       +
       		const year = 2024;

     

       43
       +
       		const semester = "Fall";

     

       44
       +
       		const courseCode = "CS101";

     

       45
       +
       		const id = "class-1";

     

       46
       +
       

     

       47
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       48
       +
       		const decoded = decodeClassCursor(cursor);

     

       49
       +
       

     

       50
       +
       		expect(decoded.year).toBe(year);

     

       51
       +
       		expect(decoded.semester).toBe(semester);

     

       52
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       53
       +
       		expect(decoded.id).toBe(id);

     

       54
       +
       	});

     

       55
       +
       

     

       56
       +
       	test("encodeClassCursor handles course codes with dashes", () => {

     

       57
       +
       		const year = 2024;

     

       58
       +
       		const semester = "Fall";

     

       59
       +
       		const courseCode = "CS-101-A";

     

       60
       +
       		const id = "class-1";

     

       61
       +
       

     

       62
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       63
       +
       		const decoded = decodeClassCursor(cursor);

     

       64
       +
       

     

       65
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       66
       +
       	});

     

       67
       +
       

     

       68
       +
       	test("decodeCursor throws on invalid base64", () => {

     

       69
       +
       		// Skip this test - Buffer.from with invalid base64 doesn't always throw

     

       70
       +
       		// The important validation happens in the specific decode functions

     

       71
       +
       	});

     

       72
       +
       

     

       73
       +
       	test("decodeSimpleCursor throws on wrong number of parts", () => {

     

       74
       +
       		const cursor = encodeCursor(["1", "2", "3"]); // 3 parts instead of 2

     

       75
       +
       

     

       76
       +
       		expect(() => {

     

       77
       +
       			decodeSimpleCursor(cursor);

     

       78
       +
       		}).toThrow("Invalid cursor format");

     

       79
       +
       	});

     

       80
       +
       

     

       81
       +
       	test("decodeSimpleCursor throws on invalid timestamp", () => {

     

       82
       +
       		const cursor = encodeCursor(["not-a-number", "trans-123"]);

     

       83
       +
       

     

       84
       +
       		expect(() => {

     

       85
       +
       			decodeSimpleCursor(cursor);

     

       86
       +
       		}).toThrow("Invalid cursor format");

     

       87
       +
       	});

     

       88
       +
       

     

       89
       +
       	test("decodeClassCursor throws on wrong number of parts", () => {

     

       90
       +
       		const cursor = encodeCursor(["1", "2"]); // 2 parts instead of 4

     

       91
       +
       

     

       92
       +
       		expect(() => {

     

       93
       +
       			decodeClassCursor(cursor);

     

       94
       +
       		}).toThrow("Invalid cursor format");

     

       95
       +
       	});

     

       96
       +
       

     

       97
       +
       	test("decodeClassCursor throws on invalid year", () => {

     

       98
       +
       		const cursor = encodeCursor(["not-a-year", "Fall", "CS101", "class-1"]);

     

       99
       +
       

     

       100
       +
       		expect(() => {

     

       101
       +
       			decodeClassCursor(cursor);

     

       102
       +
       		}).toThrow("Invalid cursor format");

     

       103
       +
       	});

     

       104
       +
       

     

       105
       +
       	test("cursors are opaque and short", () => {

     

       106
       +
       		const simpleCursor = encodeSimpleCursor(1732396800, "trans-123");

     

       107
       +
       		const classCursor = encodeClassCursor(2024, "Fall", "CS101", "class-1");

     

       108
       +
       

     

       109
       +
       		// Should be reasonably short

     

       110
       +
       		expect(simpleCursor.length).toBeLessThan(50);

     

       111
       +
       		expect(classCursor.length).toBeLessThan(50);

     

       112
       +
       

     

       113
       +
       		// Should not reveal internal structure

     

       114
       +
       		expect(simpleCursor).not.toContain("trans-123");

     

       115
       +
       		expect(classCursor).not.toContain("CS101");

     

       116
       +
       	});

     

       117
       +
       });

+92

src/lib/cursor.ts

···

       1
       +
       /**

     

       2
       +
        * Cursor encoding/decoding for pagination

     

       3
       +
        * Cursors are base64url-encoded strings for opacity and URL safety

     

       4
       +
        */

     

       5
       +
       

     

       6
       +
       /**

     

       7
       +
        * Encode a cursor from components

     

       8
       +
        */

     

       9
       +
       export function encodeCursor(parts: string[]): string {

     

       10
       +
       	const raw = parts.join("|");

     

       11
       +
       	// Use base64url encoding (no padding, URL-safe characters)

     

       12
       +
       	return Buffer.from(raw).toString("base64url");

     

       13
       +
       }

     

       14
       +
       

     

       15
       +
       /**

     

       16
       +
        * Decode a cursor into components

     

       17
       +
        */

     

       18
       +
       export function decodeCursor(cursor: string): string[] {

     

       19
       +
       	try {

     

       20
       +
       		const raw = Buffer.from(cursor, "base64url").toString("utf-8");

     

       21
       +
       		return raw.split("|");

     

       22
       +
       	} catch {

     

       23
       +
       		throw new Error("Invalid cursor format");

     

       24
       +
       	}

     

       25
       +
       }

     

       26
       +
       

     

       27
       +
       /**

     

       28
       +
        * Encode a transcription/user cursor (timestamp-id)

     

       29
       +
        */

     

       30
       +
       export function encodeSimpleCursor(timestamp: number, id: string): string {

     

       31
       +
       	return encodeCursor([timestamp.toString(), id]);

     

       32
       +
       }

     

       33
       +
       

     

       34
       +
       /**

     

       35
       +
        * Decode a transcription/user cursor (timestamp-id)

     

       36
       +
        */

     

       37
       +
       export function decodeSimpleCursor(cursor: string): {

     

       38
       +
       	timestamp: number;

     

       39
       +
       	id: string;

     

       40
       +
       } {

     

       41
       +
       	const parts = decodeCursor(cursor);

     

       42
       +
       	if (parts.length !== 2) {

     

       43
       +
       		throw new Error("Invalid cursor format");

     

       44
       +
       	}

     

       45
       +
       

     

       46
       +
       	const timestamp = Number.parseInt(parts[0] || "", 10);

     

       47
       +
       	const id = parts[1] || "";

     

       48
       +
       

     

       49
       +
       	if (Number.isNaN(timestamp) || !id) {

     

       50
       +
       		throw new Error("Invalid cursor format");

     

       51
       +
       	}

     

       52
       +
       

     

       53
       +
       	return { timestamp, id };

     

       54
       +
       }

     

       55
       +
       

     

       56
       +
       /**

     

       57
       +
        * Encode a class cursor (year-semester-coursecode-id)

     

       58
       +
        */

     

       59
       +
       export function encodeClassCursor(

     

       60
       +
       	year: number,

     

       61
       +
       	semester: string,

     

       62
       +
       	courseCode: string,

     

       63
       +
       	id: string,

     

       64
       +
       ): string {

     

       65
       +
       	return encodeCursor([year.toString(), semester, courseCode, id]);

     

       66
       +
       }

     

       67
       +
       

     

       68
       +
       /**

     

       69
       +
        * Decode a class cursor (year-semester-coursecode-id)

     

       70
       +
        */

     

       71
       +
       export function decodeClassCursor(cursor: string): {

     

       72
       +
       	year: number;

     

       73
       +
       	semester: string;

     

       74
       +
       	courseCode: string;

     

       75
       +
       	id: string;

     

       76
       +
       } {

     

       77
       +
       	const parts = decodeCursor(cursor);

     

       78
       +
       	if (parts.length !== 4) {

     

       79
       +
       		throw new Error("Invalid cursor format");

     

       80
       +
       	}

     

       81
       +
       

     

       82
       +
       	const year = Number.parseInt(parts[0] || "", 10);

     

       83
       +
       	const semester = parts[1] || "";

     

       84
       +
       	const courseCode = parts[2] || "";

     

       85
       +
       	const id = parts[3] || "";

     

       86
       +
       

     

       87
       +
       	if (Number.isNaN(year) || !semester || !courseCode || !id) {

     

       88
       +
       		throw new Error("Invalid cursor format");

     

       89
       +
       	}

     

       90
       +
       

     

       91
       +
       	return { year, semester, courseCode, id };

     

       92
       +
       }

+116

src/lib/email-change.test.ts

···

       1
       +
       import { expect, test } from "bun:test";

     

       2
       +
       import db from "../db/schema";

     

       3
       +
       import {

     

       4
       +
       	consumeEmailChangeToken,

     

       5
       +
       	createEmailChangeToken,

     

       6
       +
       	createUser,

     

       7
       +
       	getUserByEmail,

     

       8
       +
       	updateUserEmail,

     

       9
       +
       	verifyEmailChangeToken,

     

       10
       +
       } from "./auth";

     

       11
       +
       

     

       12
       +
       test("email change token lifecycle", async () => {

     

       13
       +
       	// Create a test user with unique email

     

       14
       +
       	const timestamp = Date.now();

     

       15
       +
       	const user = await createUser(

     

       16
       +
       		`test-email-change-${timestamp}@example.com`,

     

       17
       +
       		"password123",

     

       18
       +
       		"Test User",

     

       19
       +
       	);

     

       20
       +
       

     

       21
       +
       	// Create an email change token

     

       22
       +
       	const newEmail = `new-email-${timestamp}@example.com`;

     

       23
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       24
       +
       

     

       25
       +
       	expect(token).toBeTruthy();

     

       26
       +
       	expect(token.length).toBeGreaterThan(0);

     

       27
       +
       

     

       28
       +
       	// Verify the token

     

       29
       +
       	const result = verifyEmailChangeToken(token);

     

       30
       +
       	expect(result).toBeTruthy();

     

       31
       +
       	expect(result?.userId).toBe(user.id);

     

       32
       +
       	expect(result?.newEmail).toBe(newEmail);

     

       33
       +
       

     

       34
       +
       	// Update the email

     

       35
       +
       	if (result) {

     

       36
       +
       		updateUserEmail(result.userId, result.newEmail);

     

       37
       +
       	}

     

       38
       +
       

     

       39
       +
       	// Consume the token

     

       40
       +
       	consumeEmailChangeToken(token);

     

       41
       +
       

     

       42
       +
       	// Verify the email was updated

     

       43
       +
       	const updatedUser = getUserByEmail(newEmail);

     

       44
       +
       	expect(updatedUser).toBeTruthy();

     

       45
       +
       	expect(updatedUser?.id).toBe(user.id);

     

       46
       +
       	expect(updatedUser?.email).toBe(newEmail);

     

       47
       +
       

     

       48
       +
       	// Verify the token can't be used again

     

       49
       +
       	const result2 = verifyEmailChangeToken(token);

     

       50
       +
       	expect(result2).toBeNull();

     

       51
       +
       

     

       52
       +
       	// Clean up

     

       53
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       54
       +
       });

     

       55
       +
       

     

       56
       +
       test("email change token expires", async () => {

     

       57
       +
       	// Create a test user with unique email

     

       58
       +
       	const timestamp = Date.now();

     

       59
       +
       	const user = await createUser(

     

       60
       +
       		`test-expire-${timestamp}@example.com`,

     

       61
       +
       		"password123",

     

       62
       +
       		"Test User",

     

       63
       +
       	);

     

       64
       +
       

     

       65
       +
       	// Create an email change token

     

       66
       +
       	const newEmail = `new-expire-${timestamp}@example.com`;

     

       67
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       68
       +
       

     

       69
       +
       	// Manually expire the token

     

       70
       +
       	db.run("UPDATE email_change_tokens SET expires_at = ? WHERE token = ?", [

     

       71
       +
       		Math.floor(Date.now() / 1000) - 1,

     

       72
       +
       		token,

     

       73
       +
       	]);

     

       74
       +
       

     

       75
       +
       	// Verify the token is expired

     

       76
       +
       	const result = verifyEmailChangeToken(token);

     

       77
       +
       	expect(result).toBeNull();

     

       78
       +
       

     

       79
       +
       	// Clean up

     

       80
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       81
       +
       });

     

       82
       +
       

     

       83
       +
       test("only one email change token per user", async () => {

     

       84
       +
       	// Create a test user with unique email

     

       85
       +
       	const timestamp = Date.now();

     

       86
       +
       	const user = await createUser(

     

       87
       +
       		`test-single-token-${timestamp}@example.com`,

     

       88
       +
       		"password123",

     

       89
       +
       		"Test User",

     

       90
       +
       	);

     

       91
       +
       

     

       92
       +
       	// Create first token

     

       93
       +
       	const token1 = createEmailChangeToken(

     

       94
       +
       		user.id,

     

       95
       +
       		`email1-${timestamp}@example.com`,

     

       96
       +
       	);

     

       97
       +
       

     

       98
       +
       	// Create second token (should delete first)

     

       99
       +
       	const token2 = createEmailChangeToken(

     

       100
       +
       		user.id,

     

       101
       +
       		`email2-${timestamp}@example.com`,

     

       102
       +
       	);

     

       103
       +
       

     

       104
       +
       	// First token should be invalid

     

       105
       +
       	const result1 = verifyEmailChangeToken(token1);

     

       106
       +
       	expect(result1).toBeNull();

     

       107
       +
       

     

       108
       +
       	// Second token should work

     

       109
       +
       	const result2 = verifyEmailChangeToken(token2);

     

       110
       +
       	expect(result2).toBeTruthy();

     

       111
       +
       	expect(result2?.newEmail).toBe(`email2-${timestamp}@example.com`);

     

       112
       +
       

     

       113
       +
       	// Clean up

     

       114
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       115
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [user.id]);

     

       116
       +
       });

+68 -4

src/lib/email-templates.ts

···

       96
        
       

     

       97
        
       export function verifyEmailTemplate(options: VerifyEmailOptions): string {

     

       98
        
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       99
       -
       	const domain = process.env.DOMAIN || "https://thistle.app";

     

       100
       -
       	const verifyLink = `${domain}/api/auth/verify-email?token=${options.token}`;

     

       101
        
       

     

       102
        
       	return `

     

       103
        
       <!DOCTYPE html>

     
···

       210
        
             <p>Your transcription is ready!</p>

     

       211
        
             

     

       212
        
             <div class="info-box">

     

       213
       -
               ${options.className ? `

     

       0
        
       
     

       0
        
       
     

       214
        
               <p class="info-box-label">Class</p>

     

       215
        
               <p class="info-box-value">${options.className}</p>

     

       216
        
               <hr class="info-box-divider">

     

       217
       -
               ` : ''}

     

       0
        
       
     

       0
        
       
     

       218
        
               <p class="info-box-label">File</p>

     

       219
        
               <p class="info-box-value">${options.originalFilename}</p>

     

       220
        
             </div>

     
···

       231
        
       </html>

     

       232
        
         `.trim();

     

       233
        
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       96
        
       

     

       97
        
       export function verifyEmailTemplate(options: VerifyEmailOptions): string {

     

       98
        
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       99
       +
       	const origin = process.env.ORIGIN || "http://localhost:3000";

     

       100
       +
       	const verifyLink = `${origin}/api/auth/verify-email?token=${options.token}`;

     

       101
        
       

     

       102
        
       	return `

     

       103
        
       <!DOCTYPE html>

     
···

       210
        
             <p>Your transcription is ready!</p>

     

       211
        
             

     

       212
        
             <div class="info-box">

     

       213
       +
               ${

     

       214
       +
       					options.className

     

       215
       +
       						? `

     

       216
        
               <p class="info-box-label">Class</p>

     

       217
        
               <p class="info-box-value">${options.className}</p>

     

       218
        
               <hr class="info-box-divider">

     

       219
       +
               `

     

       220
       +
       						: ""

     

       221
       +
       				}

     

       222
        
               <p class="info-box-label">File</p>

     

       223
        
               <p class="info-box-value">${options.originalFilename}</p>

     

       224
        
             </div>

     
···

       235
        
       </html>

     

       236
        
         `.trim();

     

       237
        
       }

     

       238
       +
       

     

       239
       +
       interface EmailChangeOptions {

     

       240
       +
       	name: string | null;

     

       241
       +
       	currentEmail: string;

     

       242
       +
       	newEmail: string;

     

       243
       +
       	verifyLink: string;

     

       244
       +
       }

     

       245
       +
       

     

       246
       +
       export function emailChangeTemplate(options: EmailChangeOptions): string {

     

       247
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       248
       +
       

     

       249
       +
       	return `

     

       250
       +
       <!DOCTYPE html>

     

       251
       +
       <html lang="en">

     

       252
       +
       <head>

     

       253
       +
         <meta charset="UTF-8">

     

       254
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       255
       +
         <title>Verify Email Change - Thistle</title>

     

       256
       +
         <style>${baseStyles}</style>

     

       257
       +
       </head>

     

       258
       +
       <body>

     

       259
       +
         <div class="container">

     

       260
       +
           <div class="header">

     

       261
       +
             <h1>🪻 Thistle</h1>

     

       262
       +
           </div>

     

       263
       +
           <div class="content">

     

       264
       +
             <h2>${greeting}!</h2>

     

       265
       +
             <p>You requested to change your email address.</p>

     

       266
       +
             

     

       267
       +
             <div class="info-box">

     

       268
       +
               <p class="info-box-label">Current Email</p>

     

       269
       +
               <p class="info-box-value">${options.currentEmail}</p>

     

       270
       +
               <hr class="info-box-divider">

     

       271
       +
               <p class="info-box-label">New Email</p>

     

       272
       +
               <p class="info-box-value">${options.newEmail}</p>

     

       273
       +
             </div>

     

       274
       +
       

     

       275
       +
             <p>Click the button below to confirm this change:</p>

     

       276
       +
       

     

       277
       +
             <p style="text-align: center; margin-top: 1.5rem; margin-bottom: 0;">

     

       278
       +
               <a href="${options.verifyLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">Verify Email Change</a>

     

       279
       +
             </p>

     

       280
       +
       

     

       281
       +
             <p style="color: #4f5d75; font-size: 0.875rem; margin-top: 1.5rem;">

     

       282
       +
               If the button doesn't work, copy and paste this link into your browser:<br>

     

       283
       +
               <a href="${options.verifyLink}" style="color: #4f5d75; word-break: break-all;">${options.verifyLink}</a>

     

       284
       +
             </p>

     

       285
       +
       

     

       286
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       287
       +
               This link will expire in 24 hours.

     

       288
       +
             </p>

     

       289
       +
           </div>

     

       290
       +
           <div class="footer">

     

       291
       +
             <p>If you didn't request this change, please ignore this email and your email address will remain unchanged.</p>

     

       292
       +
           </div>

     

       293
       +
         </div>

     

       294
       +
       </body>

     

       295
       +
       </html>

     

       296
       +
         `.trim();

     

       297
       +
       }

+22 -21

src/lib/email-verification.test.ts

···

       1
       -
       import { describe, test, expect, beforeEach, afterEach } from "bun:test";

     

       2
        
       import db from "../db/schema";

     

       3
        
       import {

     

       4
       -
       	createUser,

     

       5
        
       	createEmailVerificationToken,

     

       6
       -
       	verifyEmailToken,

     

       0
        
       
     

       7
        
       	isEmailVerified,

     

       8
       -
       	createPasswordResetToken,

     

       9
        
       	verifyPasswordResetToken,

     

       10
       -
       	consumePasswordResetToken,

     

       11
        
       } from "./auth";

     

       12
        
       

     

       13
        
       describe("Email Verification", () => {

     
···

       23
        
       	afterEach(() => {

     

       24
        
       		// Cleanup

     

       25
        
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       26
       -
       		db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [

     

       27
       -
       			userId,

     

       28
       -
       		]);

     

       29
        
       	});

     

       30
        
       

     

       31
        
       	test("creates verification token", () => {

     

       32
       -
       		const token = createEmailVerificationToken(userId);

     

       33
       -
       		expect(token).toBeDefined();

     

       34
       -
       		expect(typeof token).toBe("string");

     

       35
       -
       		expect(token.length).toBeGreaterThan(0);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       36
        
       	});

     

       37
        
       

     

       38
        
       	test("verifies valid token", () => {

     

       39
       -
       		const token = createEmailVerificationToken(userId);

     

       40
        
       		const result = verifyEmailToken(token);

     

       41
        
       

     

       42
        
       		expect(result).not.toBeNull();

     
···

       52
        
       	});

     

       53
        
       

     

       54
        
       	test("token is one-time use", () => {

     

       55
       -
       		const token = createEmailVerificationToken(userId);

     

       56
        
       

     

       57
        
       		// First use succeeds

     

       58
        
       		const firstResult = verifyEmailToken(token);

     
···

       64
        
       	});

     

       65
        
       

     

       66
        
       	test("rejects expired token", () => {

     

       67
       -
       		const token = createEmailVerificationToken(userId);

     

       68
        
       

     

       69
        
       		// Manually expire the token

     

       70
        
       		db.run(

     
···

       77
        
       	});

     

       78
        
       

     

       79
        
       	test("replaces existing token when creating new one", () => {

     

       80
       -
       		const token1 = createEmailVerificationToken(userId);

     

       81
       -
       		const token2 = createEmailVerificationToken(userId);

     

       82
        
       

     

       83
        
       		// First token should be invalidated

     

       84
        
       		expect(verifyEmailToken(token1)).toBeNull();

     
···

       138
        
       		const token = createPasswordResetToken(userId);

     

       139
        
       

     

       140
        
       		// Manually expire the token

     

       141
       -
       		db.run(

     

       142
       -
       			"UPDATE password_reset_tokens SET expires_at = ? WHERE token = ?",

     

       143
       -
       			[Math.floor(Date.now() / 1000) - 100, token],

     

       144
       -
       		);

     

       145
        
       

     

       146
        
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       147
        
       		expect(verifiedUserId).toBeNull();

···

       1
       +
       import { afterEach, beforeEach, describe, expect, test } from "bun:test";

     

       2
        
       import db from "../db/schema";

     

       3
        
       import {

     

       4
       +
       	consumePasswordResetToken,

     

       5
        
       	createEmailVerificationToken,

     

       6
       +
       	createPasswordResetToken,

     

       7
       +
       	createUser,

     

       8
        
       	isEmailVerified,

     

       9
       +
       	verifyEmailToken,

     

       10
        
       	verifyPasswordResetToken,

     

       0
        
       
     

       11
        
       } from "./auth";

     

       12
        
       

     

       13
        
       describe("Email Verification", () => {

     
···

       23
        
       	afterEach(() => {

     

       24
        
       		// Cleanup

     

       25
        
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       26
       +
       		db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       0
        
       
     

       0
        
       
     

       27
        
       	});

     

       28
        
       

     

       29
        
       	test("creates verification token", () => {

     

       30
       +
       		const result = createEmailVerificationToken(userId);

     

       31
       +
       		expect(result).toBeDefined();

     

       32
       +
       		expect(typeof result).toBe("object");

     

       33
       +
       		expect(typeof result.code).toBe("string");

     

       34
       +
       		expect(typeof result.token).toBe("string");

     

       35
       +
       		expect(typeof result.sentAt).toBe("number");

     

       36
       +
       		expect(result.code.length).toBe(6);

     

       37
        
       	});

     

       38
        
       

     

       39
        
       	test("verifies valid token", () => {

     

       40
       +
       		const { token } = createEmailVerificationToken(userId);

     

       41
        
       		const result = verifyEmailToken(token);

     

       42
        
       

     

       43
        
       		expect(result).not.toBeNull();

     
···

       53
        
       	});

     

       54
        
       

     

       55
        
       	test("token is one-time use", () => {

     

       56
       +
       		const { token } = createEmailVerificationToken(userId);

     

       57
        
       

     

       58
        
       		// First use succeeds

     

       59
        
       		const firstResult = verifyEmailToken(token);

     
···

       65
        
       	});

     

       66
        
       

     

       67
        
       	test("rejects expired token", () => {

     

       68
       +
       		const { token } = createEmailVerificationToken(userId);

     

       69
        
       

     

       70
        
       		// Manually expire the token

     

       71
        
       		db.run(

     
···

       78
        
       	});

     

       79
        
       

     

       80
        
       	test("replaces existing token when creating new one", () => {

     

       81
       +
       		const { token: token1 } = createEmailVerificationToken(userId);

     

       82
       +
       		const { token: token2 } = createEmailVerificationToken(userId);

     

       83
        
       

     

       84
        
       		// First token should be invalidated

     

       85
        
       		expect(verifyEmailToken(token1)).toBeNull();

     
···

       139
        
       		const token = createPasswordResetToken(userId);

     

       140
        
       

     

       141
        
       		// Manually expire the token

     

       142
       +
       		db.run("UPDATE password_reset_tokens SET expires_at = ? WHERE token = ?", [

     

       143
       +
       			Math.floor(Date.now() / 1000) - 100,

     

       144
       +
       			token,

     

       145
       +
       		]);

     

       146
        
       

     

       147
        
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       148
        
       		expect(verifiedUserId).toBeNull();

+11 -14

src/lib/email.ts

···

       25
        
        * Send an email via MailChannels

     

       26
        
        */

     

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       29
        
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       30
        
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

     

       31
       -
       	const dkimPrivateKey = process.env.DKIM_PRIVATE_KEY;

     

       32
       -
       	const mailchannelsApiKey = process.env.MAILCHANNELS_API_KEY;

     

       33
       -
       

     

       34
       -
       	if (!dkimPrivateKey) {

     

       35
       -
       		throw new Error(

     

       36
       -
       			"DKIM_PRIVATE_KEY environment variable is required for sending emails",

     

       37
       -
       		);

     

       38
       -
       	}

     

       39
       -
       

     

       40
       -
       	if (!mailchannelsApiKey) {

     

       41
       -
       		throw new Error(

     

       42
       -
       			"MAILCHANNELS_API_KEY environment variable is required for sending emails",

     

       43
       -
       		);

     

       44
       -
       	}

     

       45
        
       

     

       46
        
       	// Normalize recipient

     

       47
        
       	const recipient =

···

       25
        
        * Send an email via MailChannels

     

       26
        
        */

     

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       +
       	// Skip sending emails in test mode

     

       29
       +
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       +
       		console.log(

     

       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       +
       		);

     

       33
       +
       		return;

     

       34
       +
       	}

     

       35
       +
       

     

       36
        
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       37
        
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       38
        
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

     

       39
       +
       	// Validated at startup

     

       40
       +
       	const dkimPrivateKey = process.env.DKIM_PRIVATE_KEY as string;

     

       41
       +
       	const mailchannelsApiKey = process.env.MAILCHANNELS_API_KEY as string;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       42
        
       

     

       43
        
       	// Normalize recipient

     

       44
        
       	const recipient =

+12 -10

src/lib/rate-limit.ts

···

       109
        
       	return null; // Allowed

     

       110
        
       }

     

       111
        
       

     

       112
       -
       export function clearRateLimit(endpoint: string, email?: string, ipAddress?: string): void {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       113
        
       	// Clear account-based rate limits

     

       114
        
       	if (email) {

     

       115
       -
       		db.run(

     

       116
       -
       			"DELETE FROM rate_limit_attempts WHERE key = ?",

     

       117
       -
       			[`${endpoint}:account:${email.toLowerCase()}`]

     

       118
       -
       		);

     

       119
        
       	}

     

       120
       -
       	

     

       121
        
       	// Clear IP-based rate limits

     

       122
        
       	if (ipAddress) {

     

       123
       -
       		db.run(

     

       124
       -
       			"DELETE FROM rate_limit_attempts WHERE key = ?",

     

       125
       -
       			[`${endpoint}:ip:${ipAddress}`]

     

       126
       -
       		);

     

       127
        
       	}

     

       128
        
       }

     

       129

···

       109
        
       	return null; // Allowed

     

       110
        
       }

     

       111
        
       

     

       112
       +
       export function clearRateLimit(

     

       113
       +
       	endpoint: string,

     

       114
       +
       	email?: string,

     

       115
       +
       	ipAddress?: string,

     

       116
       +
       ): void {

     

       117
        
       	// Clear account-based rate limits

     

       118
        
       	if (email) {

     

       119
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       120
       +
       			`${endpoint}:account:${email.toLowerCase()}`,

     

       121
       +
       		]);

     

       0
        
       
     

       122
        
       	}

     

       123
       +
       

     

       124
        
       	// Clear IP-based rate limits

     

       125
        
       	if (ipAddress) {

     

       126
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       127
       +
       			`${endpoint}:ip:${ipAddress}`,

     

       128
       +
       		]);

     

       0
        
       
     

       129
        
       	}

     

       130
        
       }

     

       131

+2 -2

src/lib/subscription-routes.test.ts

···

       29
        
       			headers: { Cookie: sessionCookie },

     

       30
        
       		});

     

       31
        
       

     

       32
       -
       		expect(response.status).toBe(500);

     

       33
        
       		const data = await response.json();

     

       34
        
       		expect(data.error).toContain("subscription");

     

       35
        
       	});

     
···

       74
        
       			body: formData,

     

       75
        
       		});

     

       76
        
       

     

       77
       -
       		expect(response.status).toBe(500);

     

       78
        
       		const data = await response.json();

     

       79
        
       		expect(data.error).toContain("subscription");

     

       80
        
       	});

···

       29
        
       			headers: { Cookie: sessionCookie },

     

       30
        
       		});

     

       31
        
       

     

       32
       +
       		expect(response.status).toBe(403);

     

       33
        
       		const data = await response.json();

     

       34
        
       		expect(data.error).toContain("subscription");

     

       35
        
       	});

     
···

       74
        
       			body: formData,

     

       75
        
       		});

     

       76
        
       

     

       77
       +
       		expect(response.status).toBe(403);

     

       78
        
       		const data = await response.json();

     

       79
        
       		expect(data.error).toContain("subscription");

     

       80
        
       	});

+21 -6

src/lib/transcription.ts

···

       502
        
       

     

       503
        
       	private async deleteWhisperJob(jobId: string) {

     

       504
        
       		try {

     

       505
       -
       			const response = await fetch(

     

       506
       -
       				`${this.serviceUrl}/transcribe/${jobId}`,

     

       507
       -
       				{

     

       508
       -
       					method: "DELETE",

     

       509
       -
       				},

     

       510
       -
       			);

     

       511
        
       			if (response.ok) {

     

       512
        
       				console.log(`[Cleanup] Deleted job ${jobId} from Murmur`);

     

       513
        
       			} else {

     
···

       671
        
       		} catch (error) {

     

       672
        
       			console.error("[Cleanup] Failed:", error);

     

       673
        
       		}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       674
        
       	}

     

       675
        
       }

···

       502
        
       

     

       503
        
       	private async deleteWhisperJob(jobId: string) {

     

       504
        
       		try {

     

       505
       +
       			const response = await fetch(`${this.serviceUrl}/transcribe/${jobId}`, {

     

       506
       +
       				method: "DELETE",

     

       507
       +
       			});

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       508
        
       			if (response.ok) {

     

       509
        
       				console.log(`[Cleanup] Deleted job ${jobId} from Murmur`);

     

       510
        
       			} else {

     
···

       668
        
       		} catch (error) {

     

       669
        
       			console.error("[Cleanup] Failed:", error);

     

       670
        
       		}

     

       671
       +
       	}

     

       672
       +
       

     

       673
       +
       	stop(): void {

     

       674
       +
       		console.log("[Transcription] Closing active streams...");

     

       675
       +
       		// Close all active SSE streams to Murmur

     

       676
       +
       		for (const [transcriptionId, stream] of this.activeStreams.entries()) {

     

       677
       +
       			try {

     

       678
       +
       				stream.close();

     

       679
       +
       				this.streamLocks.delete(transcriptionId);

     

       680
       +
       			} catch (error) {

     

       681
       +
       				console.error(

     

       682
       +
       					`[Transcription] Error closing stream ${transcriptionId}:`,

     

       683
       +
       					error,

     

       684
       +
       				);

     

       685
       +
       			}

     

       686
       +
       		}

     

       687
       +
       		this.activeStreams.clear();

     

       688
       +
       		console.log("[Transcription] All streams closed");

     

       689
        
       	}

     

       690
        
       }

+118

src/lib/validation.test.ts

···

       1
       +
       import { expect, test } from "bun:test";

     

       2
       +
       import {

     

       3
       +
       	validateClassId,

     

       4
       +
       	validateCourseCode,

     

       5
       +
       	validateCourseName,

     

       6
       +
       	validateEmail,

     

       7
       +
       	validateName,

     

       8
       +
       	validatePasswordHash,

     

       9
       +
       	validateSemester,

     

       10
       +
       	validateYear,

     

       11
       +
       } from "./validation";

     

       12
       +
       

     

       13
       +
       test("validateEmail accepts valid emails", () => {

     

       14
       +
       	expect(validateEmail("test@example.com").valid).toBe(true);

     

       15
       +
       	expect(validateEmail("user.name+tag@example.co.uk").valid).toBe(true);

     

       16
       +
       	expect(validateEmail("test@subdomain.example.com").valid).toBe(true);

     

       17
       +
       });

     

       18
       +
       

     

       19
       +
       test("validateEmail rejects invalid emails", () => {

     

       20
       +
       	expect(validateEmail("").valid).toBe(false);

     

       21
       +
       	expect(validateEmail("not-an-email").valid).toBe(false);

     

       22
       +
       	expect(validateEmail("@example.com").valid).toBe(false);

     

       23
       +
       	expect(validateEmail("test@").valid).toBe(false);

     

       24
       +
       	expect(validateEmail("a".repeat(321)).valid).toBe(false); // Too long

     

       25
       +
       	expect(validateEmail(123).valid).toBe(false); // Not a string

     

       26
       +
       });

     

       27
       +
       

     

       28
       +
       test("validateName accepts valid names", () => {

     

       29
       +
       	expect(validateName("John Doe").valid).toBe(true);

     

       30
       +
       	expect(validateName("Alice").valid).toBe(true);

     

       31
       +
       	expect(validateName("María García").valid).toBe(true);

     

       32
       +
       });

     

       33
       +
       

     

       34
       +
       test("validateName rejects invalid names", () => {

     

       35
       +
       	expect(validateName("").valid).toBe(false);

     

       36
       +
       	expect(validateName("   ").valid).toBe(false); // Whitespace only

     

       37
       +
       	expect(validateName("a".repeat(256)).valid).toBe(false); // Too long

     

       38
       +
       	expect(validateName(123).valid).toBe(false); // Not a string

     

       39
       +
       });

     

       40
       +
       

     

       41
       +
       test("validatePasswordHash accepts valid PBKDF2 hashes", () => {

     

       42
       +
       	const validHash = "a".repeat(64); // 64 char hex string

     

       43
       +
       	expect(validatePasswordHash(validHash).valid).toBe(true);

     

       44
       +
       	expect(validatePasswordHash("0123456789abcdef".repeat(4)).valid).toBe(true);

     

       45
       +
       });

     

       46
       +
       

     

       47
       +
       test("validatePasswordHash rejects invalid hashes", () => {

     

       48
       +
       	expect(validatePasswordHash("short").valid).toBe(false);

     

       49
       +
       	expect(validatePasswordHash("a".repeat(63)).valid).toBe(false); // Too short

     

       50
       +
       	expect(validatePasswordHash("a".repeat(65)).valid).toBe(false); // Too long

     

       51
       +
       	expect(validatePasswordHash("g".repeat(64)).valid).toBe(false); // Invalid hex

     

       52
       +
       	expect(validatePasswordHash(123).valid).toBe(false); // Not a string

     

       53
       +
       });

     

       54
       +
       

     

       55
       +
       test("validateCourseCode accepts valid course codes", () => {

     

       56
       +
       	expect(validateCourseCode("CS101").valid).toBe(true);

     

       57
       +
       	expect(validateCourseCode("MATH 2410").valid).toBe(true);

     

       58
       +
       	expect(validateCourseCode("BIO-101").valid).toBe(true);

     

       59
       +
       });

     

       60
       +
       

     

       61
       +
       test("validateCourseCode rejects invalid course codes", () => {

     

       62
       +
       	expect(validateCourseCode("").valid).toBe(false);

     

       63
       +
       	expect(validateCourseCode("   ").valid).toBe(false);

     

       64
       +
       	expect(validateCourseCode("a".repeat(51)).valid).toBe(false); // Too long

     

       65
       +
       	expect(validateCourseCode(123).valid).toBe(false); // Not a string

     

       66
       +
       });

     

       67
       +
       

     

       68
       +
       test("validateCourseName accepts valid course names", () => {

     

       69
       +
       	expect(validateCourseName("Introduction to Computer Science").valid).toBe(

     

       70
       +
       		true,

     

       71
       +
       	);

     

       72
       +
       	expect(validateCourseName("Calculus I").valid).toBe(true);

     

       73
       +
       });

     

       74
       +
       

     

       75
       +
       test("validateCourseName rejects invalid course names", () => {

     

       76
       +
       	expect(validateCourseName("").valid).toBe(false);

     

       77
       +
       	expect(validateCourseName("   ").valid).toBe(false);

     

       78
       +
       	expect(validateCourseName("a".repeat(501)).valid).toBe(false); // Too long

     

       79
       +
       	expect(validateCourseName(123).valid).toBe(false); // Not a string

     

       80
       +
       });

     

       81
       +
       

     

       82
       +
       test("validateSemester accepts valid semesters", () => {

     

       83
       +
       	expect(validateSemester("Fall").valid).toBe(true);

     

       84
       +
       	expect(validateSemester("spring").valid).toBe(true); // Case insensitive

     

       85
       +
       	expect(validateSemester("SUMMER").valid).toBe(true);

     

       86
       +
       	expect(validateSemester("Winter").valid).toBe(true);

     

       87
       +
       });

     

       88
       +
       

     

       89
       +
       test("validateSemester rejects invalid semesters", () => {

     

       90
       +
       	expect(validateSemester("").valid).toBe(false);

     

       91
       +
       	expect(validateSemester("Invalid").valid).toBe(false);

     

       92
       +
       	expect(validateSemester("Autumn").valid).toBe(false);

     

       93
       +
       	expect(validateSemester(123).valid).toBe(false); // Not a string

     

       94
       +
       });

     

       95
       +
       

     

       96
       +
       test("validateYear accepts valid years", () => {

     

       97
       +
       	const currentYear = new Date().getFullYear();

     

       98
       +
       	expect(validateYear(currentYear).valid).toBe(true);

     

       99
       +
       	expect(validateYear(2024).valid).toBe(true);

     

       100
       +
       	expect(validateYear(currentYear + 1).valid).toBe(true);

     

       101
       +
       });

     

       102
       +
       

     

       103
       +
       test("validateYear rejects invalid years", () => {

     

       104
       +
       	expect(validateYear(1999).valid).toBe(false); // Too old

     

       105
       +
       	expect(validateYear(2050).valid).toBe(false); // Too far in future

     

       106
       +
       	expect(validateYear("2024").valid).toBe(false); // Not a number

     

       107
       +
       });

     

       108
       +
       

     

       109
       +
       test("validateClassId accepts valid class IDs", () => {

     

       110
       +
       	expect(validateClassId("abc123").valid).toBe(true);

     

       111
       +
       	expect(validateClassId("class-2024-fall").valid).toBe(true);

     

       112
       +
       });

     

       113
       +
       

     

       114
       +
       test("validateClassId rejects invalid class IDs", () => {

     

       115
       +
       	expect(validateClassId("").valid).toBe(false);

     

       116
       +
       	expect(validateClassId("a".repeat(101)).valid).toBe(false); // Too long

     

       117
       +
       	expect(validateClassId(123).valid).toBe(false); // Not a string

     

       118
       +
       });

+223

src/lib/validation.ts

···

       1
       +
       /**

     

       2
       +
        * Input validation utilities

     

       3
       +
        */

     

       4
       +
       

     

       5
       +
       // RFC 5322 compliant email regex (simplified but comprehensive)

     

       6
       +
       const EMAIL_REGEX =

     

       7
       +
       	/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;

     

       8
       +
       

     

       9
       +
       // Validation limits

     

       10
       +
       export const VALIDATION_LIMITS = {

     

       11
       +
       	EMAIL_MAX: 320, // RFC 5321

     

       12
       +
       	NAME_MAX: 255,

     

       13
       +
       	PASSWORD_HASH_LENGTH: 64, // PBKDF2 hex output

     

       14
       +
       	COURSE_CODE_MAX: 50,

     

       15
       +
       	COURSE_NAME_MAX: 500,

     

       16
       +
       	PROFESSOR_NAME_MAX: 255,

     

       17
       +
       	SEMESTER_MAX: 50,

     

       18
       +
       	CLASS_ID_MAX: 100,

     

       19
       +
       };

     

       20
       +
       

     

       21
       +
       export interface ValidationResult {

     

       22
       +
       	valid: boolean;

     

       23
       +
       	error?: string;

     

       24
       +
       }

     

       25
       +
       

     

       26
       +
       /**

     

       27
       +
        * Validate email address

     

       28
       +
        */

     

       29
       +
       export function validateEmail(email: unknown): ValidationResult {

     

       30
       +
       	if (typeof email !== "string") {

     

       31
       +
       		return { valid: false, error: "Email must be a string" };

     

       32
       +
       	}

     

       33
       +
       

     

       34
       +
       	const trimmed = email.trim();

     

       35
       +
       

     

       36
       +
       	if (trimmed.length === 0) {

     

       37
       +
       		return { valid: false, error: "Email is required" };

     

       38
       +
       	}

     

       39
       +
       

     

       40
       +
       	if (trimmed.length > VALIDATION_LIMITS.EMAIL_MAX) {

     

       41
       +
       		return {

     

       42
       +
       			valid: false,

     

       43
       +
       			error: `Email must be less than ${VALIDATION_LIMITS.EMAIL_MAX} characters`,

     

       44
       +
       		};

     

       45
       +
       	}

     

       46
       +
       

     

       47
       +
       	if (!EMAIL_REGEX.test(trimmed)) {

     

       48
       +
       		return { valid: false, error: "Invalid email format" };

     

       49
       +
       	}

     

       50
       +
       

     

       51
       +
       	return { valid: true };

     

       52
       +
       }

     

       53
       +
       

     

       54
       +
       /**

     

       55
       +
        * Validate name (user name, professor name, etc.)

     

       56
       +
        */

     

       57
       +
       export function validateName(

     

       58
       +
       	name: unknown,

     

       59
       +
       	fieldName = "Name",

     

       60
       +
       ): ValidationResult {

     

       61
       +
       	if (typeof name !== "string") {

     

       62
       +
       		return { valid: false, error: `${fieldName} must be a string` };

     

       63
       +
       	}

     

       64
       +
       

     

       65
       +
       	const trimmed = name.trim();

     

       66
       +
       

     

       67
       +
       	if (trimmed.length === 0) {

     

       68
       +
       		return { valid: false, error: `${fieldName} is required` };

     

       69
       +
       	}

     

       70
       +
       

     

       71
       +
       	if (trimmed.length > VALIDATION_LIMITS.NAME_MAX) {

     

       72
       +
       		return {

     

       73
       +
       			valid: false,

     

       74
       +
       			error: `${fieldName} must be less than ${VALIDATION_LIMITS.NAME_MAX} characters`,

     

       75
       +
       		};

     

       76
       +
       	}

     

       77
       +
       

     

       78
       +
       	return { valid: true };

     

       79
       +
       }

     

       80
       +
       

     

       81
       +
       /**

     

       82
       +
        * Validate password hash format (client-side PBKDF2)

     

       83
       +
        */

     

       84
       +
       export function validatePasswordHash(password: unknown): ValidationResult {

     

       85
       +
       	if (typeof password !== "string") {

     

       86
       +
       		return { valid: false, error: "Password must be a string" };

     

       87
       +
       	}

     

       88
       +
       

     

       89
       +
       	// Client sends PBKDF2 as hex string

     

       90
       +
       	if (

     

       91
       +
       		password.length !== VALIDATION_LIMITS.PASSWORD_HASH_LENGTH ||

     

       92
       +
       		!/^[0-9a-f]+$/.test(password)

     

       93
       +
       	) {

     

       94
       +
       		return { valid: false, error: "Invalid password format" };

     

       95
       +
       	}

     

       96
       +
       

     

       97
       +
       	return { valid: true };

     

       98
       +
       }

     

       99
       +
       

     

       100
       +
       /**

     

       101
       +
        * Validate course code

     

       102
       +
        */

     

       103
       +
       export function validateCourseCode(courseCode: unknown): ValidationResult {

     

       104
       +
       	if (typeof courseCode !== "string") {

     

       105
       +
       		return { valid: false, error: "Course code must be a string" };

     

       106
       +
       	}

     

       107
       +
       

     

       108
       +
       	const trimmed = courseCode.trim();

     

       109
       +
       

     

       110
       +
       	if (trimmed.length === 0) {

     

       111
       +
       		return { valid: false, error: "Course code is required" };

     

       112
       +
       	}

     

       113
       +
       

     

       114
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_CODE_MAX) {

     

       115
       +
       		return {

     

       116
       +
       			valid: false,

     

       117
       +
       			error: `Course code must be less than ${VALIDATION_LIMITS.COURSE_CODE_MAX} characters`,

     

       118
       +
       		};

     

       119
       +
       	}

     

       120
       +
       

     

       121
       +
       	return { valid: true };

     

       122
       +
       }

     

       123
       +
       

     

       124
       +
       /**

     

       125
       +
        * Validate course/class name

     

       126
       +
        */

     

       127
       +
       export function validateCourseName(courseName: unknown): ValidationResult {

     

       128
       +
       	if (typeof courseName !== "string") {

     

       129
       +
       		return { valid: false, error: "Course name must be a string" };

     

       130
       +
       	}

     

       131
       +
       

     

       132
       +
       	const trimmed = courseName.trim();

     

       133
       +
       

     

       134
       +
       	if (trimmed.length === 0) {

     

       135
       +
       		return { valid: false, error: "Course name is required" };

     

       136
       +
       	}

     

       137
       +
       

     

       138
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_NAME_MAX) {

     

       139
       +
       		return {

     

       140
       +
       			valid: false,

     

       141
       +
       			error: `Course name must be less than ${VALIDATION_LIMITS.COURSE_NAME_MAX} characters`,

     

       142
       +
       		};

     

       143
       +
       	}

     

       144
       +
       

     

       145
       +
       	return { valid: true };

     

       146
       +
       }

     

       147
       +
       

     

       148
       +
       /**

     

       149
       +
        * Validate semester

     

       150
       +
        */

     

       151
       +
       export function validateSemester(semester: unknown): ValidationResult {

     

       152
       +
       	if (typeof semester !== "string") {

     

       153
       +
       		return { valid: false, error: "Semester must be a string" };

     

       154
       +
       	}

     

       155
       +
       

     

       156
       +
       	const trimmed = semester.trim();

     

       157
       +
       

     

       158
       +
       	if (trimmed.length === 0) {

     

       159
       +
       		return { valid: false, error: "Semester is required" };

     

       160
       +
       	}

     

       161
       +
       

     

       162
       +
       	if (trimmed.length > VALIDATION_LIMITS.SEMESTER_MAX) {

     

       163
       +
       		return {

     

       164
       +
       			valid: false,

     

       165
       +
       			error: `Semester must be less than ${VALIDATION_LIMITS.SEMESTER_MAX} characters`,

     

       166
       +
       		};

     

       167
       +
       	}

     

       168
       +
       

     

       169
       +
       	// Optional: validate it's a known semester value

     

       170
       +
       	const validSemesters = ["fall", "spring", "summer", "winter"];

     

       171
       +
       	if (!validSemesters.includes(trimmed.toLowerCase())) {

     

       172
       +
       		return {

     

       173
       +
       			valid: false,

     

       174
       +
       			error: "Semester must be Fall, Spring, Summer, or Winter",

     

       175
       +
       		};

     

       176
       +
       	}

     

       177
       +
       

     

       178
       +
       	return { valid: true };

     

       179
       +
       }

     

       180
       +
       

     

       181
       +
       /**

     

       182
       +
        * Validate year

     

       183
       +
        */

     

       184
       +
       export function validateYear(year: unknown): ValidationResult {

     

       185
       +
       	if (typeof year !== "number") {

     

       186
       +
       		return { valid: false, error: "Year must be a number" };

     

       187
       +
       	}

     

       188
       +
       

     

       189
       +
       	const currentYear = new Date().getFullYear();

     

       190
       +
       	const minYear = 2000;

     

       191
       +
       	const maxYear = currentYear + 5;

     

       192
       +
       

     

       193
       +
       	if (year < minYear || year > maxYear) {

     

       194
       +
       		return {

     

       195
       +
       			valid: false,

     

       196
       +
       			error: `Year must be between ${minYear} and ${maxYear}`,

     

       197
       +
       		};

     

       198
       +
       	}

     

       199
       +
       

     

       200
       +
       	return { valid: true };

     

       201
       +
       }

     

       202
       +
       

     

       203
       +
       /**

     

       204
       +
        * Validate class ID format

     

       205
       +
        */

     

       206
       +
       export function validateClassId(classId: unknown): ValidationResult {

     

       207
       +
       	if (typeof classId !== "string") {

     

       208
       +
       		return { valid: false, error: "Class ID must be a string" };

     

       209
       +
       	}

     

       210
       +
       

     

       211
       +
       	if (classId.length === 0) {

     

       212
       +
       		return { valid: false, error: "Class ID is required" };

     

       213
       +
       	}

     

       214
       +
       

     

       215
       +
       	if (classId.length > VALIDATION_LIMITS.CLASS_ID_MAX) {

     

       216
       +
       		return {

     

       217
       +
       			valid: false,

     

       218
       +
       			error: `Class ID must be less than ${VALIDATION_LIMITS.CLASS_ID_MAX} characters`,

     

       219
       +
       		};

     

       220
       +
       	}

     

       221
       +
       

     

       222
       +
       	return { valid: true };

     

       223
       +
       }

+227

src/lib/voting.ts

···

       1
       +
       import { nanoid } from "nanoid";

     

       2
       +
       import db from "../db/schema";

     

       3
       +
       

     

       4
       +
       /**

     

       5
       +
        * Vote for a recording

     

       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       +
        */

     

       8
       +
       export function voteForRecording(

     

       9
       +
       	transcriptionId: string,

     

       10
       +
       	userId: number,

     

       11
       +
       ): boolean {

     

       12
       +
       	try {

     

       13
       +
       		const voteId = nanoid();

     

       14
       +
       		db.run(

     

       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       +
       		);

     

       18
       +
       

     

       19
       +
       		// Increment vote count on transcription

     

       20
       +
       		db.run(

     

       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       +
       			[transcriptionId],

     

       23
       +
       		);

     

       24
       +
       

     

       25
       +
       		return true;

     

       26
       +
       	} catch (error) {

     

       27
       +
       		// Unique constraint violation means user already voted

     

       28
       +
       		if (

     

       29
       +
       			error instanceof Error &&

     

       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       +
       		) {

     

       32
       +
       			return false;

     

       33
       +
       		}

     

       34
       +
       		throw error;

     

       35
       +
       	}

     

       36
       +
       }

     

       37
       +
       

     

       38
       +
       /**

     

       39
       +
        * Remove vote for a recording

     

       40
       +
        */

     

       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       +
       	const result = db.run(

     

       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       +
       		[transcriptionId, userId],

     

       45
       +
       	);

     

       46
       +
       

     

       47
       +
       	if (result.changes > 0) {

     

       48
       +
       		// Decrement vote count on transcription

     

       49
       +
       		db.run(

     

       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       +
       			[transcriptionId],

     

       52
       +
       		);

     

       53
       +
       		return true;

     

       54
       +
       	}

     

       55
       +
       

     

       56
       +
       	return false;

     

       57
       +
       }

     

       58
       +
       

     

       59
       +
       /**

     

       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       +
        */

     

       62
       +
       export function getUserVoteForMeeting(

     

       63
       +
       	userId: number,

     

       64
       +
       	classId: string,

     

       65
       +
       	meetingTimeId: string,

     

       66
       +
       ): string | null {

     

       67
       +
       	const result = db

     

       68
       +
       		.query<

     

       69
       +
       			{ transcription_id: string },

     

       70
       +
       			[number, string, string]

     

       71
       +
       		>(

     

       72
       +
       			`SELECT rv.transcription_id 

     

       73
       +
              FROM recording_votes rv

     

       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       +
              WHERE rv.user_id = ? 

     

       76
       +
                AND t.class_id = ? 

     

       77
       +
                AND t.meeting_time_id = ?

     

       78
       +
                AND t.status = 'pending'`,

     

       79
       +
       		)

     

       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       +
       

     

       82
       +
       	return result?.transcription_id || null;

     

       83
       +
       }

     

       84
       +
       

     

       85
       +
       /**

     

       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       +
        */

     

       88
       +
       export function getPendingRecordings(

     

       89
       +
       	classId: string,

     

       90
       +
       	meetingTimeId: string,

     

       91
       +
       	sectionId?: string | null,

     

       92
       +
       ) {

     

       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       +
              FROM transcriptions

     

       96
       +
              WHERE class_id = ? 

     

       97
       +
                AND meeting_time_id = ?

     

       98
       +
                AND status = 'pending'`;

     

       99
       +
       

     

       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       +
       

     

       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       +
       	if (sectionId !== undefined) {

     

       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       +
       		params.push(sectionId);

     

       106
       +
       	}

     

       107
       +
       

     

       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       +
       

     

       110
       +
       	return db

     

       111
       +
       		.query<

     

       112
       +
       			{

     

       113
       +
       				id: string;

     

       114
       +
       				user_id: number;

     

       115
       +
       				filename: string;

     

       116
       +
       				original_filename: string;

     

       117
       +
       				vote_count: number;

     

       118
       +
       				created_at: number;

     

       119
       +
       				section_id: string | null;

     

       120
       +
       			},

     

       121
       +
       			(string | null)[]

     

       122
       +
       		>(query)

     

       123
       +
       		.all(...params);

     

       124
       +
       }

     

       125
       +
       

     

       126
       +
       /**

     

       127
       +
        * Get total enrolled users count for a class

     

       128
       +
        */

     

       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       +
       	const result = db

     

       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       +
       		)

     

       134
       +
       		.get(classId);

     

       135
       +
       

     

       136
       +
       	return result?.count || 0;

     

       137
       +
       }

     

       138
       +
       

     

       139
       +
       /**

     

       140
       +
        * Check if recording should be auto-submitted

     

       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       +
        */

     

       143
       +
       export function checkAutoSubmit(

     

       144
       +
       	classId: string,

     

       145
       +
       	meetingTimeId: string,

     

       146
       +
       	sectionId?: string | null,

     

       147
       +
       ): string | null {

     

       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       +
       

     

       150
       +
       	if (recordings.length === 0) {

     

       151
       +
       		return null;

     

       152
       +
       	}

     

       153
       +
       

     

       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       +
       

     

       157
       +
       	// Get the recording with most votes

     

       158
       +
       	const topRecording = recordings[0];

     

       159
       +
       	if (!topRecording) return null;

     

       160
       +
       

     

       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       +
       

     

       164
       +
       	// Auto-submit if:

     

       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       +
       

     

       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       +
       		console.log(

     

       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       +
       		);

     

       174
       +
       		return topRecording.id;

     

       175
       +
       	}

     

       176
       +
       

     

       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       +
       		console.log(

     

       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       +
       		);

     

       181
       +
       		return topRecording.id;

     

       182
       +
       	}

     

       183
       +
       

     

       184
       +
       	return null;

     

       185
       +
       }

     

       186
       +
       

     

       187
       +
       /**

     

       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       +
        */

     

       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       +
       	db.run(

     

       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       +
       		[transcriptionId],

     

       194
       +
       	);

     

       195
       +
       }

     

       196
       +
       

     

       197
       +
       /**

     

       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       +
        */

     

       200
       +
       export function deletePendingRecording(

     

       201
       +
       	transcriptionId: string,

     

       202
       +
       	userId: number,

     

       203
       +
       	isAdmin: boolean,

     

       204
       +
       ): boolean {

     

       205
       +
       	// Check ownership if not admin

     

       206
       +
       	if (!isAdmin) {

     

       207
       +
       		const recording = db

     

       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       +
       			)

     

       211
       +
       			.get(transcriptionId);

     

       212
       +
       

     

       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       +
       			return false;

     

       215
       +
       		}

     

       216
       +
       

     

       217
       +
       		// Only allow deleting pending recordings

     

       218
       +
       		if (recording.status !== "pending") {

     

       219
       +
       			return false;

     

       220
       +
       		}

     

       221
       +
       	}

     

       222
       +
       

     

       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       +
       

     

       226
       +
       	return true;

     

       227
       +
       }

+10

src/lib/vtt-cleaner.test.ts

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       58
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       59
        
       

     

       60
        
       	expect(result).toBe(emptyVTT);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       61
        
       });

     

       62
        
       

     

       63
        
       // AI integration test - skip by default to avoid burning credits

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       +
       

     

       59
       +
       	// Save and remove API key to avoid burning tokens

     

       60
       +
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       +
       	delete process.env.LLM_API_KEY;

     

       62
       +
       

     

       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       64
        
       

     

       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       +
       

     

       67
       +
       	// Restore original key

     

       68
       +
       	if (originalKey) {

     

       69
       +
       		process.env.LLM_API_KEY = originalKey;

     

       70
       +
       	}

     

       71
        
       });

     

       72
        
       

     

       73
        
       // AI integration test - skip by default to avoid burning credits

+8 -8

src/lib/vtt-cleaner.ts

···

       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
        
       	);

     

       340
        
       

     

       341
       -
       	const apiKey = process.env.LLM_API_KEY;

     

       342
       -
       	const apiBaseUrl = process.env.LLM_API_BASE_URL;

     

       343
       -
       	const model = process.env.LLM_MODEL;

     

       344
       -
       

     

       345
       -
       	if (!apiKey || !apiBaseUrl || !model) {

     

       346
       -
       		console.warn(

     

       347
       -
       			"[VTTCleaner] LLM configuration incomplete (need LLM_API_KEY, LLM_API_BASE_URL, LLM_MODEL), returning uncleaned VTT",

     

       348
       -
       		);

     

       349
        
       		return vttContent;

     

       350
        
       	}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       351
        
       

     

       352
        
       	try {

     

       353
        
       		// Build the input segments

···

       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
        
       	);

     

       340
        
       

     

       341
       +
       	// Check if API key is available, return original if not

     

       342
       +
       	if (!process.env.LLM_API_KEY) {

     

       343
       +
       		console.warn("[VTTCleaner] LLM_API_KEY not set, returning original VTT");

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       344
        
       		return vttContent;

     

       345
        
       	}

     

       346
       +
       

     

       347
       +
       	// Validated at startup

     

       348
       +
       	const apiKey = process.env.LLM_API_KEY as string;

     

       349
       +
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

     

       350
       +
       	const model = process.env.LLM_MODEL as string;

     

       351
        
       

     

       352
        
       	try {

     

       353
        
       		// Build the input segments

+4 -254

src/pages/admin.html

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       -
         <style>

     

       14
       -
           main {

     

       15
       -
             max-width: 80rem;

     

       16
       -
             margin: 0 auto;

     

       17
       -
             padding: 2rem;

     

       18
       -
           }

     

       19
       -
       

     

       20
       -
           h1 {

     

       21
       -
             margin-bottom: 2rem;

     

       22
       -
             color: var(--text);

     

       23
       -
           }

     

       24
       -
       

     

       25
       -
           .section {

     

       26
       -
             margin-bottom: 3rem;

     

       27
       -
           }

     

       28
       -
       

     

       29
       -
           .section-title {

     

       30
       -
             font-size: 1.5rem;

     

       31
       -
             font-weight: 600;

     

       32
       -
             color: var(--text);

     

       33
       -
             margin-bottom: 1rem;

     

       34
       -
             display: flex;

     

       35
       -
             align-items: center;

     

       36
       -
             gap: 0.5rem;

     

       37
       -
           }

     

       38
       -
       

     

       39
       -
           .tabs {

     

       40
       -
             display: flex;

     

       41
       -
             gap: 1rem;

     

       42
       -
             border-bottom: 2px solid var(--secondary);

     

       43
       -
             margin-bottom: 2rem;

     

       44
       -
           }

     

       45
       -
       

     

       46
       -
           .tab {

     

       47
       -
             padding: 0.75rem 1.5rem;

     

       48
       -
             border: none;

     

       49
       -
             background: transparent;

     

       50
       -
             color: var(--text);

     

       51
       -
             cursor: pointer;

     

       52
       -
             font-size: 1rem;

     

       53
       -
             font-weight: 500;

     

       54
       -
             font-family: inherit;

     

       55
       -
             border-bottom: 2px solid transparent;

     

       56
       -
             margin-bottom: -2px;

     

       57
       -
             transition: all 0.2s;

     

       58
       -
           }

     

       59
       -
       

     

       60
       -
           .tab:hover {

     

       61
       -
             color: var(--primary);

     

       62
       -
           }

     

       63
       -
       

     

       64
       -
           .tab.active {

     

       65
       -
             color: var(--primary);

     

       66
       -
             border-bottom-color: var(--primary);

     

       67
       -
           }

     

       68
       -
       

     

       69
       -
           .tab-content {

     

       70
       -
             display: none;

     

       71
       -
           }

     

       72
       -
       

     

       73
       -
           .tab-content.active {

     

       74
       -
             display: block;

     

       75
       -
           }

     

       76
       -
       

     

       77
       -
           .empty-state {

     

       78
       -
             text-align: center;

     

       79
       -
             padding: 3rem;

     

       80
       -
             color: var(--text);

     

       81
       -
             opacity: 0.6;

     

       82
       -
           }

     

       83
       -
       

     

       84
       -
           .loading {

     

       85
       -
             text-align: center;

     

       86
       -
             padding: 3rem;

     

       87
       -
             color: var(--text);

     

       88
       -
           }

     

       89
       -
       

     

       90
       -
           .error {

     

       91
       -
             background: #fee2e2;

     

       92
       -
             color: #991b1b;

     

       93
       -
             padding: 1rem;

     

       94
       -
             border-radius: 6px;

     

       95
       -
             margin-bottom: 1rem;

     

       96
       -
           }

     

       97
       -
       

     

       98
       -
           .stats {

     

       99
       -
             display: grid;

     

       100
       -
             grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       101
       -
             gap: 1rem;

     

       102
       -
             margin-bottom: 2rem;

     

       103
       -
           }

     

       104
       -
       

     

       105
       -
           .stat-card {

     

       106
       -
             background: var(--background);

     

       107
       -
             border: 2px solid var(--secondary);

     

       108
       -
             border-radius: 8px;

     

       109
       -
             padding: 1.5rem;

     

       110
       -
           }

     

       111
       -
       

     

       112
       -
           .stat-value {

     

       113
       -
             font-size: 2rem;

     

       114
       -
             font-weight: 700;

     

       115
       -
             color: var(--primary);

     

       116
       -
             margin-bottom: 0.25rem;

     

       117
       -
           }

     

       118
       -
       

     

       119
       -
           .stat-label {

     

       120
       -
             color: var(--text);

     

       121
       -
             opacity: 0.7;

     

       122
       -
             font-size: 0.875rem;

     

       123
       -
           }

     

       124
       -
       

     

       125
       -
           .timestamp {

     

       126
       -
             color: var(--text);

     

       127
       -
             opacity: 0.6;

     

       128
       -
             font-size: 0.875rem;

     

       129
       -
           }

     

       130
       -
         </style>

     

       131
        
       </head>

     

       132
        
       

     

       133
        
       <body>

     
···

       144
        
         <main>

     

       145
        
           <h1>Admin Dashboard</h1>

     

       146
        
       

     

       147
       -
           <div id="error-message" class="error" style="display: none;"></div>

     

       148
        
       

     

       149
        
           <div id="loading" class="loading">Loading...</div>

     

       150
        
       

     

       151
       -
           <div id="content" style="display: none;">

     

       152
        
             <div class="stats">

     

       153
        
               <div class="stat-card">

     

       154
        
                 <div class="stat-value" id="total-users">0</div>

     
···

       211
        
         <script type="module" src="../components/admin-classes.ts"></script>

     

       212
        
         <script type="module" src="../components/user-modal.ts"></script>

     

       213
        
         <script type="module" src="../components/transcript-view-modal.ts"></script>

     

       214
       -
         <script type="module">

     

       215
       -
           const transcriptionsComponent = document.getElementById('transcriptions-component');

     

       216
       -
           const usersComponent = document.getElementById('users-component');

     

       217
       -
           const userModal = document.getElementById('user-modal');

     

       218
       -
           const transcriptModal = document.getElementById('transcript-modal');

     

       219
       -
           const errorMessage = document.getElementById('error-message');

     

       220
       -
           const loading = document.getElementById('loading');

     

       221
       -
           const content = document.getElementById('content');

     

       222
       -
       

     

       223
       -
           // Modal functions

     

       224
       -
           function openUserModal(userId) {

     

       225
       -
             userModal.setAttribute('open', '');

     

       226
       -
             userModal.userId = userId;

     

       227
       -
           }

     

       228
       -
       

     

       229
       -
           function closeUserModal() {

     

       230
       -
             userModal.removeAttribute('open');

     

       231
       -
             userModal.userId = null;

     

       232
       -
           }

     

       233
       -
       

     

       234
       -
           function openTranscriptModal(transcriptId) {

     

       235
       -
             transcriptModal.setAttribute('open', '');

     

       236
       -
             transcriptModal.transcriptId = transcriptId;

     

       237
       -
           }

     

       238
       -
       

     

       239
       -
           function closeTranscriptModal() {

     

       240
       -
             transcriptModal.removeAttribute('open');

     

       241
       -
             transcriptModal.transcriptId = null;

     

       242
       -
           }

     

       243
       -
       

     

       244
       -
           // Listen for component events

     

       245
       -
           transcriptionsComponent.addEventListener('open-transcription', (e) => {

     

       246
       -
             openTranscriptModal(e.detail.id);

     

       247
       -
           });

     

       248
       -
       

     

       249
       -
           usersComponent.addEventListener('open-user', (e) => {

     

       250
       -
             openUserModal(e.detail.id);

     

       251
       -
           });

     

       252
       -
       

     

       253
       -
           // Listen for modal close events

     

       254
       -
           userModal.addEventListener('close', closeUserModal);

     

       255
       -
           userModal.addEventListener('user-updated', async () => {

     

       256
       -
             await loadStats();

     

       257
       -
           });

     

       258
       -
           userModal.addEventListener('click', (e) => {

     

       259
       -
             if (e.target === userModal) closeUserModal();

     

       260
       -
           });

     

       261
       -
       

     

       262
       -
           transcriptModal.addEventListener('close', closeTranscriptModal);

     

       263
       -
           transcriptModal.addEventListener('transcript-deleted', async () => {

     

       264
       -
             await loadStats();

     

       265
       -
           });

     

       266
       -
           transcriptModal.addEventListener('click', (e) => {

     

       267
       -
             if (e.target === transcriptModal) closeTranscriptModal();

     

       268
       -
           });

     

       269
       -
       

     

       270
       -
           async function loadStats() {

     

       271
       -
             try {

     

       272
       -
               const [transcriptionsRes, usersRes] = await Promise.all([

     

       273
       -
                 fetch('/api/admin/transcriptions'),

     

       274
       -
                 fetch('/api/admin/users')

     

       275
       -
               ]);

     

       276
       -
       

     

       277
       -
               if (!transcriptionsRes.ok || !usersRes.ok) {

     

       278
       -
                 if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       279
       -
                   window.location.href = '/';

     

       280
       -
                   return;

     

       281
       -
                 }

     

       282
       -
                 throw new Error('Failed to load admin data');

     

       283
       -
               }

     

       284
       -
       

     

       285
       -
               const transcriptions = await transcriptionsRes.json();

     

       286
       -
               const users = await usersRes.json();

     

       287
       -
       

     

       288
       -
               document.getElementById('total-users').textContent = users.length;

     

       289
       -
               document.getElementById('total-transcriptions').textContent = transcriptions.length;

     

       290
       -
               

     

       291
       -
               const failed = transcriptions.filter(t => t.status === 'failed');

     

       292
       -
               document.getElementById('failed-transcriptions').textContent = failed.length;

     

       293
       -
       

     

       294
       -
               loading.style.display = 'none';

     

       295
       -
               content.style.display = 'block';

     

       296
       -
             } catch (error) {

     

       297
       -
               errorMessage.textContent = error.message;

     

       298
       -
               errorMessage.style.display = 'block';

     

       299
       -
               loading.style.display = 'none';

     

       300
       -
             }

     

       301
       -
           }

     

       302
       -
       

     

       303
       -
           // Tab switching

     

       304
       -
           function switchTab(tabName) {

     

       305
       -
             document.querySelectorAll('.tab').forEach(t => {

     

       306
       -
               t.classList.remove('active');

     

       307
       -
             });

     

       308
       -
             document.querySelectorAll('.tab-content').forEach(c => {

     

       309
       -
               c.classList.remove('active');

     

       310
       -
             });

     

       311
       -
       

     

       312
       -
             const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       313
       -
             const tabContent = document.getElementById(`${tabName}-tab`);

     

       314
       -
             

     

       315
       -
             if (tabButton && tabContent) {

     

       316
       -
               tabButton.classList.add('active');

     

       317
       -
               tabContent.classList.add('active');

     

       318
       -
               

     

       319
       -
               // Update URL without reloading

     

       320
       -
               const url = new URL(window.location.href);

     

       321
       -
               url.searchParams.set('tab', tabName);

     

       322
       -
               // Remove subtab param when leaving classes tab

     

       323
       -
               if (tabName !== 'classes') {

     

       324
       -
                 url.searchParams.delete('subtab');

     

       325
       -
               }

     

       326
       -
               window.history.pushState({}, '', url);

     

       327
       -
             }

     

       328
       -
           }

     

       329
       -
       

     

       330
       -
           document.querySelectorAll('.tab').forEach(tab => {

     

       331
       -
             tab.addEventListener('click', () => {

     

       332
       -
               switchTab(tab.dataset.tab);

     

       333
       -
             });

     

       334
       -
           });

     

       335
       -
       

     

       336
       -
           // Check for tab query parameter on load

     

       337
       -
           const params = new URLSearchParams(window.location.search);

     

       338
       -
           const initialTab = params.get('tab');

     

       339
       -
           const validTabs = ['pending', 'transcriptions', 'users', 'classes'];

     

       340
       -
           

     

       341
       -
           if (initialTab && validTabs.includes(initialTab)) {

     

       342
       -
             switchTab(initialTab);

     

       343
       -
           }

     

       344
       -
       

     

       345
       -
           // Initialize

     

       346
       -
           loadStats();

     

       347
       -
         </script>

     

       348
        
       </body>

     

       349
        
       

     

       350
        
       </html>

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       +
         <link rel="stylesheet" href="../styles/admin.css">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       </head>

     

       15
        
       

     

       16
        
       <body>

     
···

       27
        
         <main>

     

       28
        
           <h1>Admin Dashboard</h1>

     

       29
        
       

     

       30
       +
           <div id="error-message" class="error hidden"></div>

     

       31
        
       

     

       32
        
           <div id="loading" class="loading">Loading...</div>

     

       33
        
       

     

       34
       +
           <div id="content" class="hidden">

     

       35
        
             <div class="stats">

     

       36
        
               <div class="stat-card">

     

       37
        
                 <div class="stat-value" id="total-users">0</div>

     
···

       94
        
         <script type="module" src="../components/admin-classes.ts"></script>

     

       95
        
         <script type="module" src="../components/user-modal.ts"></script>

     

       96
        
         <script type="module" src="../components/transcript-view-modal.ts"></script>

     

       97
       +
         <script type="module" src="./admin.ts"></script>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       98
        
       </body>

     

       99
        
       

     

       100
        
       </html>

+151

src/pages/admin.ts

···

       1
       +
       const transcriptionsComponent = document.getElementById(

     

       2
       +
       	"transcriptions-component",

     

       3
       +
       ) as HTMLElement | null;

     

       4
       +
       const usersComponent = document.getElementById(

     

       5
       +
       	"users-component",

     

       6
       +
       ) as HTMLElement | null;

     

       7
       +
       const userModal = document.getElementById("user-modal") as HTMLElement | null;

     

       8
       +
       const transcriptModal = document.getElementById(

     

       9
       +
       	"transcript-modal",

     

       10
       +
       ) as HTMLElement | null;

     

       11
       +
       const errorMessage = document.getElementById("error-message") as HTMLElement;

     

       12
       +
       const loading = document.getElementById("loading") as HTMLElement;

     

       13
       +
       const content = document.getElementById("content") as HTMLElement;

     

       14
       +
       

     

       15
       +
       // Modal functions

     

       16
       +
       function openUserModal(userId: string) {

     

       17
       +
       	userModal.setAttribute("open", "");

     

       18
       +
       	userModal.userId = userId;

     

       19
       +
       }

     

       20
       +
       

     

       21
       +
       function closeUserModal() {

     

       22
       +
       	userModal.removeAttribute("open");

     

       23
       +
       	userModal.userId = null;

     

       24
       +
       }

     

       25
       +
       

     

       26
       +
       function openTranscriptModal(transcriptId: string) {

     

       27
       +
       	transcriptModal.setAttribute("open", "");

     

       28
       +
       	transcriptModal.transcriptId = transcriptId;

     

       29
       +
       }

     

       30
       +
       

     

       31
       +
       function closeTranscriptModal() {

     

       32
       +
       	transcriptModal.removeAttribute("open");

     

       33
       +
       	transcriptModal.transcriptId = null;

     

       34
       +
       }

     

       35
       +
       

     

       36
       +
       // Listen for component events

     

       37
       +
       transcriptionsComponent?.addEventListener(

     

       38
       +
       	"open-transcription",

     

       39
       +
       	(e: CustomEvent) => {

     

       40
       +
       		openTranscriptModal(e.detail.id);

     

       41
       +
       	},

     

       42
       +
       );

     

       43
       +
       

     

       44
       +
       usersComponent?.addEventListener("open-user", (e: CustomEvent) => {

     

       45
       +
       	openUserModal(e.detail.id);

     

       46
       +
       });

     

       47
       +
       

     

       48
       +
       // Listen for modal close events

     

       49
       +
       userModal?.addEventListener("close", closeUserModal);

     

       50
       +
       userModal?.addEventListener("user-updated", async () => {

     

       51
       +
       	await loadStats();

     

       52
       +
       });

     

       53
       +
       userModal?.addEventListener("click", (e: MouseEvent) => {

     

       54
       +
       	if (e.target === userModal) closeUserModal();

     

       55
       +
       });

     

       56
       +
       

     

       57
       +
       transcriptModal?.addEventListener("close", closeTranscriptModal);

     

       58
       +
       transcriptModal?.addEventListener("transcript-deleted", async () => {

     

       59
       +
       	await loadStats();

     

       60
       +
       });

     

       61
       +
       transcriptModal?.addEventListener("click", (e: MouseEvent) => {

     

       62
       +
       	if (e.target === transcriptModal) closeTranscriptModal();

     

       63
       +
       });

     

       64
       +
       

     

       65
       +
       async function loadStats() {

     

       66
       +
       	try {

     

       67
       +
       		const [transcriptionsRes, usersRes] = await Promise.all([

     

       68
       +
       			fetch("/api/admin/transcriptions"),

     

       69
       +
       			fetch("/api/admin/users"),

     

       70
       +
       		]);

     

       71
       +
       

     

       72
       +
       		if (!transcriptionsRes.ok || !usersRes.ok) {

     

       73
       +
       			if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       74
       +
       				window.location.href = "/";

     

       75
       +
       				return;

     

       76
       +
       			}

     

       77
       +
       			throw new Error("Failed to load admin data");

     

       78
       +
       		}

     

       79
       +
       

     

       80
       +
       		const transcriptions = await transcriptionsRes.json();

     

       81
       +
       		const users = await usersRes.json();

     

       82
       +
       

     

       83
       +
       		const totalUsers = document.getElementById("total-users");

     

       84
       +
       		const totalTranscriptions = document.getElementById("total-transcriptions");

     

       85
       +
       		const failedTranscriptions = document.getElementById(

     

       86
       +
       			"failed-transcriptions",

     

       87
       +
       		);

     

       88
       +
       

     

       89
       +
       		if (totalUsers) totalUsers.textContent = users.length.toString();

     

       90
       +
       		if (totalTranscriptions)

     

       91
       +
       			totalTranscriptions.textContent = transcriptions.length.toString();

     

       92
       +
       

     

       93
       +
       		const failed = transcriptions.filter(

     

       94
       +
       			(t: { status: string }) => t.status === "failed",

     

       95
       +
       		);

     

       96
       +
       		if (failedTranscriptions)

     

       97
       +
       			failedTranscriptions.textContent = failed.length.toString();

     

       98
       +
       

     

       99
       +
       		loading.classList.add("hidden");

     

       100
       +
       		content.classList.remove("hidden");

     

       101
       +
       	} catch (error) {

     

       102
       +
       		errorMessage.textContent = (error as Error).message;

     

       103
       +
       		errorMessage.classList.remove("hidden");

     

       104
       +
       		loading.classList.add("hidden");

     

       105
       +
       	}

     

       106
       +
       }

     

       107
       +
       

     

       108
       +
       // Tab switching

     

       109
       +
       function switchTab(tabName: string) {

     

       110
       +
       	document.querySelectorAll(".tab").forEach((t) => {

     

       111
       +
       		t.classList.remove("active");

     

       112
       +
       	});

     

       113
       +
       	document.querySelectorAll(".tab-content").forEach((c) => {

     

       114
       +
       		c.classList.remove("active");

     

       115
       +
       	});

     

       116
       +
       

     

       117
       +
       	const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       118
       +
       	const tabContent = document.getElementById(`${tabName}-tab`);

     

       119
       +
       

     

       120
       +
       	if (tabButton && tabContent) {

     

       121
       +
       		tabButton.classList.add("active");

     

       122
       +
       		tabContent.classList.add("active");

     

       123
       +
       

     

       124
       +
       		// Update URL without reloading

     

       125
       +
       		const url = new URL(window.location.href);

     

       126
       +
       		url.searchParams.set("tab", tabName);

     

       127
       +
       		// Remove subtab param when leaving classes tab

     

       128
       +
       		if (tabName !== "classes") {

     

       129
       +
       			url.searchParams.delete("subtab");

     

       130
       +
       		}

     

       131
       +
       		window.history.pushState({}, "", url);

     

       132
       +
       	}

     

       133
       +
       }

     

       134
       +
       

     

       135
       +
       document.querySelectorAll(".tab").forEach((tab) => {

     

       136
       +
       	tab.addEventListener("click", () => {

     

       137
       +
       		switchTab((tab as HTMLElement).dataset.tab || "");

     

       138
       +
       	});

     

       139
       +
       });

     

       140
       +
       

     

       141
       +
       // Check for tab query parameter on load

     

       142
       +
       const params = new URLSearchParams(window.location.search);

     

       143
       +
       const initialTab = params.get("tab");

     

       144
       +
       const validTabs = ["pending", "transcriptions", "users", "classes"];

     

       145
       +
       

     

       146
       +
       if (initialTab && validTabs.includes(initialTab)) {

     

       147
       +
       	switchTab(initialTab);

     

       148
       +
       }

     

       149
       +
       

     

       150
       +
       // Initialize

     

       151
       +
       loadStats();

+2 -85

src/pages/index.html

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       -
         <style>

     

       14
       -
           .hero-title {

     

       15
       -
             font-size: 3rem;

     

       16
       -
             font-weight: 700;

     

       17
       -
             color: var(--text);

     

       18
       -
             margin-bottom: 1rem;

     

       19
       -
           }

     

       20
       -
       

     

       21
       -
           .hero-subtitle {

     

       22
       -
             font-size: 1.25rem;

     

       23
       -
             color: var(--text);

     

       24
       -
             opacity: 0.8;

     

       25
       -
             margin-bottom: 2rem;

     

       26
       -
           }

     

       27
       -
       

     

       28
       -
           main {

     

       29
       -
             text-align: center;

     

       30
       -
             padding: 4rem 2rem;

     

       31
       -
           }

     

       32
       -
       

     

       33
       -
           .cta-buttons {

     

       34
       -
             display: flex;

     

       35
       -
             gap: 1rem;

     

       36
       -
             justify-content: center;

     

       37
       -
             margin-top: 2rem;

     

       38
       -
           }

     

       39
       -
       

     

       40
       -
           .btn {

     

       41
       -
             padding: 0.75rem 1.5rem;

     

       42
       -
             border-radius: 6px;

     

       43
       -
             font-size: 1rem;

     

       44
       -
             font-weight: 500;

     

       45
       -
             cursor: pointer;

     

       46
       -
             transition: all 0.2s;

     

       47
       -
             font-family: inherit;

     

       48
       -
             border: 2px solid;

     

       49
       -
             text-decoration: none;

     

       50
       -
             display: inline-block;

     

       51
       -
           }

     

       52
       -
       

     

       53
       -
           .btn-primary {

     

       54
       -
             background: var(--primary);

     

       55
       -
             color: white;

     

       56
       -
             border-color: var(--primary);

     

       57
       -
           }

     

       58
       -
       

     

       59
       -
           .btn-primary:hover {

     

       60
       -
             background: transparent;

     

       61
       -
             color: var(--primary);

     

       62
       -
           }

     

       63
       -
       

     

       64
       -
           .btn-secondary {

     

       65
       -
             background: transparent;

     

       66
       -
             color: var(--text);

     

       67
       -
             border-color: var(--secondary);

     

       68
       -
           }

     

       69
       -
       

     

       70
       -
           .btn-secondary:hover {

     

       71
       -
             border-color: var(--primary);

     

       72
       -
             color: var(--primary);

     

       73
       -
           }

     

       74
       -
       

     

       75
       -
           @media (max-width: 640px) {

     

       76
       -
             .hero-title {

     

       77
       -
               font-size: 2.5rem;

     

       78
       -
             }

     

       79
       -
       

     

       80
       -
             .cta-buttons {

     

       81
       -
               flex-direction: column;

     

       82
       -
               align-items: center;

     

       83
       -
             }

     

       84
       -
           }

     

       85
       -
         </style>

     

       86
        
       </head>

     

       87
        
       

     

       88
        
       <body>

     
···

       106
        
         </main>

     

       107
        
       

     

       108
        
         <script type="module" src="../components/auth.ts"></script>

     

       109
       -
         <script type="module">

     

       110
       -
           document.getElementById('start-btn').addEventListener('click', async () => {

     

       111
       -
             const authComponent = document.querySelector('auth-component');

     

       112
       -
             const isLoggedIn = await authComponent.isAuthenticated();

     

       113
       -
       

     

       114
       -
             if (isLoggedIn) {

     

       115
       -
               window.location.href = '/classes';

     

       116
       -
             } else {

     

       117
       -
               authComponent.openAuthModal();

     

       118
       -
             }

     

       119
       -
           });

     

       120
       -
         </script>

     

       121
        
       </body>

     

       122
        
       

     

       123
        
       </html>

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       +
         <link rel="stylesheet" href="../styles/index.css">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       </head>

     

       15
        
       

     

       16
        
       <body>

     
···

       34
        
         </main>

     

       35
        
       

     

       36
        
         <script type="module" src="../components/auth.ts"></script>

     

       37
       +
         <script type="module" src="./index.ts"></script>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       38
        
       </body>

     

       39
        
       

     

       40
        
       </html>

+14

src/pages/index.ts

···

       1
       +
       document.getElementById("start-btn")?.addEventListener("click", async () => {

     

       2
       +
       	const authComponent = document.querySelector("auth-component");

     

       3
       +
       	if (!authComponent) return;

     

       4
       +
       

     

       5
       +
       	const isLoggedIn = await (

     

       6
       +
       		authComponent as { isAuthenticated: () => Promise<boolean> }

     

       7
       +
       	).isAuthenticated();

     

       8
       +
       

     

       9
       +
       	if (isLoggedIn) {

     

       10
       +
       		window.location.href = "/classes";

     

       11
       +
       	} else {

     

       12
       +
       		(authComponent as { openAuthModal: () => void }).openAuthModal();

     

       13
       +
       	}

     

       14
       +
       });

+18 -129

src/pages/reset-password.html

···

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
        
         <title>Reset Password - Thistle</title>

     

       8
       -
         <link rel="icon"

     

       9
       -
           href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='0.9em' font-size='90'>🪻</text></svg>">

     

       0
        
       
     

       0
        
       
     

       10
        
         <link rel="stylesheet" href="../styles/main.css">

     

       0
        
       
     

       11
        
       </head>

     

       12
        
       

     

       13
        
       <body>

     

       14
       -
         <auth-component></auth-component>

     

       15
       -
         

     

       16
       -
         <main>

     

       17
       -
           <div class="container" style="max-width: 28rem; margin: 4rem auto; padding: 0 1rem;">

     

       18
       -
             <div class="reset-card" style="background: var(--white); border: 1px solid var(--silver); border-radius: 0.5rem; padding: 2rem;">

     

       19
       -
               <h1 style="margin-top: 0; text-align: center;">🪻 Reset Password</h1>

     

       20
       -
               

     

       21
       -
               <div id="form-container">

     

       22
       -
                 <form id="reset-form">

     

       23
       -
                   <div style="margin-bottom: 1.5rem;">

     

       24
       -
                     <label for="password" style="display: block; margin-bottom: 0.5rem; font-weight: 500;">New Password</label>

     

       25
       -
                     <input 

     

       26
       -
                       type="password" 

     

       27
       -
                       id="password" 

     

       28
       -
                       required 

     

       29
       -
                       minlength="8"

     

       30
       -
                       style="width: 100%; padding: 0.75rem; border: 1px solid var(--silver); border-radius: 0.25rem; font-size: 1rem;"

     

       31
       -
                     >

     

       32
       -
                   </div>

     

       33
       -
                   

     

       34
       -
                   <div style="margin-bottom: 1.5rem;">

     

       35
       -
                     <label for="confirm-password" style="display: block; margin-bottom: 0.5rem; font-weight: 500;">Confirm Password</label>

     

       36
       -
                     <input 

     

       37
       -
                       type="password" 

     

       38
       -
                       id="confirm-password" 

     

       39
       -
                       required 

     

       40
       -
                       minlength="8"

     

       41
       -
                       style="width: 100%; padding: 0.75rem; border: 1px solid var(--silver); border-radius: 0.25rem; font-size: 1rem;"

     

       42
       -
                     >

     

       43
       -
                   </div>

     

       44
       -
                   

     

       45
       -
                   <div id="error-message" style="display: none; color: var(--coral); margin-bottom: 1rem; padding: 0.75rem; background: #fef2f2; border-radius: 0.25rem;"></div>

     

       46
       -
                   

     

       47
       -
                   <button 

     

       48
       -
                     type="submit" 

     

       49
       -
                     id="submit-btn"

     

       50
       -
                     style="width: 100%; padding: 0.75rem; background: var(--accent); color: var(--white); border: none; border-radius: 0.25rem; font-size: 1rem; font-weight: 500; cursor: pointer;"

     

       51
       -
                   >

     

       52
       -
                     Reset Password

     

       53
       -
                   </button>

     

       54
       -
                 </form>

     

       55
       -
                 

     

       56
       -
                 <div style="text-align: center; margin-top: 1.5rem;">

     

       57
       -
                   <a href="/" style="color: var(--primary); text-decoration: none;">Back to home</a>

     

       58
       -
                 </div>

     

       59
       -
               </div>

     

       60
       -
               

     

       61
       -
               <div id="success-message" style="display: none; text-align: center;">

     

       62
       -
                 <div style="color: var(--primary); margin-bottom: 1rem;">

     

       63
       -
                   ✓ Password reset successfully!

     

       64
       -
                 </div>

     

       65
       -
                 <a href="/" style="color: var(--accent); font-weight: 500; text-decoration: none;">Go to home</a>

     

       66
       -
               </div>

     

       67
       -
             </div>

     

       68
        
           </div>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       69
        
         </main>

     

       70
        
       

     

       71
        
         <script type="module" src="../components/auth.ts"></script>

     

       72
       -
         <script type="module">

     

       73
       -
           import { hashPasswordClient } from '../lib/client-auth.ts';

     

       74
       -
       

     

       75
       -
           const form = document.getElementById('reset-form');

     

       76
       -
           const passwordInput = document.getElementById('password');

     

       77
       -
           const confirmPasswordInput = document.getElementById('confirm-password');

     

       78
       -
           const submitBtn = document.getElementById('submit-btn');

     

       79
       -
           const errorMessage = document.getElementById('error-message');

     

       80
       -
           const formContainer = document.getElementById('form-container');

     

       81
       -
           const successMessage = document.getElementById('success-message');

     

       82
       -
       

     

       83
       -
           // Get token from URL

     

       84
       -
           const urlParams = new URLSearchParams(window.location.search);

     

       85
       -
           const token = urlParams.get('token');

     

       86
       -
       

     

       87
       -
           if (!token) {

     

       88
       -
             errorMessage.textContent = 'Invalid or missing reset token';

     

       89
       -
             errorMessage.style.display = 'block';

     

       90
       -
             form.style.display = 'none';

     

       91
       -
           }

     

       92
       -
       

     

       93
       -
           form?.addEventListener('submit', async (e) => {

     

       94
       -
             e.preventDefault();

     

       95
       -
             

     

       96
       -
             const password = passwordInput.value;

     

       97
       -
             const confirmPassword = confirmPasswordInput.value;

     

       98
       -
       

     

       99
       -
             // Validate passwords match

     

       100
       -
             if (password !== confirmPassword) {

     

       101
       -
               errorMessage.textContent = 'Passwords do not match';

     

       102
       -
               errorMessage.style.display = 'block';

     

       103
       -
               return;

     

       104
       -
             }

     

       105
       -
       

     

       106
       -
             // Validate password length

     

       107
       -
             if (password.length < 8) {

     

       108
       -
               errorMessage.textContent = 'Password must be at least 8 characters';

     

       109
       -
               errorMessage.style.display = 'block';

     

       110
       -
               return;

     

       111
       -
             }

     

       112
       -
       

     

       113
       -
             errorMessage.style.display = 'none';

     

       114
       -
             submitBtn.disabled = true;

     

       115
       -
             submitBtn.textContent = 'Resetting...';

     

       116
       -
       

     

       117
       -
             try {

     

       118
       -
               // Hash password client-side

     

       119
       -
               const hashedPassword = await hashPasswordClient(password);

     

       120
       -
       

     

       121
       -
               const response = await fetch('/api/auth/reset-password', {

     

       122
       -
                 method: 'POST',

     

       123
       -
                 headers: { 'Content-Type': 'application/json' },

     

       124
       -
                 body: JSON.stringify({ token, password: hashedPassword }),

     

       125
       -
               });

     

       126
       -
       

     

       127
       -
               const data = await response.json();

     

       128
       -
       

     

       129
       -
               if (!response.ok) {

     

       130
       -
                 throw new Error(data.error || 'Failed to reset password');

     

       131
       -
               }

     

       132
       -
       

     

       133
       -
               // Show success message

     

       134
       -
               formContainer.style.display = 'none';

     

       135
       -
               successMessage.style.display = 'block';

     

       136
       -
       

     

       137
       -
             } catch (error) {

     

       138
       -
               errorMessage.textContent = error.message || 'Failed to reset password';

     

       139
       -
               errorMessage.style.display = 'block';

     

       140
       -
               submitBtn.disabled = false;

     

       141
       -
               submitBtn.textContent = 'Reset Password';

     

       142
       -
             }

     

       143
       -
           });

     

       144
       -
         </script>

     

       145
        
       </body>

     

       146
        
       

     

       147
        
       </html>

···

       5
        
         <meta charset="UTF-8">

     

       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
        
         <title>Reset Password - Thistle</title>

     

       8
       +
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
       +
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

     

       10
       +
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       +
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       +
         <link rel="stylesheet" href="../styles/reset-password.css">

     

       14
        
       </head>

     

       15
        
       

     

       16
        
       <body>

     

       17
       +
         <header>

     

       18
       +
           <div class="header-content">

     

       19
       +
             <a href="/" class="site-title">

     

       20
       +
               <img src="../../public/favicon/favicon-32x32.png" alt="Thistle logo">

     

       21
       +
               <span>Thistle</span>

     

       22
       +
             </a>

     

       23
       +
             <auth-component></auth-component>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       24
        
           </div>

     

       25
       +
         </header>

     

       26
       +
       

     

       27
       +
         <main>

     

       28
       +
           <reset-password-form id="reset-form"></reset-password-form>

     

       29
        
         </main>

     

       30
        
       

     

       31
        
         <script type="module" src="../components/auth.ts"></script>

     

       32
       +
         <script type="module" src="../components/reset-password-form.ts"></script>

     

       33
       +
         <script type="module" src="./reset-password.ts"></script>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       34
        
       </body>

     

       35
        
       

     

       36
        
       </html>

+10

src/pages/reset-password.ts

···

       1
       +
       // Wait for component to be defined before setting token

     

       2
       +
       await customElements.whenDefined("reset-password-form");

     

       3
       +
       

     

       4
       +
       // Get token from URL and pass to component

     

       5
       +
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       +
       const token = urlParams.get("token");

     

       7
       +
       const resetForm = document.getElementById("reset-form");

     

       8
       +
       if (resetForm) {

     

       9
       +
       	(resetForm as { token: string | null }).token = token;

     

       10
       +
       }

+1 -6

src/pages/settings.html

···

       10
        
       	<link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
       	<link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
       	<link rel="stylesheet" href="../styles/main.css">

     

       13
       -
       

     

       14
       -
       	<style>

     

       15
       -
       		main {

     

       16
       -
       			max-width: 64rem;

     

       17
       -
       		}

     

       18
       -
       	</style>

     

       19
        
       </head>

     

       20
        
       

     

       21
        
       <body>

···

       10
        
       	<link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
       	<link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
       	<link rel="stylesheet" href="../styles/main.css">

     

       13
       +
       	<link rel="stylesheet" href="../styles/settings.css">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       </head>

     

       15
        
       

     

       16
        
       <body>

+3 -21

src/pages/transcribe.html

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       -
         <style>

     

       14
       -
           .page-header {

     

       15
       -
             text-align: center;

     

       16
       -
             margin-bottom: 3rem;

     

       17
       -
           }

     

       18
       -
       

     

       19
       -
           .page-title {

     

       20
       -
             font-size: 2.5rem;

     

       21
       -
             font-weight: 700;

     

       22
       -
             color: var(--text);

     

       23
       -
             margin-bottom: 0.5rem;

     

       24
       -
           }

     

       25
       -
       

     

       26
       -
           .page-subtitle {

     

       27
       -
             font-size: 1.125rem;

     

       28
       -
             color: var(--text);

     

       29
       -
             opacity: 0.8;

     

       30
       -
           }

     

       31
       -
         </style>

     

       32
        
       </head>

     

       33
        
       

     

       34
        
       <body>

     
···

       43
        
         </header>

     

       44
        
       

     

       45
        
         <main>

     

       46
       -
           <div style="margin-bottom: 1rem;">

     

       47
       -
             <a href="/classes" style="color: var(--paynes-gray); text-decoration: none; font-size: 0.875rem;">

     

       48
        
               ← Back to classes

     

       49
        
             </a>

     

       50
        
           </div>

···

       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       +
         <link rel="stylesheet" href="../styles/transcribe.css">

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       </head>

     

       15
        
       

     

       16
        
       <body>

     
···

       25
        
         </header>

     

       26
        
       

     

       27
        
         <main>

     

       28
       +
           <div class="mb-1">

     

       29
       +
             <a href="/classes" class="back-link">

     

       30
        
               ← Back to classes

     

       31
        
             </a>

     

       32
        
           </div>

+120

src/styles/admin.css

···

       1
       +
       main {

     

       2
       +
       	max-width: 80rem;

     

       3
       +
       	margin: 0 auto;

     

       4
       +
       	padding: 2rem;

     

       5
       +
       }

     

       6
       +
       

     

       7
       +
       h1 {

     

       8
       +
       	margin-bottom: 2rem;

     

       9
       +
       	color: var(--text);

     

       10
       +
       }

     

       11
       +
       

     

       12
       +
       .section {

     

       13
       +
       	margin-bottom: 3rem;

     

       14
       +
       }

     

       15
       +
       

     

       16
       +
       .section-title {

     

       17
       +
       	font-size: 1.5rem;

     

       18
       +
       	font-weight: 600;

     

       19
       +
       	color: var(--text);

     

       20
       +
       	margin-bottom: 1rem;

     

       21
       +
       	display: flex;

     

       22
       +
       	align-items: center;

     

       23
       +
       	gap: 0.5rem;

     

       24
       +
       }

     

       25
       +
       

     

       26
       +
       .tabs {

     

       27
       +
       	display: flex;

     

       28
       +
       	gap: 1rem;

     

       29
       +
       	border-bottom: 2px solid var(--secondary);

     

       30
       +
       	margin-bottom: 2rem;

     

       31
       +
       }

     

       32
       +
       

     

       33
       +
       .tab {

     

       34
       +
       	padding: 0.75rem 1.5rem;

     

       35
       +
       	border: none;

     

       36
       +
       	background: transparent;

     

       37
       +
       	color: var(--text);

     

       38
       +
       	cursor: pointer;

     

       39
       +
       	font-size: 1rem;

     

       40
       +
       	font-weight: 500;

     

       41
       +
       	font-family: inherit;

     

       42
       +
       	border-bottom: 2px solid transparent;

     

       43
       +
       	margin-bottom: -2px;

     

       44
       +
       	transition: all 0.2s;

     

       45
       +
       }

     

       46
       +
       

     

       47
       +
       .tab:hover {

     

       48
       +
       	color: var(--primary);

     

       49
       +
       }

     

       50
       +
       

     

       51
       +
       .tab.active {

     

       52
       +
       	color: var(--primary);

     

       53
       +
       	border-bottom-color: var(--primary);

     

       54
       +
       }

     

       55
       +
       

     

       56
       +
       .tab-content {

     

       57
       +
       	display: none;

     

       58
       +
       }

     

       59
       +
       

     

       60
       +
       .tab-content.active {

     

       61
       +
       	display: block;

     

       62
       +
       }

     

       63
       +
       

     

       64
       +
       .empty-state {

     

       65
       +
       	text-align: center;

     

       66
       +
       	padding: 3rem;

     

       67
       +
       	color: var(--text);

     

       68
       +
       	opacity: 0.6;

     

       69
       +
       }

     

       70
       +
       

     

       71
       +
       .loading {

     

       72
       +
       	text-align: center;

     

       73
       +
       	padding: 3rem;

     

       74
       +
       	color: var(--text);

     

       75
       +
       }

     

       76
       +
       

     

       77
       +
       .error {

     

       78
       +
       	background: #fee2e2;

     

       79
       +
       	color: #991b1b;

     

       80
       +
       	padding: 1rem;

     

       81
       +
       	border-radius: 6px;

     

       82
       +
       	margin-bottom: 1rem;

     

       83
       +
       }

     

       84
       +
       

     

       85
       +
       .stats {

     

       86
       +
       	display: grid;

     

       87
       +
       	grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       +
       	gap: 1rem;

     

       89
       +
       	margin-bottom: 2rem;

     

       90
       +
       }

     

       91
       +
       

     

       92
       +
       .stat-card {

     

       93
       +
       	background: var(--background);

     

       94
       +
       	border: 2px solid var(--secondary);

     

       95
       +
       	border-radius: 8px;

     

       96
       +
       	padding: 1.5rem;

     

       97
       +
       }

     

       98
       +
       

     

       99
       +
       .stat-value {

     

       100
       +
       	font-size: 2rem;

     

       101
       +
       	font-weight: 700;

     

       102
       +
       	color: var(--primary);

     

       103
       +
       	margin-bottom: 0.25rem;

     

       104
       +
       }

     

       105
       +
       

     

       106
       +
       .stat-label {

     

       107
       +
       	color: var(--text);

     

       108
       +
       	opacity: 0.7;

     

       109
       +
       	font-size: 0.875rem;

     

       110
       +
       }

     

       111
       +
       

     

       112
       +
       .timestamp {

     

       113
       +
       	color: var(--text);

     

       114
       +
       	opacity: 0.6;

     

       115
       +
       	font-size: 0.875rem;

     

       116
       +
       }

     

       117
       +
       

     

       118
       +
       .hidden {

     

       119
       +
       	display: none;

     

       120
       +
       }

+71

src/styles/index.css

···

       1
       +
       .hero-title {

     

       2
       +
       	font-size: 3rem;

     

       3
       +
       	font-weight: 700;

     

       4
       +
       	color: var(--text);

     

       5
       +
       	margin-bottom: 1rem;

     

       6
       +
       }

     

       7
       +
       

     

       8
       +
       .hero-subtitle {

     

       9
       +
       	font-size: 1.25rem;

     

       10
       +
       	color: var(--text);

     

       11
       +
       	opacity: 0.8;

     

       12
       +
       	margin-bottom: 2rem;

     

       13
       +
       }

     

       14
       +
       

     

       15
       +
       main {

     

       16
       +
       	text-align: center;

     

       17
       +
       	padding: 4rem 2rem;

     

       18
       +
       }

     

       19
       +
       

     

       20
       +
       .cta-buttons {

     

       21
       +
       	display: flex;

     

       22
       +
       	gap: 1rem;

     

       23
       +
       	justify-content: center;

     

       24
       +
       	margin-top: 2rem;

     

       25
       +
       }

     

       26
       +
       

     

       27
       +
       .btn {

     

       28
       +
       	padding: 0.75rem 1.5rem;

     

       29
       +
       	border-radius: 6px;

     

       30
       +
       	font-size: 1rem;

     

       31
       +
       	font-weight: 500;

     

       32
       +
       	cursor: pointer;

     

       33
       +
       	transition: all 0.2s;

     

       34
       +
       	font-family: inherit;

     

       35
       +
       	border: 2px solid;

     

       36
       +
       	text-decoration: none;

     

       37
       +
       	display: inline-block;

     

       38
       +
       }

     

       39
       +
       

     

       40
       +
       .btn-primary {

     

       41
       +
       	background: var(--primary);

     

       42
       +
       	color: white;

     

       43
       +
       	border-color: var(--primary);

     

       44
       +
       }

     

       45
       +
       

     

       46
       +
       .btn-primary:hover {

     

       47
       +
       	background: transparent;

     

       48
       +
       	color: var(--primary);

     

       49
       +
       }

     

       50
       +
       

     

       51
       +
       .btn-secondary {

     

       52
       +
       	background: transparent;

     

       53
       +
       	color: var(--text);

     

       54
       +
       	border-color: var(--secondary);

     

       55
       +
       }

     

       56
       +
       

     

       57
       +
       .btn-secondary:hover {

     

       58
       +
       	border-color: var(--primary);

     

       59
       +
       	color: var(--primary);

     

       60
       +
       }

     

       61
       +
       

     

       62
       +
       @media (max-width: 640px) {

     

       63
       +
       	.hero-title {

     

       64
       +
       		font-size: 2.5rem;

     

       65
       +
       	}

     

       66
       +
       

     

       67
       +
       	.cta-buttons {

     

       68
       +
       		flex-direction: column;

     

       69
       +
       		align-items: center;

     

       70
       +
       	}

     

       71
       +
       }

src/styles/reset-password.css

···

       1
       +
       main {

     

       2
       +
       	display: flex;

     

       3
       +
       	align-items: center;

     

       4
       +
       	justify-content: center;

     

       5
       +
       	padding: 4rem 1rem;

     

       6
       +
       }

src/styles/settings.css

···

       1
       +
       main {

     

       2
       +
       	max-width: 64rem;

     

       3
       +
       }

+27

src/styles/transcribe.css

···

       1
       +
       .page-header {

     

       2
       +
       	text-align: center;

     

       3
       +
       	margin-bottom: 3rem;

     

       4
       +
       }

     

       5
       +
       

     

       6
       +
       .page-title {

     

       7
       +
       	font-size: 2.5rem;

     

       8
       +
       	font-weight: 700;

     

       9
       +
       	color: var(--text);

     

       10
       +
       	margin-bottom: 0.5rem;

     

       11
       +
       }

     

       12
       +
       

     

       13
       +
       .page-subtitle {

     

       14
       +
       	font-size: 1.125rem;

     

       15
       +
       	color: var(--text);

     

       16
       +
       	opacity: 0.8;

     

       17
       +
       }

     

       18
       +
       

     

       19
       +
       .back-link {

     

       20
       +
       	color: var(--paynes-gray);

     

       21
       +
       	text-decoration: none;

     

       22
       +
       	font-size: 0.875rem;

     

       23
       +
       }

     

       24
       +
       

     

       25
       +
       .mb-1 {

     

       26
       +
       	margin-bottom: 1rem;

     

       27
       +
       }

Compare changes