comparing 692627f4f30612ff0ed99f049551434d9b04cb82 and main on dunkirk.sh/thistle

+24 -10

.env.example

···

       3
       3
        
       # See README for setup instructions

     

       4
       4
        
       WHISPER_SERVICE_URL=http://localhost:8000

     

       5
       5
        
       

     

       6
       6
       -
       # LLM API Configuration (Required for VTT cleaning)

     

       6
       6
       +
       # LLM API Configuration (REQUIRED for VTT cleaning)

     

       7
       7
        
       # Configure your LLM service endpoint and credentials

     

       8
       8
       -
       LLM_API_KEY=your_api_key_here

     

       9
       9
       -
       LLM_API_BASE_URL=https://api.openai.com/v1

     

       10
       10
       -
       LLM_MODEL=gpt-4o-mini

     

       8
       8
       +
       LLM_API_KEY=paste_your_api_key_here

     

       9
       9
       +
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       10
       +
       LLM_MODEL=moonshotai/kimi-k2-0905

     

       11
       11
        
       

     

       12
       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
       13
        
       # In development, these default to localhost values

     
···

       17
       17
        
       # Must match the domain where your app is hosted

     

       18
       18
        
       # RP_ID=thistle.app

     

       19
       19
        
       

     

       20
       20
       -
       # Origin - full URL of your app

     

       20
       20
       +
       # Origin - full URL of your app (RECOMMENDED - used for email links)

     

       21
       21
        
       # Must match exactly where users access your app

     

       22
       22
       -
       # ORIGIN=https://thistle.app

     

       22
       22
       +
       # In production, set this to your public URL

     

       23
       23
       +
       ORIGIN=http://localhost:3000

     

       23
       24
        
       

     

       24
       24
       -
       # Polar.sh payment stuff

     

       25
       25
       +
       # Polar.sh Payment Configuration (REQUIRED)

     

       26
       26
       +
       # Get your organization ID from https://polar.sh/settings

     

       27
       27
       +
       POLAR_ORGANIZATION_ID=paste_your_org_id_here

     

       25
       28
        
       # Get your access token from https://polar.sh/settings (or sandbox.polar.sh for testing)

     

       26
       26
       -
       POLAR_ACCESS_TOKEN=XXX

     

       29
       29
       +
       POLAR_ACCESS_TOKEN=paste_your_polar_token_here

     

       27
       30
        
       # Get product ID from your Polar dashboard (create a product first)

     

       28
       28
       -
       POLAR_PRODUCT_ID=3f1ab9f9-d573-49d4-ac0a-a78bfb06c347

     

       31
       31
       +
       POLAR_PRODUCT_ID=paste_your_product_id_here

     

       29
       32
        
       # Redirect URL after successful checkout (use {CHECKOUT_ID} placeholder)

     

       30
       33
        
       POLAR_SUCCESS_URL=http://localhost:3000/checkout?checkout_id={CHECKOUT_ID}

     

       31
       34
        
       # Webhook secret for verifying Polar webhook signatures (get from Polar dashboard)

     

       32
       32
       -
       POLAR_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxx

     

       35
       35
       +
       POLAR_WEBHOOK_SECRET=paste_your_webhook_secret_here

     

       36
       36
       +
       

     

       37
       37
       +
       # Email Configuration (REQUIRED - MailChannels)

     

       38
       38
       +
       # API key from MailChannels dashboard

     

       39
       39
       +
       MAILCHANNELS_API_KEY=paste_your_mailchannels_api_key_here

     

       40
       40
       +
       # DKIM private key for email authentication (required for sending emails)

     

       41
       41
       +
       # Generate: openssl genrsa -out dkim-private.pem 2048

     

       42
       42
       +
       # Then add TXT record: mailchannels._domainkey.yourdomain.com

     

       43
       43
       +
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nPASTE_YOUR_DKIM_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       44
       44
       +
       DKIM_DOMAIN=yourdomain.com

     

       45
       45
       +
       SMTP_FROM_EMAIL=noreply@yourdomain.com

     

       46
       46
       +
       SMTP_FROM_NAME=Thistle

     

       33
       47
        
       

     

       34
       48
        
       # Environment (set to 'production' in production)

     

       35
       49
        
       NODE_ENV=development

.gitignore

···

       3
       3
        
       uploads/

     

       4
       4
        
       transcripts/

     

       5
       5
        
       .env

     

       6
       6
       +
       *.pem

+154 -1

CRUSH.md

···

       6
       6
        
       

     

       7
       7
        
       **IMPORTANT**: Do NOT commit changes until the user explicitly asks you to commit. Always wait for user verification that changes are working correctly before making commits.

     

       8
       8
        
       

     

       9
       9
       +
       ## Environment Variables

     

       10
       10
       +
       

     

       11
       11
       +
       **CRITICAL**: Always use `process.env.ORIGIN` for generating URLs in emails and links, NOT hardcoded domains.

     

       12
       12
       +
       

     

       13
       13
       +
       - `ORIGIN` - The public URL of the application (e.g., `https://thistle.app` or `http://localhost:3000`)

     

       14
       14
       +
       - Used for: Email verification links, password reset links, any user-facing URLs

     

       15
       15
       +
       - Default: `http://localhost:3000` (development only)

     

       16
       16
       +
       

     

       17
       17
       +
       **Never hardcode domain names** like `https://thistle.app` in code - always use `process.env.ORIGIN`.

     

       18
       18
       +
       

     

       9
       19
        
       ## Project Info

     

       10
       20
        
       

     

       11
       21
        
       - Name: Thistle

     
···

       641
       651
        
       VALUES ('test-sub', <user_id>, 'test-customer', 'active');

     

       642
       652
        
       ```

     

       643
       653
        
       

     

       654
       654
       +
       ## Transcription Service Integration (Murmur)

     

       655
       655
       +
       

     

       656
       656
       +
       The application uses [Murmur](https://github.com/taciturnaxolotl/murmur) as the transcription backend.

     

       657
       657
       +
       

     

       658
       658
       +
       **Murmur API endpoints:**

     

       659
       659
       +
       - `POST /transcribe` - Upload audio file and create transcription job

     

       660
       660
       +
       - `GET /transcribe/:job_id` - Get job status and transcript (supports `?format=json|vtt`)

     

       661
       661
       +
       - `GET /transcribe/:job_id/stream` - Stream real-time progress via Server-Sent Events

     

       662
       662
       +
       - `GET /jobs` - List all jobs (newest first)

     

       663
       663
       +
       - `DELETE /transcribe/:job_id` - Delete a job from Murmur's database

     

       664
       664
       +
       

     

       665
       665
       +
       **Job synchronization:**

     

       666
       666
       +
       The `TranscriptionService` runs periodic syncs to reconcile state between our database and Murmur:

     

       667
       667
       +
       - Reconnects to active jobs on server restart

     

       668
       668
       +
       - Syncs status updates for processing/transcribing jobs

     

       669
       669
       +
       - Handles completed jobs (fetches VTT, cleans transcript, saves to storage)

     

       670
       670
       +
       - **Cleans up finished jobs** - After successful completion or failure, jobs are deleted from Murmur

     

       671
       671
       +
       - **Cleans up orphaned jobs** - Jobs found in Murmur but not in our database are automatically deleted

     

       672
       672
       +
       

     

       673
       673
       +
       **Job cleanup:**

     

       674
       674
       +
       - **Completed jobs**: After fetching transcript and saving to storage, the job is deleted from Murmur

     

       675
       675
       +
       - **Failed jobs**: After recording the error in our database, the job is deleted from Murmur

     

       676
       676
       +
       - **Orphaned jobs**: Jobs in Murmur but not in our database are deleted on discovery

     

       677
       677
       +
       - All deletions use `DELETE /transcribe/:job_id`

     

       678
       678
       +
       - This prevents Murmur's database from accumulating stale jobs (Murmur doesn't have automatic cleanup)

     

       679
       679
       +
       - Logs success/failure of deletion attempts for monitoring

     

       680
       680
       +
       

     

       681
       681
       +
       **Job lifecycle:**

     

       682
       682
       +
       1. User uploads audio → creates transcription in our DB with `status='uploading'`

     

       683
       683
       +
       2. Audio uploaded to Murmur → get `whisper_job_id`, update to `status='processing'`

     

       684
       684
       +
       3. Murmur transcribes → stream progress updates, update to `status='transcribing'`

     

       685
       685
       +
       4. Job completes → fetch VTT, clean with LLM, save transcript, update to `status='completed'`, **delete from Murmur**

     

       686
       686
       +
       5. If job fails in Murmur → update to `status='failed'` with error message, **delete from Murmur**

     

       687
       687
       +
       

     

       688
       688
       +
       **Configuration:**

     

       689
       689
       +
       Set `WHISPER_SERVICE_URL` in `.env` (default: `http://localhost:8000`)

     

       690
       690
       +
       

     

       691
       691
       +
       ## Issue Tracking

     

       692
       692
       +
       

     

       693
       693
       +
       This project uses [Tangled](https://tangled.org) for issue tracking via the `tangled-cli` tool.

     

       694
       694
       +
       

     

       695
       695
       +
       **Installation:**

     

       696
       696
       +
       ```bash

     

       697
       697
       +
       cargo install --git https://tangled.org/vitorpy.com/tangled-cli

     

       698
       698
       +
       ```

     

       699
       699
       +
       

     

       700
       700
       +
       **Authentication:**

     

       701
       701
       +
       ```bash

     

       702
       702
       +
       tangled-cli auth login

     

       703
       703
       +
       ```

     

       704
       704
       +
       

     

       705
       705
       +
       **Creating issues:**

     

       706
       706
       +
       ```bash

     

       707
       707
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --body "Issue description"

     

       708
       708
       +
       

     

       709
       709
       +
       # With labels (if created in the repo):

     

       710
       710
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --label "bug" --label "priority:high" --body "Issue description"

     

       711
       711
       +
       ```

     

       712
       712
       +
       

     

       713
       713
       +
       **Listing issues:**

     

       714
       714
       +
       ```bash

     

       715
       715
       +
       # List all open issues

     

       716
       716
       +
       tangled-cli issue list --repo "thistle"

     

       717
       717
       +
       

     

       718
       718
       +
       # List with specific state

     

       719
       719
       +
       tangled-cli issue list --repo "thistle" --state open

     

       720
       720
       +
       tangled-cli issue list --repo "thistle" --state closed

     

       721
       721
       +
       

     

       722
       722
       +
       # List by label

     

       723
       723
       +
       tangled-cli issue list --repo "thistle" --label "priority: low"

     

       724
       724
       +
       tangled-cli issue list --repo "thistle" --label "bug"

     

       725
       725
       +
       

     

       726
       726
       +
       # List by author

     

       727
       727
       +
       tangled-cli issue list --repo "thistle" --author "username"

     

       728
       728
       +
       

     

       729
       729
       +
       # JSON output format

     

       730
       730
       +
       tangled-cli issue list --repo "thistle" --format json

     

       731
       731
       +
       ```

     

       732
       732
       +
       

     

       733
       733
       +
       **Showing issue details:**

     

       734
       734
       +
       ```bash

     

       735
       735
       +
       # Show specific issue by ID

     

       736
       736
       +
       tangled-cli issue show <issue-id>

     

       737
       737
       +
       

     

       738
       738
       +
       # Show with comments

     

       739
       739
       +
       tangled-cli issue show <issue-id> --comments

     

       740
       740
       +
       

     

       741
       741
       +
       # JSON format

     

       742
       742
       +
       tangled-cli issue show <issue-id> --json

     

       743
       743
       +
       ```

     

       744
       744
       +
       

     

       745
       745
       +
       **Commenting on issues:**

     

       746
       746
       +
       ```bash

     

       747
       747
       +
       tangled-cli issue comment <issue-id> --body "Your comment here"

     

       748
       748
       +
       ```

     

       749
       749
       +
       

     

       750
       750
       +
       **Editing issues:**

     

       751
       751
       +
       ```bash

     

       752
       752
       +
       # Update title

     

       753
       753
       +
       tangled-cli issue edit <issue-id> --title "New title"

     

       754
       754
       +
       

     

       755
       755
       +
       # Update body

     

       756
       756
       +
       tangled-cli issue edit <issue-id> --body "New description"

     

       757
       757
       +
       

     

       758
       758
       +
       # Close an issue

     

       759
       759
       +
       tangled-cli issue edit <issue-id> --state closed

     

       760
       760
       +
       

     

       761
       761
       +
       # Reopen an issue

     

       762
       762
       +
       tangled-cli issue edit <issue-id> --state open

     

       763
       763
       +
       ```

     

       764
       764
       +
       

     

       765
       765
       +
       **Repository commands:**

     

       766
       766
       +
       ```bash

     

       767
       767
       +
       # List your repositories

     

       768
       768
       +
       tangled-cli repo list

     

       769
       769
       +
       

     

       770
       770
       +
       # Show repository details

     

       771
       771
       +
       tangled-cli repo info thistle

     

       772
       772
       +
       

     

       773
       773
       +
       # Create a new repository

     

       774
       774
       +
       tangled-cli repo create --name "repo-name" --description "Description"

     

       775
       775
       +
       ```

     

       776
       776
       +
       

     

       777
       777
       +
       **Viewing issues by priority:**

     

       778
       778
       +
       

     

       779
       779
       +
       The thistle repo uses priority labels:

     

       780
       780
       +
       - `priority: high` - Critical issues that need immediate attention

     

       781
       781
       +
       - `priority: medium` - Important issues to address soon

     

       782
       782
       +
       - `priority: low` - Nice-to-have improvements

     

       783
       783
       +
       

     

       784
       784
       +
       ```bash

     

       785
       785
       +
       # View all low priority issues

     

       786
       786
       +
       tangled-cli issue list --repo "thistle" --label "priority: low" --state open

     

       787
       787
       +
       

     

       788
       788
       +
       # View all high priority issues

     

       789
       789
       +
       tangled-cli issue list --repo "thistle" --label "priority: high" --state open

     

       790
       790
       +
       ```

     

       791
       791
       +
       

     

       792
       792
       +
       **Note:** The repo name for this project is `thistle` (resolves to `dunkirk.sh/thistle` in Tangled). Labels are supported but need to be created in the repository first.

     

       793
       793
       +
       

     

       794
       794
       +
       **Known Issues:**

     

       795
       795
       +
       - The CLI may have decoding issues with some API responses (missing `createdAt` field). If `tangled-cli issue list` fails, you can access issues via the web interface at https://tangled.org/dunkirk.sh/thistle

     

       796
       796
       +
       - For complex filtering or browsing, the web UI may be more reliable than the CLI

     

       797
       797
       +
       

     

       644
       798
        
       ## Future Additions

     

       645
       799
        
       

     

       646
       800
        
       As the codebase grows, document:

     

       647
       801
        
       - Database schema and migrations

     

       648
       802
        
       - API endpoint patterns

     

       649
       803
        
       - Authentication/authorization approach

     

       650
       650
       -
       - Transcription service integration details

     

       651
       804
        
       - Deployment process

     

       652
       805
        
       - Environment variables needed

     

       653
       806

-264

docs/CLASS_SYSTEM_SPEC.md

···

       1
       1
       -
       # Class System Specification

     

       2
       2
       -
       

     

       3
       3
       -
       ## Overview

     

       4
       4
       -
       

     

       5
       5
       -
       Restructure Thistle from individual transcript management to class-based transcript organization. Users will manage transcripts grouped by classes, with scheduled meeting times and selective transcription.

     

       6
       6
       -
       

     

       7
       7
       -
       ## User Flow

     

       8
       8
       -
       

     

       9
       9
       -
       ### 1. Classes Page (Home)

     

       10
       10
       -
       - Replaces the transcript page as the main view after signup

     

       11
       11
       -
       - Displays grid of class cards organized by semester/year

     

       12
       12
       -
       - Each section (semester/year combo) separated by horizontal rules

     

       13
       13
       -
       - Each card shows:

     

       14
       14
       -
         - Course code (e.g., "CS 101")

     

       15
       15
       -
         - Course name (e.g., "Introduction to Computer Science")

     

       16
       16
       -
         - Professor name

     

       17
       17
       -
         - Semester and year (e.g., "Fall 2024")

     

       18
       18
       -
         - Archive indicator (if archived)

     

       19
       19
       -
       - Final card in grid is "Register for Class" with centered plus icon

     

       20
       20
       -
       - Empty state: Only shows register button if user has no classes

     

       21
       21
       -
       

     

       22
       22
       -
       ### 2. Individual Class Page (`/classes/:id`)

     

       23
       23
       -
       - Lists all recordings and transcripts for the class

     

       24
       24
       -
       - Shows meeting schedule (flexible text, e.g., "Monday Lecture", "Wednesday Lab")

     

       25
       25
       -
       - Displays recordings with statuses:

     

       26
       26
       -
         - **Pending**: Uploaded but not selected for transcription

     

       27
       27
       -
         - **Selected**: Marked for transcription by admin

     

       28
       28
       -
         - **Transcribed**: Processing complete, ready to view

     

       29
       29
       -
         - **Failed**: Transcription failed

     

       30
       30
       -
       - Upload button to add new recordings

     

       31
       31
       -
       - Each recording tagged with meeting time

     

       32
       32
       -
       

     

       33
       33
       -
       ### 3. Recording Upload

     

       34
       34
       -
       - Any enrolled student can upload recordings

     

       35
       35
       -
       - Must select which meeting time the recording is for

     

       36
       36
       -
       - Recording enters "pending" state

     

       37
       37
       -
       - Does not auto-transcribe

     

       38
       38
       -
       

     

       39
       39
       -
       ### 4. Admin Workflow

     

       40
       40
       -
       - Admin views pending recordings

     

       41
       41
       -
       - Selects specific recording to transcribe for each meeting

     

       42
       42
       -
       - Only selected recordings get processed

     

       43
       43
       -
       - Can manage classes (create, archive, enrollments)

     

       44
       44
       -
       

     

       45
       45
       -
       ## Database Schema

     

       46
       46
       -
       

     

       47
       47
       -
       ### Classes Table

     

       48
       48
       -
       ```sql

     

       49
       49
       -
       CREATE TABLE classes (

     

       50
       50
       -
         id TEXT PRIMARY KEY,           -- stable random ID (nanoid or similar)

     

       51
       51
       -
         course_code TEXT NOT NULL,     -- e.g., "CS 101"

     

       52
       52
       -
         name TEXT NOT NULL,            -- e.g., "Introduction to Computer Science"

     

       53
       53
       -
         professor TEXT NOT NULL,

     

       54
       54
       -
         semester TEXT NOT NULL,        -- e.g., "Fall", "Spring", "Summer"

     

       55
       55
       -
         year INTEGER NOT NULL,         -- e.g., 2024

     

       56
       56
       -
         archived BOOLEAN DEFAULT FALSE,

     

       57
       57
       -
         created_at INTEGER NOT NULL

     

       58
       58
       -
       );

     

       59
       59
       -
       ```

     

       60
       60
       -
       

     

       61
       61
       -
       ### Class Members Table

     

       62
       62
       -
       ```sql

     

       63
       63
       -
       CREATE TABLE class_members (

     

       64
       64
       -
         class_id TEXT NOT NULL,

     

       65
       65
       -
         user_id TEXT NOT NULL,

     

       66
       66
       -
         enrolled_at INTEGER NOT NULL,

     

       67
       67
       -
         PRIMARY KEY (class_id, user_id),

     

       68
       68
       -
         FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       69
       69
       -
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       70
       70
       -
       );

     

       71
       71
       -
       ```

     

       72
       72
       -
       

     

       73
       73
       -
       ### Meeting Times Table

     

       74
       74
       -
       ```sql

     

       75
       75
       -
       CREATE TABLE meeting_times (

     

       76
       76
       -
         id TEXT PRIMARY KEY,

     

       77
       77
       -
         class_id TEXT NOT NULL,

     

       78
       78
       -
         label TEXT NOT NULL,           -- flexible text: "Monday Lecture", "Wednesday Lab", etc.

     

       79
       79
       -
         created_at INTEGER NOT NULL,

     

       80
       80
       -
         FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE

     

       81
       81
       -
       );

     

       82
       82
       -
       ```

     

       83
       83
       -
       

     

       84
       84
       -
       ### Updated Transcripts Table

     

       85
       85
       -
       ```sql

     

       86
       86
       -
       -- Add new columns to existing transcripts table:

     

       87
       87
       -
       ALTER TABLE transcripts ADD COLUMN class_id TEXT;

     

       88
       88
       -
       ALTER TABLE transcripts ADD COLUMN meeting_time_id TEXT;

     

       89
       89
       -
       ALTER TABLE transcripts ADD COLUMN status TEXT DEFAULT 'pending';

     

       90
       90
       -
       -- status: 'pending' | 'selected' | 'transcribed' | 'failed'

     

       91
       91
       -
       

     

       92
       92
       -
       -- Add foreign keys:

     

       93
       93
       -
       FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE

     

       94
       94
       -
       FOREIGN KEY (meeting_time_id) REFERENCES meeting_times(id) ON DELETE SET NULL

     

       95
       95
       -
       ```

     

       96
       96
       -
       

     

       97
       97
       -
       **Note**: Add indexes for performance:

     

       98
       98
       -
       - `class_members(user_id)` - lookup user's classes

     

       99
       99
       -
       - `class_members(class_id)` - lookup class members

     

       100
       100
       -
       - `transcripts(class_id)` - lookup class transcripts

     

       101
       101
       -
       - `transcripts(status)` - filter by status

     

       102
       102
       -
       - `meeting_times(class_id)` - lookup class schedule

     

       103
       103
       -
       

     

       104
       104
       -
       ## Permissions

     

       105
       105
       -
       

     

       106
       106
       -
       ### Class Access

     

       107
       107
       -
       - Users can only view classes they're enrolled in

     

       108
       108
       -
       - Admins can view all classes

     

       109
       109
       -
       - Non-enrolled users get 403 when accessing `/classes/:id`

     

       110
       110
       -
       

     

       111
       111
       -
       ### Recording Permissions

     

       112
       112
       -
       - **Upload**: Any enrolled student can upload recordings

     

       113
       113
       -
       - **Delete**: Students can delete their own recordings

     

       114
       114
       -
       - **Select for transcription**: Admin only

     

       115
       115
       -
       - **View**: All enrolled students can view all transcripts in their classes

     

       116
       116
       -
       

     

       117
       117
       -
       ### Class Management

     

       118
       118
       -
       - **Create**: Admin only (via admin UI)

     

       119
       119
       -
       - **Archive**: Admin only (via admin UI)

     

       120
       120
       -
       - **Enroll students**: Admin only (via admin UI)

     

       121
       121
       -
       - **Remove students**: Admin only (via admin UI)

     

       122
       122
       -
       

     

       123
       123
       -
       ## Archive Behavior

     

       124
       124
       -
       

     

       125
       125
       -
       When a class is archived:

     

       126
       126
       -
       - Students can still view the class and all transcripts

     

       127
       127
       -
       - No new recordings can be uploaded

     

       128
       128
       -
       - No recordings can be deleted

     

       129
       129
       -
       - No transcription selection allowed

     

       130
       130
       -
       - No enrollment changes

     

       131
       131
       -
       - Class appears with archive indicator in UI

     

       132
       132
       -
       - Organized with active classes by semester/year

     

       133
       133
       -
       

     

       134
       134
       -
       ## API Endpoints

     

       135
       135
       -
       

     

       136
       136
       -
       ### Classes

     

       137
       137
       -
       - `GET /api/classes` - List user's classes (grouped by semester/year)

     

       138
       138
       -
       - `GET /api/classes/:id` - Get class details (info, meeting times, transcripts)

     

       139
       139
       -
       - `POST /api/classes` (admin) - Create new class

     

       140
       140
       -
       - `PUT /api/classes/:id/archive` (admin) - Archive/unarchive class

     

       141
       141
       -
       - `DELETE /api/classes/:id` (admin) - Delete class

     

       142
       142
       -
       

     

       143
       143
       -
       ### Class Members

     

       144
       144
       -
       - `POST /api/classes/:id/members` (admin) - Enroll student(s)

     

       145
       145
       -
       - `DELETE /api/classes/:id/members/:userId` (admin) - Remove student

     

       146
       146
       -
       - `GET /api/classes/:id/members` (admin) - List class members

     

       147
       147
       -
       

     

       148
       148
       -
       ### Meeting Times

     

       149
       149
       -
       - `GET /api/classes/:id/meetings` - List meeting times

     

       150
       150
       -
       - `POST /api/classes/:id/meetings` (admin) - Create meeting time

     

       151
       151
       -
       - `PUT /api/meetings/:id` (admin) - Update meeting time label

     

       152
       152
       -
       - `DELETE /api/meetings/:id` (admin) - Delete meeting time

     

       153
       153
       -
       

     

       154
       154
       -
       ### Recordings/Transcripts

     

       155
       155
       -
       - `GET /api/classes/:id/transcripts` - List all transcripts for class

     

       156
       156
       -
       - `POST /api/classes/:id/recordings` - Upload recording (enrolled students)

     

       157
       157
       -
       - `PUT /api/transcripts/:id/select` (admin) - Mark recording for transcription

     

       158
       158
       -
       - `DELETE /api/transcripts/:id` - Delete recording (owner or admin)

     

       159
       159
       -
       - `GET /api/transcripts/:id` - View transcript (enrolled students)

     

       160
       160
       -
       

     

       161
       161
       -
       ## Frontend Components

     

       162
       162
       -
       

     

       163
       163
       -
       ### Pages

     

       164
       164
       -
       - `/classes` - Classes grid (home page, replaces transcripts page)

     

       165
       165
       -
       - `/classes/:id` - Individual class view

     

       166
       166
       -
       - `/admin` - Update to include class management

     

       167
       167
       -
       

     

       168
       168
       -
       ### New Components

     

       169
       169
       -
       - `class-card.ts` - Class card component

     

       170
       170
       -
       - `register-card.ts` - Register for class card (plus icon)

     

       171
       171
       -
       - `class-detail.ts` - Individual class page

     

       172
       172
       -
       - `recording-upload.ts` - Recording upload form

     

       173
       173
       -
       - `recording-list.ts` - List of recordings with status

     

       174
       174
       -
       - `admin-classes.ts` - Admin class management interface

     

       175
       175
       -
       

     

       176
       176
       -
       ### Navigation Updates

     

       177
       177
       -
       - Remove transcript page links

     

       178
       178
       -
       - Add classes link (make it home)

     

       179
       179
       -
       - Update auth redirect after signup to `/classes`

     

       180
       180
       -
       

     

       181
       181
       -
       ## Migration Strategy

     

       182
       182
       -
       

     

       183
       183
       -
       **Breaking change**: Reset database schema to consolidate all migrations.

     

       184
       184
       -
       

     

       185
       185
       -
       1. Export any critical production data (if needed)

     

       186
       186
       -
       2. Drop all tables

     

       187
       187
       -
       3. Consolidate migrations in `src/db/schema.ts`:

     

       188
       188
       -
          - Include all previous migrations

     

       189
       189
       -
          - Add new class system tables

     

       190
       190
       -
          - Add new columns to transcripts

     

       191
       191
       -
       4. Restart with version 1

     

       192
       192
       -
       5. Existing transcripts will be lost (acceptable for this phase)

     

       193
       193
       -
       

     

       194
       194
       -
       ## Admin UI Updates

     

       195
       195
       -
       

     

       196
       196
       -
       ### Class Management Tab

     

       197
       197
       -
       - Create new class form:

     

       198
       198
       -
         - Course code

     

       199
       199
       -
         - Course name

     

       200
       200
       -
         - Professor

     

       201
       201
       -
         - Semester dropdown (Fall/Spring/Summer/Winter)

     

       202
       202
       -
         - Year input

     

       203
       203
       -
       - List all classes (with archive status)

     

       204
       204
       -
       - Archive/unarchive button per class

     

       205
       205
       -
       - Delete class button

     

       206
       206
       -
       

     

       207
       207
       -
       ### Enrollment Management

     

       208
       208
       -
       - Search for class

     

       209
       209
       -
       - Add student by email

     

       210
       210
       -
       - Remove enrolled students

     

       211
       211
       -
       - View enrollment list per class

     

       212
       212
       -
       - Future: Bulk CSV import

     

       213
       213
       -
       

     

       214
       214
       -
       ### Recording Selection

     

       215
       215
       -
       - View pending recordings per class

     

       216
       216
       -
       - Select recording to transcribe for each meeting

     

       217
       217
       -
       - View transcription status

     

       218
       218
       -
       - Handle failed transcriptions

     

       219
       219
       -
       

     

       220
       220
       -
       ## Empty States

     

       221
       221
       -
       

     

       222
       222
       -
       - **No classes**: Show only register card with message "No classes yet"

     

       223
       223
       -
       - **No recordings in class**: Show message "No recordings yet" with upload button

     

       224
       224
       -
       - **No pending recordings**: Show message in admin "All recordings processed"

     

       225
       225
       -
       

     

       226
       226
       -
       ## Future Enhancements (Out of Scope)

     

       227
       227
       -
       

     

       228
       228
       -
       - Share/enrollment links for self-enrollment

     

       229
       229
       -
       - Notifications when transcripts ready

     

       230
       230
       -
       - Auto-transcribe settings per class

     

       231
       231
       -
       - Student/instructor roles

     

       232
       232
       -
       - Search/filter classes

     

       233
       233
       -
       - Bulk enrollment via CSV

     

       234
       234
       -
       - Meeting time templates (MWF, TTh patterns)

     

       235
       235
       -
       - Download all transcripts for a class

     

       236
       236
       -
       

     

       237
       237
       -
       ## Open Questions

     

       238
       238
       -
       

     

       239
       239
       -
       None - spec is complete for initial implementation.

     

       240
       240
       -
       

     

       241
       241
       -
       ## Implementation Phases

     

       242
       242
       -
       

     

       243
       243
       -
       ### Phase 1: Database & Backend

     

       244
       244
       -
       1. Consolidate migrations and add new schema

     

       245
       245
       -
       2. Add API endpoints for classes and members

     

       246
       246
       -
       3. Update permissions middleware

     

       247
       247
       -
       4. Add admin endpoints

     

       248
       248
       -
       

     

       249
       249
       -
       ### Phase 2: Admin UI

     

       250
       250
       -
       1. Class management interface

     

       251
       251
       -
       2. Enrollment management

     

       252
       252
       -
       3. Recording selection interface

     

       253
       253
       -
       

     

       254
       254
       -
       ### Phase 3: Student UI

     

       255
       255
       -
       1. Classes page with cards

     

       256
       256
       -
       2. Individual class pages

     

       257
       257
       -
       3. Recording upload

     

       258
       258
       -
       4. Update navigation

     

       259
       259
       -
       

     

       260
       260
       -
       ### Phase 4: Testing & Polish

     

       261
       261
       -
       1. Test permissions thoroughly

     

       262
       262
       -
       2. Test archive behavior

     

       263
       263
       -
       3. Empty states

     

       264
       264
       -
       4. Error handling

+28 -28

package.json

···

       1
       1
        
       {

     

       2
       2
       -
         "name": "thistle",

     

       3
       3
       -
         "module": "src/index.ts",

     

       4
       4
       -
         "type": "module",

     

       5
       5
       -
         "private": true,

     

       6
       6
       -
         "scripts": {

     

       7
       7
       -
           "dev": "bun run src/index.ts --hot",

     

       8
       8
       -
           "clean": "rm -rf transcripts uploads thistle.db",

     

       9
       9
       -
           "test": "bun test",

     

       10
       10
       -
           "test:integration": "bun test src/index.test.ts",

     

       11
       11
       -
           "ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       12
       -
         },

     

       13
       13
       -
         "devDependencies": {

     

       14
       14
       -
           "@biomejs/biome": "^2.3.2",

     

       15
       15
       -
           "@simplewebauthn/types": "^12.0.0",

     

       16
       16
       -
           "@types/bun": "latest"

     

       17
       17
       -
         },

     

       18
       18
       -
         "peerDependencies": {

     

       19
       19
       -
           "typescript": "^5"

     

       20
       20
       -
         },

     

       21
       21
       -
         "dependencies": {

     

       22
       22
       -
           "@polar-sh/sdk": "^0.41.5",

     

       23
       23
       -
           "@simplewebauthn/browser": "^13.2.2",

     

       24
       24
       -
           "@simplewebauthn/server": "^13.2.2",

     

       25
       25
       -
           "eventsource-client": "^1.2.0",

     

       26
       26
       -
           "lit": "^3.3.1",

     

       27
       27
       -
           "nanoid": "^5.1.6",

     

       28
       28
       -
           "ua-parser-js": "^2.0.6"

     

       29
       29
       -
         }

     

       2
       2
       +
       	"name": "thistle",

     

       3
       3
       +
       	"module": "src/index.ts",

     

       4
       4
       +
       	"type": "module",

     

       5
       5
       +
       	"private": true,

     

       6
       6
       +
       	"scripts": {

     

       7
       7
       +
       		"dev": "bun run src/index.ts --hot",

     

       8
       8
       +
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       9
       +
       		"test": "NODE_ENV=test bun test",

     

       10
       10
       +
       		"test:integration": "NODE_ENV=test bun test src/index.test.ts",

     

       11
       11
       +
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       12
       +
       	},

     

       13
       13
       +
       	"devDependencies": {

     

       14
       14
       +
       		"@biomejs/biome": "^2.3.2",

     

       15
       15
       +
       		"@simplewebauthn/types": "^12.0.0",

     

       16
       16
       +
       		"@types/bun": "latest"

     

       17
       17
       +
       	},

     

       18
       18
       +
       	"peerDependencies": {

     

       19
       19
       +
       		"typescript": "^5"

     

       20
       20
       +
       	},

     

       21
       21
       +
       	"dependencies": {

     

       22
       22
       +
       		"@polar-sh/sdk": "^0.41.5",

     

       23
       23
       +
       		"@simplewebauthn/browser": "^13.2.2",

     

       24
       24
       +
       		"@simplewebauthn/server": "^13.2.2",

     

       25
       25
       +
       		"eventsource-client": "^1.2.0",

     

       26
       26
       +
       		"lit": "^3.3.1",

     

       27
       27
       +
       		"nanoid": "^5.1.6",

     

       28
       28
       +
       		"ua-parser-js": "^2.0.6"

     

       29
       29
       +
       	}

     

       30
       30
        
       }

+19 -1

public/favicon/site.webmanifest

···

       1
       1
       -
       {"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}
     

       1
       1
       +
       {

     

       2
       2
       +
       	"name": "",

     

       3
       3
       +
       	"short_name": "",

     

       4
       4
       +
       	"icons": [

     

       5
       5
       +
       		{

     

       6
       6
       +
       			"src": "/android-chrome-192x192.png",

     

       7
       7
       +
       			"sizes": "192x192",

     

       8
       8
       +
       			"type": "image/png"

     

       9
       9
       +
       		},

     

       10
       10
       +
       		{

     

       11
       11
       +
       			"src": "/android-chrome-512x512.png",

     

       12
       12
       +
       			"sizes": "512x512",

     

       13
       13
       +
       			"type": "image/png"

     

       14
       14
       +
       		}

     

       15
       15
       +
       	],

     

       16
       16
       +
       	"theme_color": "#ffffff",

     

       17
       17
       +
       	"background_color": "#ffffff",

     

       18
       18
       +
       	"display": "standalone"

     

       19
       19
       +
       }

+17

scripts/clear-rate-limits.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       console.log("🧹 Clearing all rate limit attempts...");

     

       6
       6
       +
       

     

       7
       7
       +
       const result = db.run("DELETE FROM rate_limit_attempts");

     

       8
       8
       +
       

     

       9
       9
       +
       const deletedCount = result.changes;

     

       10
       10
       +
       

     

       11
       11
       +
       if (deletedCount === 0) {

     

       12
       12
       +
       	console.log("ℹ️  No rate limit attempts to clear");

     

       13
       13
       +
       } else {

     

       14
       14
       +
       	console.log(

     

       15
       15
       +
       		`✅ Successfully cleared ${deletedCount} rate limit attempt${deletedCount === 1 ? "" : "s"}`,

     

       16
       16
       +
       	);

     

       17
       17
       +
       }

+39

scripts/remove-from-classes.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       const email = process.argv[2];

     

       6
       6
       +
       

     

       7
       7
       +
       if (!email) {

     

       8
       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       10
       +
       	process.exit(1);

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       const user = db

     

       14
       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       16
       +
       	)

     

       17
       17
       +
       	.get(email);

     

       18
       18
       +
       

     

       19
       19
       +
       if (!user) {

     

       20
       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       21
       +
       	process.exit(1);

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // Get current enrollments

     

       25
       25
       +
       const enrollments = db

     

       26
       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       28
       +
       	)

     

       29
       29
       +
       	.all(user.id);

     

       30
       30
       +
       

     

       31
       31
       +
       if (enrollments.length === 0) {

     

       32
       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       33
       +
       	process.exit(0);

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Remove from all classes

     

       37
       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       38
       +
       

     

       39
       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+70

scripts/send-test-emails.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Send test emails to preview all email templates

     

       3
       3
       +
        * Usage: bun scripts/send-test-emails.ts <email>

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       import { sendEmail } from "../src/lib/email";

     

       7
       7
       +
       import {

     

       8
       8
       +
       	passwordResetTemplate,

     

       9
       9
       +
       	transcriptionCompleteTemplate,

     

       10
       10
       +
       	verifyEmailTemplate,

     

       11
       11
       +
       } from "../src/lib/email-templates";

     

       12
       12
       +
       

     

       13
       13
       +
       const targetEmail = process.argv[2];

     

       14
       14
       +
       

     

       15
       15
       +
       if (!targetEmail) {

     

       16
       16
       +
       	console.error("Usage: bun scripts/send-test-emails.ts <email>");

     

       17
       17
       +
       	process.exit(1);

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       async function sendTestEmails() {

     

       21
       21
       +
       	console.log(`Sending test emails to ${targetEmail}...`);

     

       22
       22
       +
       

     

       23
       23
       +
       	try {

     

       24
       24
       +
       		// 1. Email verification

     

       25
       25
       +
       		console.log("\n[1/3] Sending email verification...");

     

       26
       26
       +
       		await sendEmail({

     

       27
       27
       +
       			to: targetEmail,

     

       28
       28
       +
       			subject: "Test: Verify your email - Thistle",

     

       29
       29
       +
       			html: verifyEmailTemplate({

     

       30
       30
       +
       				name: "Test User",

     

       31
       31
       +
       				code: "123456",

     

       32
       32
       +
       				token: "test-token-abc123",

     

       33
       33
       +
       			}),

     

       34
       34
       +
       		});

     

       35
       35
       +
       		console.log("✓ Email verification sent");

     

       36
       36
       +
       

     

       37
       37
       +
       		// 2. Password reset

     

       38
       38
       +
       		console.log("\n[2/3] Sending password reset...");

     

       39
       39
       +
       		await sendEmail({

     

       40
       40
       +
       			to: targetEmail,

     

       41
       41
       +
       			subject: "Test: Reset your password - Thistle",

     

       42
       42
       +
       			html: passwordResetTemplate({

     

       43
       43
       +
       				name: "Test User",

     

       44
       44
       +
       				resetLink: "https://thistle.app/reset-password?token=test-token-xyz789",

     

       45
       45
       +
       			}),

     

       46
       46
       +
       		});

     

       47
       47
       +
       		console.log("✓ Password reset sent");

     

       48
       48
       +
       

     

       49
       49
       +
       		// 3. Transcription complete

     

       50
       50
       +
       		console.log("\n[3/3] Sending transcription complete...");

     

       51
       51
       +
       		await sendEmail({

     

       52
       52
       +
       			to: targetEmail,

     

       53
       53
       +
       			subject: "Test: Transcription complete - Thistle",

     

       54
       54
       +
       			html: transcriptionCompleteTemplate({

     

       55
       55
       +
       				name: "Test User",

     

       56
       56
       +
       				originalFilename: "lecture-2024-11-22.m4a",

     

       57
       57
       +
       				transcriptLink: "https://thistle.app/transcriptions/123",

     

       58
       58
       +
       				className: "Introduction to Computer Science",

     

       59
       59
       +
       			}),

     

       60
       60
       +
       		});

     

       61
       61
       +
       		console.log("✓ Transcription complete sent");

     

       62
       62
       +
       

     

       63
       63
       +
       		console.log("\n✅ All test emails sent successfully!");

     

       64
       64
       +
       	} catch (error) {

     

       65
       65
       +
       		console.error("\n❌ Error sending emails:", error);

     

       66
       66
       +
       		process.exit(1);

     

       67
       67
       +
       	}

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       sendTestEmails();

+260 -29

src/components/admin-classes.ts

···

       12
       12
        
       	year: number;

     

       13
       13
        
       	archived: boolean;

     

       14
       14
        
       	created_at: number;

     

       15
       15
       +
       	student_count?: number;

     

       16
       16
       +
       	transcript_count?: number;

     

       15
       17
        
       }

     

       16
       18
        
       

     

       17
       19
        
       interface WaitlistEntry {

     
···

       38
       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       39
       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       40
       42
        
       	@state() showModal = false;

     

       43
       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       47
       +
       	@state() newSectionNumber = "";

     

       41
       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       49
       +
       	@state() sections: string[] = [];

     

       42
       50
        
       	@state() editingClass = {

     

       43
       51
        
       		courseCode: "",

     

       44
       52
        
       		courseName: "",

     
···

       227
       235
        
             color: var(--paynes-gray);

     

       228
       236
        
           }

     

       229
       237
        
       

     

       230
       230
       -
           .error-message {

     

       231
       231
       -
             background: #fee2e2;

     

       232
       232
       -
             color: #991b1b;

     

       238
       238
       +
           .error-banner {

     

       239
       239
       +
             background: #fecaca;

     

       240
       240
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       241
       241
       +
             border-radius: 6px;

     

       233
       242
        
             padding: 1rem;

     

       234
       234
       -
             border-radius: 6px;

     

       235
       235
       -
             margin-bottom: 1rem;

     

       243
       243
       +
             margin-bottom: 1.5rem;

     

       244
       244
       +
             color: #dc2626;

     

       245
       245
       +
             font-weight: 500;

     

       236
       246
        
           }

     

       237
       247
        
       

     

       238
       248
        
           .tabs {

     
···

       463
       473
        
       

     

       464
       474
        
       	override async connectedCallback() {

     

       465
       475
        
       		super.connectedCallback();

     

       476
       476
       +
       

     

       477
       477
       +
       		// Check for subtab query parameter

     

       478
       478
       +
       		const params = new URLSearchParams(window.location.search);

     

       479
       479
       +
       		const subtab = params.get("subtab");

     

       480
       480
       +
       		if (subtab && this.isValidSubtab(subtab)) {

     

       481
       481
       +
       			this.activeTab = subtab as "classes" | "waitlist";

     

       482
       482
       +
       		} else {

     

       483
       483
       +
       			// Set default subtab in URL if on classes tab

     

       484
       484
       +
       			this.setActiveTab(this.activeTab);

     

       485
       485
       +
       		}

     

       486
       486
       +
       

     

       466
       487
        
       		await this.loadData();

     

       467
       488
        
       	}

     

       468
       489
        
       

     

       490
       490
       +
       	private isValidSubtab(subtab: string): boolean {

     

       491
       491
       +
       		return ["classes", "waitlist"].includes(subtab);

     

       492
       492
       +
       	}

     

       493
       493
       +
       

     

       494
       494
       +
       	private setActiveTab(tab: "classes" | "waitlist") {

     

       495
       495
       +
       		this.activeTab = tab;

     

       496
       496
       +
       		// Update URL without reloading page

     

       497
       497
       +
       		const url = new URL(window.location.href);

     

       498
       498
       +
       		url.searchParams.set("subtab", tab);

     

       499
       499
       +
       		window.history.pushState({}, "", url);

     

       500
       500
       +
       	}

     

       501
       501
       +
       

     

       469
       502
        
       	private async loadData() {

     

       470
       503
        
       		this.isLoading = true;

     

       471
       504
        
       		this.error = "";

     
···

       483
       516
        
       			const classesData = await classesRes.json();

     

       484
       517
        
       			const waitlistData = await waitlistRes.json();

     

       485
       518
        
       

     

       486
       486
       -
       			this.classes = classesData.classes || [];

     

       519
       519
       +
       			// Flatten grouped classes into array

     

       520
       520
       +
       			const groupedClasses = classesData.classes || {};

     

       521
       521
       +
       			this.classes = Object.values(groupedClasses).flat();

     

       487
       522
        
       			this.waitlist = waitlistData.waitlist || [];

     

       488
       523
        
       		} catch {

     

       489
       524
        
       			this.error = "Failed to load data. Please try again.";

     
···

       499
       534
        
       	private async handleToggleArchive(classId: string) {

     

       500
       535
        
       		try {

     

       501
       536
        
       			// Find the class to toggle its archived state

     

       502
       502
       -
       			const classToToggle = this.classes.find(c => c.id === classId);

     

       537
       537
       +
       			const classToToggle = this.classes.find((c) => c.id === classId);

     

       503
       538
        
       			if (!classToToggle) return;

     

       504
       539
        
       

     

       505
       540
        
       			const response = await fetch(`/api/classes/${classId}/archive`, {

     
···

       513
       548
        
       			}

     

       514
       549
        
       

     

       515
       550
        
       			// Update local state instead of reloading

     

       516
       516
       -
       			this.classes = this.classes.map(c => 

     

       517
       517
       -
       				c.id === classId ? { ...c, archived: !c.archived } : c

     

       551
       551
       +
       			this.classes = this.classes.map((c) =>

     

       552
       552
       +
       				c.id === classId ? { ...c, archived: !c.archived } : c,

     

       518
       553
        
       			);

     

       519
       554
        
       		} catch {

     

       520
       555
        
       			this.error = "Failed to update class. Please try again.";

     
···

       635
       670
        
       		this.showModal = true;

     

       636
       671
        
       	}

     

       637
       672
        
       

     

       673
       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       674
       +
       		try {

     

       675
       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       677
       +
       			

     

       678
       678
       +
       			const data = await response.json();

     

       679
       679
       +
       			this.editingClassId = classId;

     

       680
       680
       +
       			this.editingClassInfo = data.class;

     

       681
       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       682
       +
       			this.newSectionNumber = "";

     

       683
       683
       +
       			this.showClassSettingsModal = true;

     

       684
       684
       +
       		} catch {

     

       685
       685
       +
       			this.error = "Failed to load class details";

     

       686
       686
       +
       		}

     

       687
       687
       +
       	}

     

       688
       688
       +
       

     

       689
       689
       +
       	private async handleAddSection() {

     

       690
       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       691
       +
       

     

       692
       692
       +
       		try {

     

       693
       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       694
       +
       				method: "POST",

     

       695
       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       697
       +
       			});

     

       698
       698
       +
       

     

       699
       699
       +
       			if (!response.ok) {

     

       700
       700
       +
       				const data = await response.json();

     

       701
       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       702
       +
       				return;

     

       703
       703
       +
       			}

     

       704
       704
       +
       

     

       705
       705
       +
       			const newSection = await response.json();

     

       706
       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       707
       +
       			this.newSectionNumber = "";

     

       708
       708
       +
       		} catch {

     

       709
       709
       +
       			this.error = "Failed to add section";

     

       710
       710
       +
       		}

     

       711
       711
       +
       	}

     

       712
       712
       +
       

     

       713
       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       714
       +
       		if (!this.editingClassId) return;

     

       715
       715
       +
       

     

       716
       716
       +
       		try {

     

       717
       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       718
       +
       				method: "DELETE",

     

       719
       719
       +
       			});

     

       720
       720
       +
       

     

       721
       721
       +
       			if (!response.ok) {

     

       722
       722
       +
       				const data = await response.json();

     

       723
       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       724
       +
       				return;

     

       725
       725
       +
       			}

     

       726
       726
       +
       

     

       727
       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       728
       +
       		} catch {

     

       729
       729
       +
       			this.error = "Failed to delete section";

     

       730
       730
       +
       		}

     

       731
       731
       +
       	}

     

       732
       732
       +
       

     

       733
       733
       +
       	private handleCloseSectionsModal() {

     

       734
       734
       +
       		this.showClassSettingsModal = false;

     

       735
       735
       +
       		this.editingClassId = null;

     

       736
       736
       +
       		this.editingClassInfo = null;

     

       737
       737
       +
       		this.editingClassSections = [];

     

       738
       738
       +
       		this.newSectionNumber = "";

     

       739
       739
       +
       		this.loadData();

     

       740
       740
       +
       	}

     

       741
       741
       +
       

     

       742
       742
       +
       

     

       638
       743
        
       	private getFilteredClasses() {

     

       639
       744
        
       		if (!this.searchTerm) return this.classes;

     

       640
       745
        
       

     
···

       656
       761
        
       		const filteredClasses = this.getFilteredClasses();

     

       657
       762
        
       

     

       658
       763
        
       		return html`

     

       659
       659
       -
             ${this.error ? html`<div class="error-message">${this.error}</div>` : ""}

     

       764
       764
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       660
       765
        
       

     

       661
       766
        
             <div class="tabs">

     

       662
       767
        
               <button

     

       663
       768
        
                 class="tab ${this.activeTab === "classes" ? "active" : ""}"

     

       664
       769
        
                 @click=${() => {

     

       665
       665
       -
       						this.activeTab = "classes";

     

       770
       770
       +
       						this.setActiveTab("classes");

     

       666
       771
        
       					}}

     

       667
       772
        
               >

     

       668
       773
        
                 Classes

     
···

       670
       775
        
               <button

     

       671
       776
        
                 class="tab ${this.activeTab === "waitlist" ? "active" : ""}"

     

       672
       777
        
                 @click=${() => {

     

       673
       673
       -
       						this.activeTab = "waitlist";

     

       778
       778
       +
       						this.setActiveTab("waitlist");

     

       674
       779
        
       					}}

     

       675
       780
        
               >

     

       676
       781
        
                 Waitlist

     
···

       685
       790
        
       			}

     

       686
       791
        
       

     

       687
       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       688
       794
        
           `;

     

       689
       795
        
       	}

     

       690
       796
        
       

     
···

       714
       820
        
                 <div class="classes-grid">

     

       715
       821
        
                   ${filteredClasses.map(

     

       716
       822
        
       							(cls) => html`

     

       717
       717
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       823
       823
       +
                     <div 

     

       824
       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       826
       +
                       style="cursor: pointer;"

     

       827
       827
       +
                     >

     

       718
       828
        
                       <div class="class-header">

     

       719
       829
        
                         <div class="class-info">

     

       720
       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       722
       832
        
                           <div class="class-meta">

     

       723
       833
        
                             <span>👤 ${cls.professor}</span>

     

       724
       834
        
                             <span>📅 ${cls.semester} ${cls.year}</span>

     

       835
       835
       +
                             <span>👥 ${cls.student_count || 0} students</span>

     

       836
       836
       +
                             <span>📄 ${cls.transcript_count || 0} transcripts</span>

     

       725
       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       726
       838
        
                           </div>

     

       727
       839
        
                         </div>

     

       728
       728
       -
                         <div class="actions">

     

       729
       729
       -
                           <button

     

       730
       730
       -
                             class="btn-archive"

     

       731
       731
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       732
       732
       -
                           >

     

       733
       733
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       734
       734
       -
                           </button>

     

       735
       735
       -
                           <button

     

       736
       736
       -
                             class="btn-delete"

     

       737
       737
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       738
       738
       -
                           >

     

       739
       739
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       740
       740
       -
                           </button>

     

       741
       741
       -
                         </div>

     

       742
       840
        
                       </div>

     

       743
       841
        
                     </div>

     

       744
       842
        
                   `,

     
···

       749
       847
        
           `;

     

       750
       848
        
       	}

     

       751
       849
        
       

     

       850
       850
       +
       	private renderClassSettingsModal() {

     

       851
       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       852
       +
       

     

       853
       853
       +
       		return html`

     

       854
       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       856
       +
                 <div class="modal-header">

     

       857
       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       859
       +
                 </div>

     

       860
       860
       +
       

     

       861
       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       863
       +
                     <button

     

       864
       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       865
       +
                     >

     

       866
       866
       +
                       Sections

     

       867
       867
       +
                     </button>

     

       868
       868
       +
                   </div>

     

       869
       869
       +
                 </div>

     

       870
       870
       +
       

     

       871
       871
       +
                 <!-- Sections Tab -->

     

       872
       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       874
       +
                   

     

       875
       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       876
       +
                     <input

     

       877
       877
       +
                       type="text"

     

       878
       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       879
       +
                       .value=${this.newSectionNumber}

     

       880
       880
       +
                       @input=${(e: Event) => {

     

       881
       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       882
       +
       								}}

     

       883
       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       884
       +
       									if (e.key === "Enter") {

     

       885
       885
       +
       										e.preventDefault();

     

       886
       886
       +
       										this.handleAddSection();

     

       887
       887
       +
       									}

     

       888
       888
       +
       								}}

     

       889
       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       890
       +
                     />

     

       891
       891
       +
                     <button

     

       892
       892
       +
                       @click=${this.handleAddSection}

     

       893
       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       895
       +
                     >

     

       896
       896
       +
                       Add Section

     

       897
       897
       +
                     </button>

     

       898
       898
       +
                   </div>

     

       899
       899
       +
       

     

       900
       900
       +
                   ${

     

       901
       901
       +
       							this.editingClassSections.length === 0

     

       902
       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       903
       +
       								: html`

     

       904
       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       905
       +
                         ${this.editingClassSections.map(

     

       906
       906
       +
       										(section) => html`

     

       907
       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       909
       +
                             <button

     

       910
       910
       +
                               @click=${(e: Event) => {

     

       911
       911
       +
       													e.stopPropagation();

     

       912
       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       913
       +
       												}}

     

       914
       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       915
       +
                             >

     

       916
       916
       +
                               Delete

     

       917
       917
       +
                             </button>

     

       918
       918
       +
                           </div>

     

       919
       919
       +
                         `,

     

       920
       920
       +
       									)}

     

       921
       921
       +
                       </div>

     

       922
       922
       +
                     `

     

       923
       923
       +
       						}

     

       924
       924
       +
                 </div>

     

       925
       925
       +
       

     

       926
       926
       +
                 <!-- Actions -->

     

       927
       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       929
       +
                     <button

     

       930
       930
       +
                       @click=${(e: Event) => {

     

       931
       931
       +
       									e.stopPropagation();

     

       932
       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       933
       +
       									this.handleCloseSectionsModal();

     

       934
       934
       +
       								}}

     

       935
       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       936
       +
                     >

     

       937
       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       938
       +
                     </button>

     

       939
       939
       +
                     <button

     

       940
       940
       +
                       @click=${(e: Event) => {

     

       941
       941
       +
       									e.stopPropagation();

     

       942
       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       943
       +
       								}}

     

       944
       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       945
       +
                     >

     

       946
       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       947
       +
                     </button>

     

       948
       948
       +
                   </div>

     

       949
       949
       +
                   <button

     

       950
       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       952
       +
                   >

     

       953
       953
       +
                     Done

     

       954
       954
       +
                   </button>

     

       955
       955
       +
                 </div>

     

       956
       956
       +
       

     

       957
       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       958
       +
               </div>

     

       959
       959
       +
             </div>

     

       960
       960
       +
           `;

     

       961
       961
       +
       	}

     

       962
       962
       +
       

     

       752
       963
        
       	private renderWaitlist() {

     

       753
       964
        
       		return html`

     

       754
       965
        
             ${

     
···

       834
       1045
        
       		this.meetingTimes = e.detail;

     

       835
       1046
        
       	}

     

       836
       1047
        
       

     

       1048
       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       1050
       +
       		this.sections = value

     

       1051
       1051
       +
       			.split(",")

     

       1052
       1052
       +
       			.map((s) => s.trim())

     

       1053
       1053
       +
       			.filter((s) => s);

     

       1054
       1054
       +
       	}

     

       1055
       1055
       +
       

     

       837
       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       838
       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       839
       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       843
       1062
        
       		this.showModal = false;

     

       844
       1063
        
       		this.approvingEntry = null;

     

       845
       1064
        
       		this.meetingTimes = [];

     

       1065
       1065
       +
       		this.sections = [];

     

       846
       1066
        
       		this.editingClass = {

     

       847
       1067
        
       			courseCode: "",

     

       848
       1068
        
       			courseName: "",

     
···

       872
       1092
        
       					semester: this.editingClass.semester,

     

       873
       1093
        
       					year: this.editingClass.year,

     

       874
       1094
        
       					meeting_times: labels,

     

       1095
       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       875
       1096
        
       				}),

     

       876
       1097
        
       			});

     

       877
       1098
        
       

     
···

       890
       1111
        
       

     

       891
       1112
        
       			await this.loadData();

     

       892
       1113
        
       

     

       893
       893
       -
       			this.activeTab = "classes";

     

       1114
       1114
       +
       			this.setActiveTab("classes");

     

       894
       1115
        
       			this.showModal = false;

     

       895
       1116
        
       			this.approvingEntry = null;

     

       896
       1117
        
       			this.meetingTimes = [];

     
···

       926
       1147
        
                   ${description}

     

       927
       1148
        
                 </p>

     

       928
       1149
        
       

     

       929
       929
       -
                 ${this.error ? html`<div class="error-message">${this.error}</div>` : ""}

     

       1150
       1150
       +
                 ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       930
       1151
        
       

     

       931
       1152
        
                 <div class="form-grid">

     

       932
       1153
        
                   <div class="form-group">

     
···

       987
       1208
        
                       .value=${this.meetingTimes}

     

       988
       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       989
       1210
        
                     ></meeting-time-picker>

     

       1211
       1211
       +
                   </div>

     

       1212
       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       1214
       +
                     <input

     

       1215
       1215
       +
                       type="text"

     

       1216
       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       1219
       +
                     />

     

       1220
       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       990
       1221
        
                   </div>

     

       991
       1222
        
                 </div>

     

       992
       1223

+36 -13

src/components/admin-pending-recordings.ts

···

       46
       46
        
             display: block;

     

       47
       47
        
           }

     

       48
       48
        
       

     

       49
       49
       +
           .error-banner {

     

       50
       50
       +
             background: #fecaca;

     

       51
       51
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       52
       52
       +
             border-radius: 6px;

     

       53
       53
       +
             padding: 1rem;

     

       54
       54
       +
             margin-bottom: 1.5rem;

     

       55
       55
       +
             color: #dc2626;

     

       56
       56
       +
             font-weight: 500;

     

       57
       57
       +
           }

     

       58
       58
       +
       

     

       49
       59
        
           .loading,

     

       50
       60
        
           .empty-state {

     

       51
       61
        
             text-align: center;

     
···

       240
       250
        
       			// Get all classes with their transcriptions

     

       241
       251
        
       			const response = await fetch("/api/classes");

     

       242
       252
        
       			if (!response.ok) {

     

       243
       243
       -
       				throw new Error("Failed to load classes");

     

       253
       253
       +
       				const data = await response.json();

     

       254
       254
       +
       				throw new Error(data.error || "Failed to load classes");

     

       244
       255
        
       			}

     

       245
       256
        
       

     

       246
       257
        
       			const data = await response.json();

     
···

       305
       316
        
       			pendingRecordings.sort((a, b) => b.created_at - a.created_at);

     

       306
       317
        
       

     

       307
       318
        
       			this.recordings = pendingRecordings;

     

       308
       308
       -
       		} catch (error) {

     

       309
       309
       -
       			console.error("Failed to load pending recordings:", error);

     

       310
       310
       -
       			this.error = "Failed to load pending recordings. Please try again.";

     

       319
       319
       +
       		} catch (err) {

     

       320
       320
       +
       			this.error =

     

       321
       321
       +
       				err instanceof Error

     

       322
       322
       +
       					? err.message

     

       323
       323
       +
       					: "Failed to load pending recordings. Please try again.";

     

       311
       324
        
       		} finally {

     

       312
       325
        
       			this.isLoading = false;

     

       313
       326
        
       		}

     

       314
       327
        
       	}

     

       315
       328
        
       

     

       316
       329
        
       	private async handleApprove(recordingId: string) {

     

       330
       330
       +
       		this.error = null;

     

       317
       331
        
       		try {

     

       318
       332
        
       			const response = await fetch(`/api/transcripts/${recordingId}/select`, {

     

       319
       333
        
       				method: "PUT",

     

       320
       334
        
       			});

     

       321
       335
        
       

     

       322
       336
        
       			if (!response.ok) {

     

       323
       323
       -
       				throw new Error("Failed to approve recording");

     

       337
       337
       +
       				const data = await response.json();

     

       338
       338
       +
       				throw new Error(data.error || "Failed to approve recording");

     

       324
       339
        
       			}

     

       325
       340
        
       

     

       326
       341
        
       			// Reload recordings

     

       327
       342
        
       			await this.loadRecordings();

     

       328
       328
       -
       		} catch (error) {

     

       329
       329
       -
       			console.error("Failed to approve recording:", error);

     

       330
       330
       -
       			alert("Failed to approve recording. Please try again.");

     

       343
       343
       +
       		} catch (err) {

     

       344
       344
       +
       			this.error =

     

       345
       345
       +
       				err instanceof Error

     

       346
       346
       +
       					? err.message

     

       347
       347
       +
       					: "Failed to approve recording. Please try again.";

     

       331
       348
        
       		}

     

       332
       349
        
       	}

     

       333
       350
        
       

     
···

       340
       357
        
       			return;

     

       341
       358
        
       		}

     

       342
       359
        
       

     

       360
       360
       +
       		this.error = null;

     

       343
       361
        
       		try {

     

       344
       362
        
       			const response = await fetch(`/api/admin/transcriptions/${recordingId}`, {

     

       345
       363
        
       				method: "DELETE",

     

       346
       364
        
       			});

     

       347
       365
        
       

     

       348
       366
        
       			if (!response.ok) {

     

       349
       349
       -
       				throw new Error("Failed to delete recording");

     

       367
       367
       +
       				const data = await response.json();

     

       368
       368
       +
       				throw new Error(data.error || "Failed to delete recording");

     

       350
       369
        
       			}

     

       351
       370
        
       

     

       352
       371
        
       			// Reload recordings

     

       353
       372
        
       			await this.loadRecordings();

     

       354
       354
       -
       		} catch (error) {

     

       355
       355
       -
       			console.error("Failed to delete recording:", error);

     

       356
       356
       -
       			alert("Failed to delete recording. Please try again.");

     

       373
       373
       +
       		} catch (err) {

     

       374
       374
       +
       			this.error =

     

       375
       375
       +
       				err instanceof Error

     

       376
       376
       +
       					? err.message

     

       377
       377
       +
       					: "Failed to delete recording. Please try again.";

     

       357
       378
        
       		}

     

       358
       379
        
       	}

     

       359
       380
        
       

     
···

       369
       390
        
       

     

       370
       391
        
       		if (this.error) {

     

       371
       392
        
       			return html`

     

       372
       372
       -
               <div class="error">${this.error}</div>

     

       393
       393
       +
               <div class="error-banner">${this.error}</div>

     

       373
       394
        
               <button @click=${this.loadRecordings}>Retry</button>

     

       374
       395
        
             `;

     

       375
       396
        
       		}

     
···

       383
       404
        
       		}

     

       384
       405
        
       

     

       385
       406
        
       		return html`

     

       407
       407
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       408
       408
       +
             

     

       386
       409
        
             <div class="recordings-grid">

     

       387
       410
        
               ${this.recordings.map(

     

       388
       411
        
       					(recording) => html`

+30 -10

src/components/admin-transcriptions.ts

···

       24
       24
        
             display: block;

     

       25
       25
        
           }

     

       26
       26
        
       

     

       27
       27
       +
           .error-banner {

     

       28
       28
       +
             background: #fecaca;

     

       29
       29
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       30
       30
       +
             border-radius: 6px;

     

       31
       31
       +
             padding: 1rem;

     

       32
       32
       +
             margin-bottom: 1.5rem;

     

       33
       33
       +
             color: #dc2626;

     

       34
       34
       +
             font-weight: 500;

     

       35
       35
       +
           }

     

       36
       36
       +
       

     

       27
       37
        
           .search-box {

     

       28
       38
        
             width: 100%;

     

       29
       39
        
             max-width: 30rem;

     
···

       180
       190
        
       		try {

     

       181
       191
        
       			const response = await fetch("/api/admin/transcriptions");

     

       182
       192
        
       			if (!response.ok) {

     

       183
       183
       -
       				throw new Error("Failed to load transcriptions");

     

       193
       193
       +
       				const data = await response.json();

     

       194
       194
       +
       				throw new Error(data.error || "Failed to load transcriptions");

     

       184
       195
        
       			}

     

       185
       196
        
       

     

       186
       186
       -
       			this.transcriptions = await response.json();

     

       187
       187
       -
       		} catch (error) {

     

       188
       188
       -
       			console.error("Failed to load transcriptions:", error);

     

       189
       189
       -
       			this.error = "Failed to load transcriptions. Please try again.";

     

       197
       197
       +
       			const result = await response.json();

     

       198
       198
       +
       			this.transcriptions = result.data || result;

     

       199
       199
       +
       		} catch (err) {

     

       200
       200
       +
       			this.error =

     

       201
       201
       +
       				err instanceof Error

     

       202
       202
       +
       					? err.message

     

       203
       203
       +
       					: "Failed to load transcriptions. Please try again.";

     

       190
       204
        
       		} finally {

     

       191
       205
        
       			this.isLoading = false;

     

       192
       206
        
       		}

     
···

       201
       215
        
       			return;

     

       202
       216
        
       		}

     

       203
       217
        
       

     

       218
       218
       +
       		this.error = null;

     

       204
       219
        
       		try {

     

       205
       220
        
       			const response = await fetch(

     

       206
       221
        
       				`/api/admin/transcriptions/${transcriptionId}`,

     
···

       210
       225
        
       			);

     

       211
       226
        
       

     

       212
       227
        
       			if (!response.ok) {

     

       213
       213
       -
       				throw new Error("Failed to delete transcription");

     

       228
       228
       +
       				const data = await response.json();

     

       229
       229
       +
       				throw new Error(data.error || "Failed to delete transcription");

     

       214
       230
        
       			}

     

       215
       231
        
       

     

       216
       232
        
       			await this.loadTranscriptions();

     

       217
       233
        
       			this.dispatchEvent(new CustomEvent("transcription-deleted"));

     

       218
       218
       -
       		} catch (error) {

     

       219
       219
       -
       			console.error("Failed to delete transcription:", error);

     

       220
       220
       -
       			alert("Failed to delete transcription. Please try again.");

     

       234
       234
       +
       		} catch (err) {

     

       235
       235
       +
       			this.error =

     

       236
       236
       +
       				err instanceof Error

     

       237
       237
       +
       					? err.message

     

       238
       238
       +
       					: "Failed to delete transcription. Please try again.";

     

       221
       239
        
       		}

     

       222
       240
        
       	}

     

       223
       241
        
       

     
···

       257
       275
        
       

     

       258
       276
        
       		if (this.error) {

     

       259
       277
        
       			return html`

     

       260
       260
       -
               <div class="error">${this.error}</div>

     

       278
       278
       +
               <div class="error-banner">${this.error}</div>

     

       261
       279
        
               <button @click=${this.loadTranscriptions}>Retry</button>

     

       262
       280
        
             `;

     

       263
       281
        
       		}

     
···

       265
       283
        
       		const filtered = this.filteredTranscriptions;

     

       266
       284
        
       

     

       267
       285
        
       		return html`

     

       286
       286
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       287
       287
       +
             

     

       268
       288
        
             <input

     

       269
       289
        
               type="text"

     

       270
       290
        
               class="search-box"

+154 -62

src/components/admin-users.ts

···

       29
       29
        
             display: block;

     

       30
       30
        
           }

     

       31
       31
        
       

     

       32
       32
       +
           .error-banner {

     

       33
       33
       +
             background: #fecaca;

     

       34
       34
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       35
       35
       +
             border-radius: 6px;

     

       36
       36
       +
             padding: 1rem;

     

       37
       37
       +
             margin-bottom: 1.5rem;

     

       38
       38
       +
             color: #dc2626;

     

       39
       39
       +
             font-weight: 500;

     

       40
       40
       +
           }

     

       41
       41
       +
       

     

       32
       42
        
           .search-box {

     

       33
       43
        
             width: 100%;

     

       34
       44
        
             max-width: 30rem;

     
···

       80
       90
        
             border-color: var(--primary);

     

       81
       91
        
           }

     

       82
       92
        
       

     

       93
       93
       +
           .user-card.system {

     

       94
       94
       +
             cursor: default;

     

       95
       95
       +
             opacity: 0.8;

     

       96
       96
       +
           }

     

       97
       97
       +
       

     

       98
       98
       +
           .user-card.system:hover {

     

       99
       99
       +
             border-color: var(--secondary);

     

       100
       100
       +
           }

     

       101
       101
       +
       

     

       83
       102
        
           .card-header {

     

       84
       103
        
             display: flex;

     

       85
       104
        
             justify-content: space-between;

     
···

       125
       144
        
             text-transform: uppercase;

     

       126
       145
        
           }

     

       127
       146
        
       

     

       147
       147
       +
           .system-badge {

     

       148
       148
       +
             background: var(--paynes-gray);

     

       149
       149
       +
             color: var(--white);

     

       150
       150
       +
             padding: 0.5rem 1rem;

     

       151
       151
       +
             border-radius: 4px;

     

       152
       152
       +
             font-size: 0.75rem;

     

       153
       153
       +
             font-weight: 600;

     

       154
       154
       +
             text-transform: uppercase;

     

       155
       155
       +
           }

     

       156
       156
       +
       

     

       128
       157
        
           .meta-row {

     

       129
       158
        
             display: flex;

     

       130
       159
        
             gap: 2rem;

     
···

       291
       320
        
       		try {

     

       292
       321
        
       			const response = await fetch("/api/admin/users");

     

       293
       322
        
       			if (!response.ok) {

     

       294
       294
       -
       				throw new Error("Failed to load users");

     

       323
       323
       +
       				const data = await response.json();

     

       324
       324
       +
       				throw new Error(data.error || "Failed to load users");

     

       295
       325
        
       			}

     

       296
       326
        
       

     

       297
       297
       -
       			this.users = await response.json();

     

       298
       298
       -
       		} catch (error) {

     

       299
       299
       -
       			console.error("Failed to load users:", error);

     

       300
       300
       -
       			this.error = "Failed to load users. Please try again.";

     

       327
       327
       +
       			const result = await response.json();

     

       328
       328
       +
       			this.users = result.data || result;

     

       329
       329
       +
       		} catch (err) {

     

       330
       330
       +
       			this.error =

     

       331
       331
       +
       				err instanceof Error

     

       332
       332
       +
       					? err.message

     

       333
       333
       +
       					: "Failed to load users. Please try again.";

     

       301
       334
        
       		} finally {

     

       302
       335
        
       			this.isLoading = false;

     

       303
       336
        
       		}

     
···

       350
       383
        
       			});

     

       351
       384
        
       

     

       352
       385
        
       			if (!response.ok) {

     

       353
       353
       -
       				throw new Error("Failed to update role");

     

       386
       386
       +
       				const data = await response.json();

     

       387
       387
       +
       				throw new Error(data.error || "Failed to update role");

     

       354
       388
        
       			}

     

       355
       389
        
       

     

       356
       390
        
       			if (isDemotingSelf) {

     
···

       358
       392
        
       			} else {

     

       359
       393
        
       				await this.loadUsers();

     

       360
       394
        
       			}

     

       361
       361
       -
       		} catch (error) {

     

       362
       362
       -
       			console.error("Failed to update role:", error);

     

       363
       363
       -
       			alert("Failed to update user role");

     

       395
       395
       +
       		} catch (err) {

     

       396
       396
       +
       			this.error =

     

       397
       397
       +
       				err instanceof Error ? err.message : "Failed to update user role";

     

       364
       398
        
       			select.value = oldRole;

     

       365
       399
        
       		}

     

       366
       400
        
       	}

     
···

       419
       453
        
       	}

     

       420
       454
        
       

     

       421
       455
        
       	private async performDeleteUser(userId: number) {

     

       456
       456
       +
       		this.error = null;

     

       422
       457
        
       		try {

     

       423
       458
        
       			const response = await fetch(`/api/admin/users/${userId}`, {

     

       424
       459
        
       				method: "DELETE",

     

       425
       460
        
       			});

     

       426
       461
        
       

     

       427
       462
        
       			if (!response.ok) {

     

       428
       428
       -
       				throw new Error("Failed to delete user");

     

       463
       463
       +
       				const data = await response.json();

     

       464
       464
       +
       				throw new Error(data.error || "Failed to delete user");

     

       429
       465
        
       			}

     

       430
       466
        
       

     

       431
       467
        
       			// Remove user from local array instead of reloading

     

       432
       432
       -
       			this.users = this.users.filter(u => u.id !== userId);

     

       468
       468
       +
       			this.users = this.users.filter((u) => u.id !== userId);

     

       433
       469
        
       			this.dispatchEvent(new CustomEvent("user-deleted"));

     

       434
       434
       -
       		} catch {

     

       435
       435
       -
       			alert("Failed to delete user. Please try again.");

     

       470
       470
       +
       		} catch (err) {

     

       471
       471
       +
       			this.error =

     

       472
       472
       +
       				err instanceof Error

     

       473
       473
       +
       					? err.message

     

       474
       474
       +
       					: "Failed to delete user. Please try again.";

     

       436
       475
        
       		}

     

       437
       476
        
       	}

     

       438
       477
        
       

     

       439
       439
       -
       	private handleRevokeClick(userId: number, email: string, subscriptionId: string, event: Event) {

     

       478
       478
       +
       	private handleRevokeClick(

     

       479
       479
       +
       		userId: number,

     

       480
       480
       +
       		email: string,

     

       481
       481
       +
       		subscriptionId: string,

     

       482
       482
       +
       		event: Event,

     

       483
       483
       +
       	) {

     

       440
       484
        
       		event.stopPropagation();

     

       441
       485
        
       

     

       442
       486
        
       		// If this is a different item or timeout expired, reset

     
···

       479
       523
        
       			this.deleteState = null;

     

       480
       524
        
       		}, 1000);

     

       481
       525
        
       

     

       482
       482
       -
       		this.deleteState = { id: userId, type: "revoke", clicks: newClicks, timeout };

     

       526
       526
       +
       		this.deleteState = {

     

       527
       527
       +
       			id: userId,

     

       528
       528
       +
       			type: "revoke",

     

       529
       529
       +
       			clicks: newClicks,

     

       530
       530
       +
       			timeout,

     

       531
       531
       +
       		};

     

       483
       532
        
       	}

     

       484
       533
        
       

     

       485
       485
       -
       	private async performRevokeSubscription(userId: number, email: string, subscriptionId: string) {

     

       534
       534
       +
       	private async performRevokeSubscription(

     

       535
       535
       +
       		userId: number,

     

       536
       536
       +
       		_email: string,

     

       537
       537
       +
       		subscriptionId: string,

     

       538
       538
       +
       	) {

     

       486
       539
        
       		this.revokingSubscriptions.add(userId);

     

       487
       540
        
       		this.requestUpdate();

     

       541
       541
       +
       		this.error = null;

     

       488
       542
        
       

     

       489
       543
        
       		try {

     

       490
       544
        
       			const response = await fetch(`/api/admin/users/${userId}/subscription`, {

     
···

       499
       553
        
       			}

     

       500
       554
        
       

     

       501
       555
        
       			await this.loadUsers();

     

       502
       502
       -
       			alert(`Subscription revoked for ${email}`);

     

       503
       503
       -
       		} catch (error) {

     

       504
       504
       -
       			alert(`Failed to revoke subscription: ${error instanceof Error ? error.message : "Unknown error"}`);

     

       556
       556
       +
       		} catch (err) {

     

       557
       557
       +
       			this.error =

     

       558
       558
       +
       				err instanceof Error ? err.message : "Failed to revoke subscription";

     

       505
       559
        
       			this.revokingSubscriptions.delete(userId);

     

       506
       560
        
       		}

     

       507
       561
        
       	}

     
···

       511
       565
        
       

     

       512
       566
        
       		this.syncingSubscriptions.add(userId);

     

       513
       567
        
       		this.requestUpdate();

     

       568
       568
       +
       		this.error = null;

     

       514
       569
        
       

     

       515
       570
        
       		try {

     

       516
       571
        
       			const response = await fetch(`/api/admin/users/${userId}/subscription`, {

     
···

       520
       575
        
       

     

       521
       576
        
       			if (!response.ok) {

     

       522
       577
        
       				const data = await response.json();

     

       523
       523
       -
       				// Don't alert if there's just no subscription

     

       578
       578
       +
       				// Don't show error if there's just no subscription

     

       524
       579
        
       				if (response.status !== 404) {

     

       525
       525
       -
       					alert(`Failed to sync subscription: ${data.error || "Unknown error"}`);

     

       580
       580
       +
       					this.error = data.error || "Failed to sync subscription";

     

       526
       581
        
       				}

     

       527
       582
        
       				return;

     

       528
       583
        
       			}

     
···

       555
       610
        
       	}

     

       556
       611
        
       

     

       557
       612
        
       	private handleCardClick(userId: number, event: Event) {

     

       558
       558
       -
       		// Don't open modal if clicking on delete button, revoke button, or role select

     

       613
       613
       +
       		// Don't open modal for ghost user

     

       614
       614
       +
       		if (userId === 0) {

     

       615
       615
       +
       			return;

     

       616
       616
       +
       		}

     

       617
       617
       +
       

     

       618
       618
       +
       		// Don't open modal if clicking on delete button, revoke button, sync button, or role select

     

       559
       619
        
       		if (

     

       560
       620
        
       			(event.target as HTMLElement).closest(".delete-btn") ||

     

       561
       621
        
       			(event.target as HTMLElement).closest(".revoke-btn") ||

     

       622
       622
       +
       			(event.target as HTMLElement).closest(".sync-btn") ||

     

       562
       623
        
       			(event.target as HTMLElement).closest(".role-select")

     

       563
       624
        
       		) {

     

       564
       625
        
       			return;

     
···

       577
       638
        
       	}

     

       578
       639
        
       

     

       579
       640
        
       	private get filteredUsers() {

     

       580
       580
       -
       		if (!this.searchQuery) return this.users;

     

       581
       581
       -
       

     

       582
       641
        
       		const query = this.searchQuery.toLowerCase();

     

       583
       583
       -
       		return this.users.filter(

     

       642
       642
       +
       

     

       643
       643
       +
       		// Filter users based on search query

     

       644
       644
       +
       		let filtered = this.users.filter(

     

       584
       645
        
       			(u) =>

     

       585
       646
        
       				u.email.toLowerCase().includes(query) ||

     

       586
       647
        
       				u.name?.toLowerCase().includes(query),

     

       587
       648
        
       		);

     

       649
       649
       +
       

     

       650
       650
       +
       		// Hide ghost user unless specifically searched for

     

       651
       651
       +
       		if (

     

       652
       652
       +
       			!query.includes("deleted") &&

     

       653
       653
       +
       			!query.includes("ghost") &&

     

       654
       654
       +
       			!query.includes("system")

     

       655
       655
       +
       		) {

     

       656
       656
       +
       			filtered = filtered.filter((u) => u.id !== 0);

     

       657
       657
       +
       		}

     

       658
       658
       +
       

     

       659
       659
       +
       		return filtered;

     

       588
       660
        
       	}

     

       589
       661
        
       

     

       590
       662
        
       	override render() {

     
···

       594
       666
        
       

     

       595
       667
        
       		if (this.error) {

     

       596
       668
        
       			return html`

     

       597
       597
       -
               <div class="error">${this.error}</div>

     

       669
       669
       +
               <div class="error-banner">${this.error}</div>

     

       598
       670
        
               <button @click=${this.loadUsers}>Retry</button>

     

       599
       671
        
             `;

     

       600
       672
        
       		}

     
···

       602
       674
        
       		const filtered = this.filteredUsers;

     

       603
       675
        
       

     

       604
       676
        
       		return html`

     

       677
       677
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       678
       678
       +
             

     

       605
       679
        
             <input

     

       606
       680
        
               type="text"

     

       607
       681
        
               class="search-box"

     
···

       619
       693
        
                 <div class="users-grid">

     

       620
       694
        
                   ${filtered.map(

     

       621
       695
        
       							(u) => html`

     

       622
       622
       -
                     <div class="user-card" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       696
       696
       +
                     <div class="user-card ${u.id === 0 ? "system" : ""}" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       623
       697
        
                       <div class="card-header">

     

       624
       698
        
                         <div class="user-info">

     

       625
       699
        
                           <img

     
···

       632
       706
        
                             <div class="user-email">${u.email}</div>

     

       633
       707
        
                           </div>

     

       634
       708
        
                         </div>

     

       635
       635
       -
                         ${u.role === "admin" ? html`<span class="admin-badge">Admin</span>` : ""}

     

       709
       709
       +
                         ${

     

       710
       710
       +
       										u.id === 0

     

       711
       711
       +
       											? html`<span class="system-badge">System</span>`

     

       712
       712
       +
       											: u.role === "admin"

     

       713
       713
       +
       												? html`<span class="admin-badge">Admin</span>`

     

       714
       714
       +
       												: ""

     

       715
       715
       +
       									}

     

       636
       716
        
                       </div>

     

       637
       717
        
       

     

       638
       718
        
                       <div class="meta-row">

     
···

       643
       723
        
                         <div class="meta-item">

     

       644
       724
        
                           <div class="meta-label">Subscription</div>

     

       645
       725
        
                           <div class="meta-value">

     

       646
       646
       -
                             ${u.subscription_status 

     

       647
       647
       -
                               ? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>` 

     

       648
       648
       -
                               : html`<span class="subscription-badge none">None</span>`

     

       649
       649
       -
                             }

     

       726
       726
       +
                             ${

     

       727
       727
       +
       												u.subscription_status

     

       728
       728
       +
       													? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>`

     

       729
       729
       +
       													: html`<span class="subscription-badge none">None</span>`

     

       730
       730
       +
       											}

     

       650
       731
        
                           </div>

     

       651
       732
        
                         </div>

     

       652
       733
        
                         <div class="meta-item">

     
···

       664
       745
        
                       </div>

     

       665
       746
        
       

     

       666
       747
        
                       <div class="actions">

     

       667
       667
       -
                         <select

     

       668
       668
       -
                           class="role-select"

     

       669
       669
       -
                           .value=${u.role}

     

       670
       670
       -
                           @change=${(e: Event) => this.handleRoleChange(u.id, u.email, (e.target as HTMLSelectElement).value as "user" | "admin", u.role, e)}

     

       671
       671
       -
                         >

     

       672
       672
       -
                           <option value="user">User</option>

     

       673
       673
       -
                           <option value="admin">Admin</option>

     

       674
       674
       -
                         </select>

     

       675
       675
       -
                         <button 

     

       676
       676
       -
                           class="sync-btn" 

     

       677
       677
       -
                           ?disabled=${this.syncingSubscriptions.has(u.id)}

     

       678
       678
       -
                           @click=${(e: Event) => this.handleSyncSubscription(u.id, e)}

     

       679
       679
       -
                           title="Sync subscription status from Polar"

     

       680
       680
       -
                         >

     

       681
       681
       -
                           ${this.syncingSubscriptions.has(u.id) ? "Syncing..." : "🔄 Sync"}

     

       682
       682
       -
                         </button>

     

       683
       683
       -
                         <button 

     

       684
       684
       -
                           class="revoke-btn" 

     

       685
       685
       -
                           ?disabled=${!u.subscription_status || !u.subscription_id || this.revokingSubscriptions.has(u.id)}

     

       686
       686
       -
                           @click=${(e: Event) => {

     

       687
       687
       -
       											if (u.subscription_id) {

     

       688
       688
       -
       												this.handleRevokeClick(u.id, u.email, u.subscription_id, e);

     

       689
       689
       -
       											}

     

       690
       690
       -
       										}}

     

       691
       691
       -
                         >

     

       692
       692
       -
                           ${this.revokingSubscriptions.has(u.id) ? "Revoking..." : this.getDeleteButtonText(u.id, "revoke")}

     

       693
       693
       -
                         </button>

     

       694
       694
       -
                         <button class="delete-btn" @click=${(e: Event) => this.handleDeleteClick(u.id, e)}>

     

       695
       695
       -
                           ${this.getDeleteButtonText(u.id, "user")}

     

       696
       696
       -
                         </button>

     

       748
       748
       +
                         ${

     

       749
       749
       +
       										u.id === 0

     

       750
       750
       +
       											? html`<div style="color: var(--paynes-gray); font-size: 0.875rem; padding: 0.5rem;">System account cannot be modified</div>`

     

       751
       751
       +
       											: html`

     

       752
       752
       +
                             <select

     

       753
       753
       +
                               class="role-select"

     

       754
       754
       +
                               .value=${u.role}

     

       755
       755
       +
                               @change=${(e: Event) => this.handleRoleChange(u.id, u.email, (e.target as HTMLSelectElement).value as "user" | "admin", u.role, e)}

     

       756
       756
       +
                             >

     

       757
       757
       +
                               <option value="user">User</option>

     

       758
       758
       +
                               <option value="admin">Admin</option>

     

       759
       759
       +
                             </select>

     

       760
       760
       +
                             <button 

     

       761
       761
       +
                               class="sync-btn" 

     

       762
       762
       +
                               ?disabled=${this.syncingSubscriptions.has(u.id)}

     

       763
       763
       +
                               @click=${(e: Event) => this.handleSyncSubscription(u.id, e)}

     

       764
       764
       +
                               title="Sync subscription status from Polar"

     

       765
       765
       +
                             >

     

       766
       766
       +
                               ${this.syncingSubscriptions.has(u.id) ? "Syncing..." : "🔄 Sync"}

     

       767
       767
       +
                             </button>

     

       768
       768
       +
                             <button 

     

       769
       769
       +
                               class="revoke-btn" 

     

       770
       770
       +
                               ?disabled=${!u.subscription_status || !u.subscription_id || this.revokingSubscriptions.has(u.id)}

     

       771
       771
       +
                               @click=${(e: Event) => {

     

       772
       772
       +
       													if (u.subscription_id) {

     

       773
       773
       +
       														this.handleRevokeClick(

     

       774
       774
       +
       															u.id,

     

       775
       775
       +
       															u.email,

     

       776
       776
       +
       															u.subscription_id,

     

       777
       777
       +
       															e,

     

       778
       778
       +
       														);

     

       779
       779
       +
       													}

     

       780
       780
       +
       												}}

     

       781
       781
       +
                             >

     

       782
       782
       +
                               ${this.revokingSubscriptions.has(u.id) ? "Revoking..." : this.getDeleteButtonText(u.id, "revoke")}

     

       783
       783
       +
                             </button>

     

       784
       784
       +
                             <button class="delete-btn" @click=${(e: Event) => this.handleDeleteClick(u.id, e)}>

     

       785
       785
       +
                               ${this.getDeleteButtonText(u.id, "user")}

     

       786
       786
       +
                             </button>

     

       787
       787
       +
                           `

     

       788
       788
       +
       									}

     

       697
       789
        
                       </div>

     

       698
       790
        
                     </div>

     

       699
       791
        
                   `,

+273 -4

src/components/auth.ts

···

       30
       30
        
       	@state() needsRegistration = false;

     

       31
       31
        
       	@state() passwordStrength: PasswordStrengthResult | null = null;

     

       32
       32
        
       	@state() passkeySupported = false;

     

       33
       33
       +
       	@state() needsEmailVerification = false;

     

       34
       34
       +
       	@state() verificationCode = "";

     

       35
       35
       +
       	@state() resendCodeTimer = 0;

     

       36
       36
       +
       	@state() resendingCode = false;

     

       37
       37
       +
       	private resendInterval: number | null = null;

     

       38
       38
       +
       	private codeSentAt: number | null = null; // Unix timestamp in seconds when code was sent

     

       33
       39
        
       

     

       34
       40
        
       	static override styles = css`

     

       35
       41
        
       		:host {

     
···

       268
       274
        
       		.info-text {

     

       269
       275
        
       			color: var(--text);

     

       270
       276
        
       			font-size: 0.875rem;

     

       271
       271
       -
       			margin: 0;

     

       277
       277
       +
       			margin: 0 0 1.5rem 0;

     

       278
       278
       +
       			line-height: 1.5;

     

       279
       279
       +
       		}

     

       280
       280
       +
       

     

       281
       281
       +
       		.verification-code-input {

     

       282
       282
       +
       			text-align: center;

     

       283
       283
       +
       			font-size: 1.5rem;

     

       284
       284
       +
       			letter-spacing: 0.5rem;

     

       285
       285
       +
       			font-weight: 600;

     

       286
       286
       +
       			padding: 1rem;

     

       287
       287
       +
       			font-family: 'Monaco', 'Courier New', monospace;

     

       288
       288
       +
       		}

     

       289
       289
       +
       

     

       290
       290
       +
       		.resend-link {

     

       291
       291
       +
       			text-align: center;

     

       292
       292
       +
       			margin-top: 1rem;

     

       293
       293
       +
       			font-size: 0.875rem;

     

       294
       294
       +
       			color: var(--text);

     

       295
       295
       +
       		}

     

       296
       296
       +
       

     

       297
       297
       +
       		.resend-button {

     

       298
       298
       +
       			background: none;

     

       299
       299
       +
       			border: none;

     

       300
       300
       +
       			color: var(--primary);

     

       301
       301
       +
       			cursor: pointer;

     

       302
       302
       +
       			text-decoration: underline;

     

       303
       303
       +
       			font-size: 0.875rem;

     

       304
       304
       +
       			padding: 0;

     

       305
       305
       +
       			font-family: inherit;

     

       306
       306
       +
       		}

     

       307
       307
       +
       

     

       308
       308
       +
       		.resend-button:hover:not(:disabled) {

     

       309
       309
       +
       			color: var(--accent);

     

       310
       310
       +
       		}

     

       311
       311
       +
       

     

       312
       312
       +
       		.resend-button:disabled {

     

       313
       313
       +
       			color: var(--secondary);

     

       314
       314
       +
       			cursor: not-allowed;

     

       315
       315
       +
       			text-decoration: none;

     

       316
       316
       +
       		}

     

       317
       317
       +
       

     

       318
       318
       +
       		.btn-secondary {

     

       319
       319
       +
       			background: transparent;

     

       320
       320
       +
       			color: var(--text);

     

       321
       321
       +
       			border-color: var(--secondary);

     

       322
       322
       +
       			flex: 1;

     

       323
       323
       +
       		}

     

       324
       324
       +
       

     

       325
       325
       +
       		.btn-secondary:hover:not(:disabled) {

     

       326
       326
       +
       			border-color: var(--primary);

     

       327
       327
       +
       			color: var(--primary);

     

       272
       328
        
       		}

     

       273
       329
        
       

     

       274
       330
        
       	.divider {

     
···

       383
       439
        
       					return;

     

       384
       440
        
       				}

     

       385
       441
        
       

     

       386
       386
       -
       				this.user = await response.json();

     

       442
       442
       +
       				const data = await response.json();

     

       443
       443
       +
       

     

       444
       444
       +
       				if (data.email_verification_required) {

     

       445
       445
       +
       					this.needsEmailVerification = true;

     

       446
       446
       +
       					this.password = "";

     

       447
       447
       +
       					this.error = "";

     

       448
       448
       +
       					this.startResendTimer(data.verification_code_sent_at);

     

       449
       449
       +
       					return;

     

       450
       450
       +
       				}

     

       451
       451
       +
       

     

       452
       452
       +
       				this.user = data;

     

       387
       453
        
       				this.closeModal();

     

       388
       454
        
       				await this.checkAuth();

     

       389
       455
        
       				window.dispatchEvent(new CustomEvent("auth-changed"));

     
···

       411
       477
        
       					return;

     

       412
       478
        
       				}

     

       413
       479
        
       

     

       414
       414
       -
       				this.user = await response.json();

     

       480
       480
       +
       				const data = await response.json();

     

       481
       481
       +
       

     

       482
       482
       +
       				if (data.email_verification_required) {

     

       483
       483
       +
       					this.needsEmailVerification = true;

     

       484
       484
       +
       					this.password = "";

     

       485
       485
       +
       					this.error = "";

     

       486
       486
       +
       					this.startResendTimer(data.verification_code_sent_at);

     

       487
       487
       +
       					return;

     

       488
       488
       +
       				}

     

       489
       489
       +
       

     

       490
       490
       +
       				this.user = data;

     

       415
       491
        
       				this.closeModal();

     

       416
       492
        
       				await this.checkAuth();

     

       417
       493
        
       				window.dispatchEvent(new CustomEvent("auth-changed"));

     
···

       453
       529
        
       		this.password = (e.target as HTMLInputElement).value;

     

       454
       530
        
       	}

     

       455
       531
        
       

     

       532
       532
       +
       	private handleVerificationCodeInput(e: Event) {

     

       533
       533
       +
       		this.verificationCode = (e.target as HTMLInputElement).value;

     

       534
       534
       +
       	}

     

       535
       535
       +
       

     

       536
       536
       +
       	private async handleVerifyEmail(e: Event) {

     

       537
       537
       +
       		e.preventDefault();

     

       538
       538
       +
       		this.error = "";

     

       539
       539
       +
       		this.isSubmitting = true;

     

       540
       540
       +
       

     

       541
       541
       +
       		try {

     

       542
       542
       +
       			const response = await fetch("/api/auth/verify-email", {

     

       543
       543
       +
       				method: "POST",

     

       544
       544
       +
       				headers: {

     

       545
       545
       +
       					"Content-Type": "application/json",

     

       546
       546
       +
       				},

     

       547
       547
       +
       				body: JSON.stringify({

     

       548
       548
       +
       					email: this.email,

     

       549
       549
       +
       					code: this.verificationCode,

     

       550
       550
       +
       				}),

     

       551
       551
       +
       			});

     

       552
       552
       +
       

     

       553
       553
       +
       			if (!response.ok) {

     

       554
       554
       +
       				const data = await response.json();

     

       555
       555
       +
       				this.error = data.error || "Verification failed";

     

       556
       556
       +
       				return;

     

       557
       557
       +
       			}

     

       558
       558
       +
       

     

       559
       559
       +
       			// Successfully verified - redirect to classes

     

       560
       560
       +
       			this.closeModal();

     

       561
       561
       +
       			await this.checkAuth();

     

       562
       562
       +
       			window.dispatchEvent(new CustomEvent("auth-changed"));

     

       563
       563
       +
       			window.location.href = "/classes";

     

       564
       564
       +
       		} catch (error) {

     

       565
       565
       +
       			this.error = error instanceof Error ? error.message : "An error occurred";

     

       566
       566
       +
       		} finally {

     

       567
       567
       +
       			this.isSubmitting = false;

     

       568
       568
       +
       		}

     

       569
       569
       +
       	}

     

       570
       570
       +
       

     

       456
       571
        
       	private handlePasswordBlur() {

     

       457
       572
        
       		if (!this.needsRegistration) return;

     

       458
       573
        
       

     
···

       490
       605
        
       		}

     

       491
       606
        
       	}

     

       492
       607
        
       

     

       608
       608
       +
       	private startResendTimer(sentAtTimestamp: number) {

     

       609
       609
       +
       		// Use provided timestamp

     

       610
       610
       +
       		this.codeSentAt = sentAtTimestamp;

     

       611
       611
       +
       

     

       612
       612
       +
       		// Clear existing interval if any

     

       613
       613
       +
       		if (this.resendInterval !== null) {

     

       614
       614
       +
       			clearInterval(this.resendInterval);

     

       615
       615
       +
       		}

     

       616
       616
       +
       

     

       617
       617
       +
       		// Update timer based on elapsed time

     

       618
       618
       +
       		const updateTimer = () => {

     

       619
       619
       +
       			if (this.codeSentAt === null) return;

     

       620
       620
       +
       

     

       621
       621
       +
       			const now = Math.floor(Date.now() / 1000);

     

       622
       622
       +
       			const elapsed = now - this.codeSentAt;

     

       623
       623
       +
       			const remaining = Math.max(0, 5 * 60 - elapsed);

     

       624
       624
       +
       			this.resendCodeTimer = remaining;

     

       625
       625
       +
       

     

       626
       626
       +
       			if (remaining <= 0) {

     

       627
       627
       +
       				if (this.resendInterval !== null) {

     

       628
       628
       +
       					clearInterval(this.resendInterval);

     

       629
       629
       +
       					this.resendInterval = null;

     

       630
       630
       +
       				}

     

       631
       631
       +
       			}

     

       632
       632
       +
       		};

     

       633
       633
       +
       

     

       634
       634
       +
       		// Update immediately

     

       635
       635
       +
       		updateTimer();

     

       636
       636
       +
       

     

       637
       637
       +
       		// Then update every second

     

       638
       638
       +
       		this.resendInterval = window.setInterval(updateTimer, 1000);

     

       639
       639
       +
       	}

     

       640
       640
       +
       

     

       641
       641
       +
       	private async handleResendCode() {

     

       642
       642
       +
       		this.error = "";

     

       643
       643
       +
       		this.resendingCode = true;

     

       644
       644
       +
       

     

       645
       645
       +
       		try {

     

       646
       646
       +
       			const response = await fetch("/api/auth/resend-verification-code", {

     

       647
       647
       +
       				method: "POST",

     

       648
       648
       +
       				headers: {

     

       649
       649
       +
       					"Content-Type": "application/json",

     

       650
       650
       +
       				},

     

       651
       651
       +
       				body: JSON.stringify({

     

       652
       652
       +
       					email: this.email,

     

       653
       653
       +
       				}),

     

       654
       654
       +
       			});

     

       655
       655
       +
       

     

       656
       656
       +
       			if (!response.ok) {

     

       657
       657
       +
       				const data = await response.json();

     

       658
       658
       +
       				this.error = data.error || "Failed to resend code";

     

       659
       659
       +
       				return;

     

       660
       660
       +
       			}

     

       661
       661
       +
       

     

       662
       662
       +
       			// Start the 5-minute timer

     

       663
       663
       +
       			this.startResendTimer(data.verification_code_sent_at);

     

       664
       664
       +
       		} catch (error) {

     

       665
       665
       +
       			this.error = error instanceof Error ? error.message : "An error occurred";

     

       666
       666
       +
       		} finally {

     

       667
       667
       +
       			this.resendingCode = false;

     

       668
       668
       +
       		}

     

       669
       669
       +
       	}

     

       670
       670
       +
       

     

       671
       671
       +
       	private formatTimer(seconds: number): string {

     

       672
       672
       +
       		const mins = Math.floor(seconds / 60);

     

       673
       673
       +
       		const secs = seconds % 60;

     

       674
       674
       +
       		return `${mins}:${secs.toString().padStart(2, "0")}`;

     

       675
       675
       +
       	}

     

       676
       676
       +
       

     

       677
       677
       +
       	override disconnectedCallback() {

     

       678
       678
       +
       		super.disconnectedCallback();

     

       679
       679
       +
       		// Clean up timer when component is removed

     

       680
       680
       +
       		if (this.resendInterval !== null) {

     

       681
       681
       +
       			clearInterval(this.resendInterval);

     

       682
       682
       +
       			this.resendInterval = null;

     

       683
       683
       +
       		}

     

       684
       684
       +
       	}

     

       685
       685
       +
       

     

       493
       686
        
       	override render() {

     

       494
       687
        
       		if (this.loading) {

     

       495
       688
        
       			return html`<div class="loading">Loading...</div>`;

     
···

       543
       736
        
       						<div class="modal-overlay" @click=${this.closeModal}>

     

       544
       737
        
       							<div class="modal" @click=${(e: Event) => e.stopPropagation()}>

     

       545
       738
        
       								<h2 class="modal-title">

     

       546
       546
       -
       									${this.needsRegistration ? "Create Account" : "Sign In"}

     

       739
       739
       +
       									${this.needsEmailVerification ? "Verify Email" : this.needsRegistration ? "Create Account" : "Sign In"}

     

       547
       740
        
       								</h2>

     

       548
       741
        
       

     

       549
       742
        
       								${

     

       743
       743
       +
       									this.needsEmailVerification

     

       744
       744
       +
       										? html`

     

       745
       745
       +
       											<p class="info-text">

     

       746
       746
       +
       												We sent a 6-digit verification code to <strong>${this.email}</strong>.<br>

     

       747
       747
       +
       												Check your email and enter the code below.

     

       748
       748
       +
       											</p>

     

       749
       749
       +
       											

     

       750
       750
       +
       											<form @submit=${this.handleVerifyEmail}>

     

       751
       751
       +
       												<div class="form-group">

     

       752
       752
       +
       													<label for="verification-code">Verification Code</label>

     

       753
       753
       +
       													<input

     

       754
       754
       +
       														type="text"

     

       755
       755
       +
       														id="verification-code"

     

       756
       756
       +
       														class="verification-code-input"

     

       757
       757
       +
       														placeholder="000000"

     

       758
       758
       +
       														.value=${this.verificationCode}

     

       759
       759
       +
       														@input=${this.handleVerificationCodeInput}

     

       760
       760
       +
       														required

     

       761
       761
       +
       														maxlength="6"

     

       762
       762
       +
       														pattern="[0-9]{6}"

     

       763
       763
       +
       														inputmode="numeric"

     

       764
       764
       +
       														?disabled=${this.isSubmitting}

     

       765
       765
       +
       														autocomplete="one-time-code"

     

       766
       766
       +
       													/>

     

       767
       767
       +
       												</div>

     

       768
       768
       +
       

     

       769
       769
       +
       												${

     

       770
       770
       +
       													this.error

     

       771
       771
       +
       														? html`<div class="error-message">${this.error}</div>`

     

       772
       772
       +
       														: ""

     

       773
       773
       +
       												}

     

       774
       774
       +
       

     

       775
       775
       +
       												<div class="resend-link">

     

       776
       776
       +
       													${

     

       777
       777
       +
       														this.resendCodeTimer > 0

     

       778
       778
       +
       															? html`Resend code in ${this.formatTimer(this.resendCodeTimer)}`

     

       779
       779
       +
       															: html`

     

       780
       780
       +
       																<button

     

       781
       781
       +
       																	type="button"

     

       782
       782
       +
       																	class="resend-button"

     

       783
       783
       +
       																	@click=${this.handleResendCode}

     

       784
       784
       +
       																	?disabled=${this.resendingCode}

     

       785
       785
       +
       																>

     

       786
       786
       +
       																	${this.resendingCode ? "Sending..." : "Resend code"}

     

       787
       787
       +
       																</button>

     

       788
       788
       +
       															`

     

       789
       789
       +
       													}

     

       790
       790
       +
       												</div>

     

       791
       791
       +
       

     

       792
       792
       +
       												<div class="modal-actions">

     

       793
       793
       +
       													<button

     

       794
       794
       +
       														type="submit"

     

       795
       795
       +
       														class="btn-primary"

     

       796
       796
       +
       														?disabled=${this.isSubmitting || this.verificationCode.length !== 6}

     

       797
       797
       +
       													>

     

       798
       798
       +
       														${this.isSubmitting ? "Verifying..." : "Verify Email"}

     

       799
       799
       +
       													</button>

     

       800
       800
       +
       													<button

     

       801
       801
       +
       														type="button"

     

       802
       802
       +
       														class="btn-secondary"

     

       803
       803
       +
       														@click=${() => {

     

       804
       804
       +
       															this.needsEmailVerification = false;

     

       805
       805
       +
       															this.verificationCode = "";

     

       806
       806
       +
       															this.error = "";

     

       807
       807
       +
       														}}

     

       808
       808
       +
       														?disabled=${this.isSubmitting}

     

       809
       809
       +
       													>

     

       810
       810
       +
       														Back

     

       811
       811
       +
       													</button>

     

       812
       812
       +
       												</div>

     

       813
       813
       +
       											</form>

     

       814
       814
       +
       										`

     

       815
       815
       +
       										: html`

     

       816
       816
       +
       								${

     

       550
       817
        
       									this.needsRegistration

     

       551
       818
        
       										? html`

     

       552
       819
        
       											<p class="info-text">

     
···

       660
       927
        
       										</button>

     

       661
       928
        
       									</div>

     

       662
       929
        
       								</form>

     

       930
       930
       +
       										`

     

       931
       931
       +
       								}

     

       663
       932
        
       							</div>

     

       664
       933
        
       						</div>

     

       665
       934
        
       					`

+123 -13

src/components/class-view.ts

···

       2
       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
       3
        
       import "./upload-recording-modal.ts";

     

       4
       4
        
       import "./vtt-viewer.ts";

     

       5
       5
       +
       import "./pending-recordings-view.ts";

     

       5
       6
        
       

     

       6
       7
        
       interface Class {

     

       7
       8
        
       	id: string;

     
···

       24
       25
        
       	id: string;

     

       25
       26
        
       	user_id: number;

     

       26
       27
        
       	meeting_time_id: string | null;

     

       28
       28
       +
       	section_id: string | null;

     

       27
       29
        
       	filename: string;

     

       28
       30
        
       	original_filename: string;

     

       29
       31
        
       	status:

     
···

       42
       44
        
       	audioUrl?: string;

     

       43
       45
        
       }

     

       44
       46
        
       

     

       47
       47
       +
       interface ClassSection {

     

       48
       48
       +
       	id: string;

     

       49
       49
       +
       	section_number: string;

     

       50
       50
       +
       }

     

       51
       51
       +
       

     

       45
       52
        
       @customElement("class-view")

     

       46
       53
        
       export class ClassView extends LitElement {

     

       47
       54
        
       	@state() classId = "";

     

       48
       55
        
       	@state() classInfo: Class | null = null;

     

       49
       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       58
       +
       	@state() userSection: string | null = null;

     

       59
       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       50
       60
        
       	@state() transcriptions: Transcription[] = [];

     

       51
       61
        
       	@state() isLoading = true;

     

       52
       62
        
       	@state() error: string | null = null;

     
···

       363
       373
        
       			const data = await response.json();

     

       364
       374
        
       			this.classInfo = data.class;

     

       365
       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       376
       +
       			this.sections = data.sections || [];

     

       377
       377
       +
       			this.userSection = data.userSection || null;

     

       366
       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       379
       +
       

     

       380
       380
       +
       			// Default to user's section for filtering

     

       381
       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       383
       +
       			}

     

       367
       384
        
       

     

       368
       385
        
       			// Load VTT for completed transcriptions

     

       369
       386
        
       			await this.loadVTTForCompleted();

     
···

       450
       467
        
       	}

     

       451
       468
        
       

     

       452
       469
        
       	private get filteredTranscriptions() {

     

       453
       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       470
       470
       +
       		let filtered = this.transcriptions;

     

       454
       471
        
       

     

       455
       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       458
       -
       		);

     

       472
       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       474
       +
       		

     

       475
       475
       +
       		// Only filter by section if:

     

       476
       476
       +
       		// 1. There are sections in the class

     

       477
       477
       +
       		// 2. User has a section OR has selected one

     

       478
       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       479
       +
       			// For admins: show all transcriptions

     

       480
       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       481
       +
       			if (!this.isAdmin) {

     

       482
       482
       +
       				filtered = filtered.filter(

     

       483
       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       484
       +
       				);

     

       485
       485
       +
       			}

     

       486
       486
       +
       		}

     

       487
       487
       +
       

     

       488
       488
       +
       		// Filter by search query

     

       489
       489
       +
       		if (this.searchQuery) {

     

       490
       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       493
       +
       			);

     

       494
       494
       +
       		}

     

       495
       495
       +
       

     

       496
       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       498
       +
       

     

       499
       499
       +
       		return filtered;

     

       459
       500
        
       	}

     

       460
       501
        
       

     

       461
       502
        
       	private formatDate(timestamp: number): string {

     
···

       521
       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
       563
        
                   <h1>${this.classInfo.name}</h1>

     

       523
       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       565
       565
       +
                   <div class="semester">

     

       566
       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       567
       +
                     ${

     

       568
       568
       +
       								this.userSection

     

       569
       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       570
       +
       									: ""

     

       571
       571
       +
       							}

     

       572
       572
       +
                   </div>

     

       525
       573
        
                 </div>

     

       526
       574
        
               </div>

     

       527
       575
        
       

     
···

       538
       586
        
       						: ""

     

       539
       587
        
       				}

     

       540
       588
        
       

     

       541
       541
       -
               ${!canAccessTranscriptions ? html`

     

       589
       589
       +
               ${

     

       590
       590
       +
       					!canAccessTranscriptions

     

       591
       591
       +
       						? html`

     

       542
       592
        
                 <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin: 2rem 0; text-align: center;">

     

       543
       593
        
                   <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Access Recordings</h3>

     

       544
       594
        
                   <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and view transcriptions.</p>

     

       545
       595
        
                   <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       546
       596
        
                 </div>

     

       547
       547
       -
               ` : html`

     

       597
       597
       +
               `

     

       598
       598
       +
       						: html`

     

       548
       599
        
               <div class="search-upload">

     

       600
       600
       +
                 ${

     

       601
       601
       +
       						this.sections.length > 1

     

       602
       602
       +
       							? html`

     

       603
       603
       +
                     <select

     

       604
       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       605
       +
                       @change=${(e: Event) => {

     

       606
       606
       +
       									this.selectedSectionFilter =

     

       607
       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       608
       +
       								}}

     

       609
       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       610
       +
                     >

     

       611
       611
       +
                       ${this.sections.map(

     

       612
       612
       +
       									(s) =>

     

       613
       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       614
       +
       								)}

     

       615
       615
       +
                     </select>

     

       616
       616
       +
                   `

     

       617
       617
       +
       							: ""

     

       618
       618
       +
       					}

     

       549
       619
        
                 <input

     

       550
       620
        
                   type="text"

     

       551
       621
        
                   class="search-box"

     
···

       564
       634
        
                 </button>

     

       565
       635
        
               </div>

     

       566
       636
        
       

     

       637
       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       638
       +
               ${

     

       639
       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       640
       +
       						// Apply section filtering to pending recordings

     

       641
       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       642
       +
       						

     

       643
       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       645
       +
       								return false;

     

       646
       646
       +
       							}

     

       647
       647
       +
       							

     

       648
       648
       +
       							// Filter by section if applicable

     

       649
       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       652
       +
       							}

     

       653
       653
       +
       							

     

       654
       654
       +
       							return true;

     

       655
       655
       +
       						}).length;

     

       656
       656
       +
       

     

       657
       657
       +
       						// Only show if there are pending recordings

     

       658
       658
       +
       						if (pendingCount === 0) return "";

     

       659
       659
       +
       

     

       660
       660
       +
       						return html`

     

       661
       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       662
       +
                     <pending-recordings-view

     

       663
       663
       +
                       .classId=${this.classId}

     

       664
       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       666
       +
                       .sectionId=${sectionFilter}

     

       667
       667
       +
                     ></pending-recordings-view>

     

       668
       668
       +
                   </div>

     

       669
       669
       +
                 `;

     

       670
       670
       +
       					})

     

       671
       671
       +
       				}

     

       672
       672
       +
       

     

       673
       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       567
       674
        
               ${

     

       568
       675
        
       					this.filteredTranscriptions.length === 0

     

       569
       676
        
       						? html`

     
···

       572
       679
        
                 <p>${this.searchQuery ? "Try a different search term" : "Upload a recording to get started!"}</p>

     

       573
       680
        
               </div>

     

       574
       681
        
             `

     

       575
       575
       -
       					: html`

     

       682
       682
       +
       						: html`

     

       576
       683
        
               ${this.filteredTranscriptions.map(

     

       577
       577
       -
       						(t) => html`

     

       684
       684
       +
       					(t) => html`

     

       578
       685
        
                 <div class="transcription-card">

     

       579
       686
        
                   <div class="transcription-header">

     

       580
       687
        
                     <div>

     
···

       617
       724
        
                   ${t.error_message ? html`<div class="error">${t.error_message}</div>` : ""}

     

       618
       725
        
                 </div>

     

       619
       726
        
               `,

     

       620
       620
       -
       					)}

     

       727
       727
       +
       				)}

     

       621
       728
        
             `

     

       622
       622
       -
       			}

     

       623
       623
       -
               `}

     

       729
       729
       +
       				}

     

       730
       730
       +
               `

     

       731
       731
       +
       				}

     

       624
       732
        
             </div>

     

       625
       733
        
       

     

       626
       734
        
             <upload-recording-modal

     

       627
       735
        
               ?open=${this.uploadModalOpen}

     

       628
       736
        
               .classId=${this.classId}

     

       629
       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       738
       +
               .sections=${this.sections}

     

       739
       739
       +
               .userSection=${this.userSection}

     

       630
       740
        
               @close=${this.handleModalClose}

     

       631
       741
        
               @upload-success=${this.handleUploadSuccess}

     

       632
       742
        
             ></upload-recording-modal>

+21 -7

src/components/classes-overview.ts

···

       150
       150
        
             margin-bottom: 1rem;

     

       151
       151
        
           }

     

       152
       152
        
       

     

       153
       153
       +
           .empty-state button {

     

       154
       154
       +
             margin-top: 2rem;

     

       155
       155
       +
             padding: 0.75rem 2rem;

     

       156
       156
       +
             background: var(--accent);

     

       157
       157
       +
             color: var(--white);

     

       158
       158
       +
             border: none;

     

       159
       159
       +
             border-radius: 8px;

     

       160
       160
       +
             font-size: 1rem;

     

       161
       161
       +
             font-weight: 600;

     

       162
       162
       +
             cursor: pointer;

     

       163
       163
       +
             transition: all 0.2s;

     

       164
       164
       +
           }

     

       165
       165
       +
       

     

       166
       166
       +
           .empty-state button:hover {

     

       167
       167
       +
             background: color-mix(in srgb, var(--accent) 90%, black);

     

       168
       168
       +
             transform: translateY(-2px);

     

       169
       169
       +
           }

     

       170
       170
       +
       

     

       153
       171
        
           .loading {

     

       154
       172
        
             text-align: center;

     

       155
       173
        
             padding: 4rem 2rem;

     
···

       214
       232
        
       	}

     

       215
       233
        
       

     

       216
       234
        
       	private async handleClassJoined() {

     

       235
       235
       +
       		this.showRegistrationModal = false;

     

       217
       236
        
       		await this.loadClasses();

     

       218
       237
        
       	}

     

       219
       238
        
       

     
···

       259
       278
        
       										? html`

     

       260
       279
        
                         <div class="register-card" @click=${this.handleRegisterClick}>

     

       261
       280
        
                           <div class="register-icon">+</div>

     

       262
       262
       -
                           <div class="register-text">Register for Class</div>

     

       281
       281
       +
                           <div class="register-text">Register for a Class</div>

     

       263
       282
        
                         </div>

     

       264
       283
        
                       `

     

       265
       284
        
       										: ""

     
···

       273
       292
        
                 <div class="empty-state">

     

       274
       293
        
                   <h2>No classes yet</h2>

     

       275
       294
        
                   <p>You haven't been enrolled in any classes.</p>

     

       276
       276
       -
                 </div>

     

       277
       277
       -
                 <div class="classes-grid">

     

       278
       278
       -
                   <div class="register-card" @click=${this.handleRegisterClick}>

     

       279
       279
       -
                     <div class="register-icon">+</div>

     

       280
       280
       -
                     <div class="register-text">Register for Class</div>

     

       281
       281
       -
                   </div>

     

       295
       295
       +
                   <button @click=${this.handleRegisterClick}>Register for a Class</button>

     

       282
       296
        
                 </div>

     

       283
       297
        
               `

     

       284
       298
        
       			}

+436

src/components/pending-recordings-view.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       

     

       4
       4
       +
       interface PendingRecording {

     

       5
       5
       +
       	id: string;

     

       6
       6
       +
       	user_id: number;

     

       7
       7
       +
       	filename: string;

     

       8
       8
       +
       	original_filename: string;

     

       9
       9
       +
       	vote_count: number;

     

       10
       10
       +
       	created_at: number;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       interface RecordingsData {

     

       14
       14
       +
       	recordings: PendingRecording[];

     

       15
       15
       +
       	total_users: number;

     

       16
       16
       +
       	user_vote: string | null;

     

       17
       17
       +
       	vote_threshold: number;

     

       18
       18
       +
       	winning_recording_id: string | null;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       @customElement("pending-recordings-view")

     

       22
       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       23
       +
       	@property({ type: String }) classId = "";

     

       24
       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       27
       +
       

     

       28
       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       29
       +
       	@state() private userVote: string | null = null;

     

       30
       30
       +
       	@state() private voteThreshold = 0;

     

       31
       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       32
       +
       	@state() private error: string | null = null;

     

       33
       33
       +
       	@state() private timeRemaining = "";

     

       34
       34
       +
       

     

       35
       35
       +
       	private refreshInterval?: number;

     

       36
       36
       +
       	private loadingInProgress = false;

     

       37
       37
       +
       

     

       38
       38
       +
       	static override styles = css`

     

       39
       39
       +
           :host {

     

       40
       40
       +
             display: block;

     

       41
       41
       +
             padding: 1rem;

     

       42
       42
       +
           }

     

       43
       43
       +
       

     

       44
       44
       +
           .container {

     

       45
       45
       +
             max-width: 56rem;

     

       46
       46
       +
             margin: 0 auto;

     

       47
       47
       +
           }

     

       48
       48
       +
       

     

       49
       49
       +
           h2 {

     

       50
       50
       +
             color: var(--text);

     

       51
       51
       +
             margin-bottom: 0.5rem;

     

       52
       52
       +
           }

     

       53
       53
       +
       

     

       54
       54
       +
           .info {

     

       55
       55
       +
             color: var(--paynes-gray);

     

       56
       56
       +
             font-size: 0.875rem;

     

       57
       57
       +
             margin-bottom: 1.5rem;

     

       58
       58
       +
           }

     

       59
       59
       +
       

     

       60
       60
       +
           .stats {

     

       61
       61
       +
             display: flex;

     

       62
       62
       +
             gap: 2rem;

     

       63
       63
       +
             margin-bottom: 1.5rem;

     

       64
       64
       +
             padding: 1rem;

     

       65
       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       66
       +
             border-radius: 8px;

     

       67
       67
       +
           }

     

       68
       68
       +
       

     

       69
       69
       +
           .stat {

     

       70
       70
       +
             display: flex;

     

       71
       71
       +
             flex-direction: column;

     

       72
       72
       +
             gap: 0.25rem;

     

       73
       73
       +
           }

     

       74
       74
       +
       

     

       75
       75
       +
           .stat-label {

     

       76
       76
       +
             font-size: 0.75rem;

     

       77
       77
       +
             color: var(--paynes-gray);

     

       78
       78
       +
             text-transform: uppercase;

     

       79
       79
       +
             letter-spacing: 0.05em;

     

       80
       80
       +
           }

     

       81
       81
       +
       

     

       82
       82
       +
           .stat-value {

     

       83
       83
       +
             font-size: 1.5rem;

     

       84
       84
       +
             font-weight: 600;

     

       85
       85
       +
             color: var(--text);

     

       86
       86
       +
           }

     

       87
       87
       +
       

     

       88
       88
       +
           .recordings-list {

     

       89
       89
       +
             display: flex;

     

       90
       90
       +
             flex-direction: column;

     

       91
       91
       +
             gap: 1rem;

     

       92
       92
       +
           }

     

       93
       93
       +
       

     

       94
       94
       +
           .recording-card {

     

       95
       95
       +
             border: 2px solid var(--secondary);

     

       96
       96
       +
             border-radius: 8px;

     

       97
       97
       +
             padding: 1rem;

     

       98
       98
       +
             transition: all 0.2s;

     

       99
       99
       +
           }

     

       100
       100
       +
       

     

       101
       101
       +
           .recording-card.voted {

     

       102
       102
       +
             border-color: var(--accent);

     

       103
       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       104
       +
           }

     

       105
       105
       +
       

     

       106
       106
       +
           .recording-card.winning {

     

       107
       107
       +
             border-color: var(--accent);

     

       108
       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       109
       +
           }

     

       110
       110
       +
       

     

       111
       111
       +
           .recording-header {

     

       112
       112
       +
             display: flex;

     

       113
       113
       +
             justify-content: space-between;

     

       114
       114
       +
             align-items: center;

     

       115
       115
       +
             margin-bottom: 0.75rem;

     

       116
       116
       +
           }

     

       117
       117
       +
       

     

       118
       118
       +
           .recording-info {

     

       119
       119
       +
             flex: 1;

     

       120
       120
       +
           }

     

       121
       121
       +
       

     

       122
       122
       +
           .recording-name {

     

       123
       123
       +
             font-weight: 600;

     

       124
       124
       +
             color: var(--text);

     

       125
       125
       +
             margin-bottom: 0.25rem;

     

       126
       126
       +
           }

     

       127
       127
       +
       

     

       128
       128
       +
           .recording-meta {

     

       129
       129
       +
             font-size: 0.75rem;

     

       130
       130
       +
             color: var(--paynes-gray);

     

       131
       131
       +
           }

     

       132
       132
       +
       

     

       133
       133
       +
           .vote-section {

     

       134
       134
       +
             display: flex;

     

       135
       135
       +
             align-items: center;

     

       136
       136
       +
             gap: 1rem;

     

       137
       137
       +
           }

     

       138
       138
       +
       

     

       139
       139
       +
           .vote-count {

     

       140
       140
       +
             font-size: 1.25rem;

     

       141
       141
       +
             font-weight: 600;

     

       142
       142
       +
             color: var(--accent);

     

       143
       143
       +
             min-width: 3rem;

     

       144
       144
       +
             text-align: center;

     

       145
       145
       +
           }

     

       146
       146
       +
       

     

       147
       147
       +
           .vote-button {

     

       148
       148
       +
             padding: 0.5rem 1rem;

     

       149
       149
       +
             border-radius: 6px;

     

       150
       150
       +
             font-size: 0.875rem;

     

       151
       151
       +
             font-weight: 500;

     

       152
       152
       +
             cursor: pointer;

     

       153
       153
       +
             transition: all 0.2s;

     

       154
       154
       +
             border: 2px solid var(--secondary);

     

       155
       155
       +
             background: var(--background);

     

       156
       156
       +
             color: var(--text);

     

       157
       157
       +
           }

     

       158
       158
       +
       

     

       159
       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       160
       +
             border-color: var(--accent);

     

       161
       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       162
       +
           }

     

       163
       163
       +
       

     

       164
       164
       +
           .vote-button.voted {

     

       165
       165
       +
             border-color: var(--accent);

     

       166
       166
       +
             background: var(--accent);

     

       167
       167
       +
             color: var(--white);

     

       168
       168
       +
           }

     

       169
       169
       +
       

     

       170
       170
       +
           .vote-button:disabled {

     

       171
       171
       +
             opacity: 0.5;

     

       172
       172
       +
             cursor: not-allowed;

     

       173
       173
       +
           }

     

       174
       174
       +
       

     

       175
       175
       +
           .delete-button {

     

       176
       176
       +
             padding: 0.5rem;

     

       177
       177
       +
             border: none;

     

       178
       178
       +
             background: transparent;

     

       179
       179
       +
             color: var(--paynes-gray);

     

       180
       180
       +
             cursor: pointer;

     

       181
       181
       +
             border-radius: 4px;

     

       182
       182
       +
             transition: all 0.2s;

     

       183
       183
       +
           }

     

       184
       184
       +
       

     

       185
       185
       +
           .delete-button:hover {

     

       186
       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       187
       +
             color: red;

     

       188
       188
       +
           }

     

       189
       189
       +
       

     

       190
       190
       +
           .winning-badge {

     

       191
       191
       +
             background: var(--accent);

     

       192
       192
       +
             color: var(--white);

     

       193
       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       194
       +
             border-radius: 12px;

     

       195
       195
       +
             font-size: 0.75rem;

     

       196
       196
       +
             font-weight: 600;

     

       197
       197
       +
           }

     

       198
       198
       +
       

     

       199
       199
       +
           .error {

     

       200
       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       201
       +
             border: 1px solid red;

     

       202
       202
       +
             color: red;

     

       203
       203
       +
             padding: 0.75rem;

     

       204
       204
       +
             border-radius: 4px;

     

       205
       205
       +
             margin-bottom: 1rem;

     

       206
       206
       +
             font-size: 0.875rem;

     

       207
       207
       +
           }

     

       208
       208
       +
       

     

       209
       209
       +
           .empty-state {

     

       210
       210
       +
             text-align: center;

     

       211
       211
       +
             padding: 3rem 1rem;

     

       212
       212
       +
             color: var(--paynes-gray);

     

       213
       213
       +
           }

     

       214
       214
       +
       

     

       215
       215
       +
           .audio-player {

     

       216
       216
       +
             margin-top: 0.75rem;

     

       217
       217
       +
           }

     

       218
       218
       +
       

     

       219
       219
       +
           audio {

     

       220
       220
       +
             width: 100%;

     

       221
       221
       +
             height: 2.5rem;

     

       222
       222
       +
           }

     

       223
       223
       +
         `;

     

       224
       224
       +
       

     

       225
       225
       +
       	override connectedCallback() {

     

       226
       226
       +
       		super.connectedCallback();

     

       227
       227
       +
       		this.loadRecordings();

     

       228
       228
       +
       		// Refresh every 10 seconds

     

       229
       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	override disconnectedCallback() {

     

       233
       233
       +
       		super.disconnectedCallback();

     

       234
       234
       +
       		if (this.refreshInterval) {

     

       235
       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       236
       +
       		}

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	private async loadRecordings() {

     

       240
       240
       +
       		if (this.loadingInProgress) return;

     

       241
       241
       +
       

     

       242
       242
       +
       		this.loadingInProgress = true;

     

       243
       243
       +
       

     

       244
       244
       +
       		try {

     

       245
       245
       +
       			// Build URL with optional section_id parameter

     

       246
       246
       +
       			const url = new URL(

     

       247
       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       248
       +
       				window.location.origin,

     

       249
       249
       +
       			);

     

       250
       250
       +
       			if (this.sectionId !== null) {

     

       251
       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       252
       +
       			}

     

       253
       253
       +
       

     

       254
       254
       +
       			const response = await fetch(url.toString());

     

       255
       255
       +
       

     

       256
       256
       +
       			if (!response.ok) {

     

       257
       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       258
       +
       			}

     

       259
       259
       +
       

     

       260
       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       261
       +
       			this.recordings = data.recordings;

     

       262
       262
       +
       			this.userVote = data.user_vote;

     

       263
       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       265
       +
       

     

       266
       266
       +
       			// Calculate time remaining for first recording

     

       267
       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       269
       +
       				const now = Date.now() / 1000;

     

       270
       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       272
       +
       

     

       273
       273
       +
       				if (remaining > 0) {

     

       274
       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       277
       +
       				} else {

     

       278
       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       279
       +
       				}

     

       280
       280
       +
       			}

     

       281
       281
       +
       

     

       282
       282
       +
       			this.error = null;

     

       283
       283
       +
       		} catch (error) {

     

       284
       284
       +
       			this.error =

     

       285
       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       286
       +
       		} finally {

     

       287
       287
       +
       			this.loadingInProgress = false;

     

       288
       288
       +
       		}

     

       289
       289
       +
       	}

     

       290
       290
       +
       

     

       291
       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       292
       +
       		try {

     

       293
       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       294
       +
       				method: "POST",

     

       295
       295
       +
       			});

     

       296
       296
       +
       

     

       297
       297
       +
       			if (!response.ok) {

     

       298
       298
       +
       				throw new Error("Failed to vote");

     

       299
       299
       +
       			}

     

       300
       300
       +
       

     

       301
       301
       +
       			const data = await response.json();

     

       302
       302
       +
       

     

       303
       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       304
       +
       			if (data.winning_recording_id) {

     

       305
       305
       +
       				window.location.reload();

     

       306
       306
       +
       			} else {

     

       307
       307
       +
       				// Just reload recordings to show updated votes

     

       308
       308
       +
       				await this.loadRecordings();

     

       309
       309
       +
       			}

     

       310
       310
       +
       		} catch (error) {

     

       311
       311
       +
       			this.error =

     

       312
       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       313
       +
       		}

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       318
       +
       			return;

     

       319
       319
       +
       		}

     

       320
       320
       +
       

     

       321
       321
       +
       		try {

     

       322
       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       323
       +
       				method: "DELETE",

     

       324
       324
       +
       			});

     

       325
       325
       +
       

     

       326
       326
       +
       			if (!response.ok) {

     

       327
       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       328
       +
       			}

     

       329
       329
       +
       

     

       330
       330
       +
       			await this.loadRecordings();

     

       331
       331
       +
       		} catch (error) {

     

       332
       332
       +
       			this.error =

     

       333
       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       334
       +
       		}

     

       335
       335
       +
       	}

     

       336
       336
       +
       

     

       337
       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       338
       +
       		const now = Date.now() / 1000;

     

       339
       339
       +
       		const diff = now - timestamp;

     

       340
       340
       +
       

     

       341
       341
       +
       		if (diff < 60) return "just now";

     

       342
       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       345
       +
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	override render() {

     

       348
       348
       +
       		return html`

     

       349
       349
       +
             <div class="container">

     

       350
       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       351
       +
               <p class="info">

     

       352
       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       353
       +
               </p>

     

       354
       354
       +
       

     

       355
       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       356
       +
       

     

       357
       357
       +
               ${

     

       358
       358
       +
       					this.recordings.length > 0

     

       359
       359
       +
       						? html`

     

       360
       360
       +
                   <div class="stats">

     

       361
       361
       +
                     <div class="stat">

     

       362
       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       364
       +
                     </div>

     

       365
       365
       +
                     <div class="stat">

     

       366
       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       368
       +
                     </div>

     

       369
       369
       +
                     <div class="stat">

     

       370
       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       372
       +
                     </div>

     

       373
       373
       +
                   </div>

     

       374
       374
       +
       

     

       375
       375
       +
                   <div class="recordings-list">

     

       376
       376
       +
                     ${this.recordings.map(

     

       377
       377
       +
       								(recording) => html`

     

       378
       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       379
       +
                         <div class="recording-header">

     

       380
       380
       +
                           <div class="recording-info">

     

       381
       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       382
       +
                             <div class="recording-meta">

     

       383
       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       384
       +
                             </div>

     

       385
       385
       +
                           </div>

     

       386
       386
       +
       

     

       387
       387
       +
                           <div class="vote-section">

     

       388
       388
       +
                             ${

     

       389
       389
       +
       												this.winningRecordingId === recording.id

     

       390
       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       391
       +
       													: ""

     

       392
       392
       +
       											}

     

       393
       393
       +
                             

     

       394
       394
       +
                             <div class="vote-count">

     

       395
       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       396
       +
                             </div>

     

       397
       397
       +
       

     

       398
       398
       +
                             <button

     

       399
       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       402
       +
                             >

     

       403
       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       404
       +
                             </button>

     

       405
       405
       +
       

     

       406
       406
       +
                             <button

     

       407
       407
       +
                               class="delete-button"

     

       408
       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       409
       +
                               title="Delete recording"

     

       410
       410
       +
                             >

     

       411
       411
       +
                               🗑️

     

       412
       412
       +
                             </button>

     

       413
       413
       +
                           </div>

     

       414
       414
       +
                         </div>

     

       415
       415
       +
       

     

       416
       416
       +
                         <div class="audio-player">

     

       417
       417
       +
                           <audio controls preload="none">

     

       418
       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       419
       +
                           </audio>

     

       420
       420
       +
                         </div>

     

       421
       421
       +
                       </div>

     

       422
       422
       +
                     `,

     

       423
       423
       +
       							)}

     

       424
       424
       +
                   </div>

     

       425
       425
       +
                 `

     

       426
       426
       +
       						: html`

     

       427
       427
       +
                   <div class="empty-state">

     

       428
       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       430
       +
                   </div>

     

       431
       431
       +
                 `

     

       432
       432
       +
       				}

     

       433
       433
       +
             </div>

     

       434
       434
       +
           `;

     

       435
       435
       +
       	}

     

       436
       436
       +
       }

+335

src/components/reset-password-form.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       import { hashPasswordClient } from "../lib/client-auth";

     

       4
       4
       +
       

     

       5
       5
       +
       @customElement("reset-password-form")

     

       6
       6
       +
       export class ResetPasswordForm extends LitElement {

     

       7
       7
       +
       	@property({ type: String }) token: string | null = null;

     

       8
       8
       +
       	@state() private email: string | null = null;

     

       9
       9
       +
       	@state() private password = "";

     

       10
       10
       +
       	@state() private confirmPassword = "";

     

       11
       11
       +
       	@state() private error = "";

     

       12
       12
       +
       	@state() private isSubmitting = false;

     

       13
       13
       +
       	@state() private isSuccess = false;

     

       14
       14
       +
       	@state() private isLoadingEmail = false;

     

       15
       15
       +
       

     

       16
       16
       +
       	static override styles = css`

     

       17
       17
       +
       		:host {

     

       18
       18
       +
       			display: block;

     

       19
       19
       +
       		}

     

       20
       20
       +
       

     

       21
       21
       +
       		.reset-card {

     

       22
       22
       +
       			background: var(--background);

     

       23
       23
       +
       			border: 2px solid var(--secondary);

     

       24
       24
       +
       			border-radius: 12px;

     

       25
       25
       +
       			padding: 2.5rem;

     

       26
       26
       +
       			max-width: 25rem;

     

       27
       27
       +
       			width: 100%;

     

       28
       28
       +
       			box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);

     

       29
       29
       +
       		}

     

       30
       30
       +
       

     

       31
       31
       +
       		.reset-title {

     

       32
       32
       +
       			margin-top: 0;

     

       33
       33
       +
       			margin-bottom: 2rem;

     

       34
       34
       +
       			color: var(--text);

     

       35
       35
       +
       			text-align: center;

     

       36
       36
       +
       			font-size: 1.75rem;

     

       37
       37
       +
       		}

     

       38
       38
       +
       

     

       39
       39
       +
       		.form-group {

     

       40
       40
       +
       			margin-bottom: 1.5rem;

     

       41
       41
       +
       		}

     

       42
       42
       +
       

     

       43
       43
       +
       		label {

     

       44
       44
       +
       			display: block;

     

       45
       45
       +
       			margin-bottom: 0.25rem;

     

       46
       46
       +
       			font-weight: 500;

     

       47
       47
       +
       			color: var(--text);

     

       48
       48
       +
       			font-size: 0.875rem;

     

       49
       49
       +
       		}

     

       50
       50
       +
       

     

       51
       51
       +
       		input {

     

       52
       52
       +
       			width: 100%;

     

       53
       53
       +
       			padding: 0.75rem;

     

       54
       54
       +
       			border: 2px solid var(--secondary);

     

       55
       55
       +
       			border-radius: 6px;

     

       56
       56
       +
       			font-size: 1rem;

     

       57
       57
       +
       			font-family: inherit;

     

       58
       58
       +
       			background: var(--background);

     

       59
       59
       +
       			color: var(--text);

     

       60
       60
       +
       			transition: all 0.2s;

     

       61
       61
       +
       			box-sizing: border-box;

     

       62
       62
       +
       		}

     

       63
       63
       +
       

     

       64
       64
       +
       		input::placeholder {

     

       65
       65
       +
       			color: var(--secondary);

     

       66
       66
       +
       			opacity: 1;

     

       67
       67
       +
       		}

     

       68
       68
       +
       

     

       69
       69
       +
       		input:focus {

     

       70
       70
       +
       			outline: none;

     

       71
       71
       +
       			border-color: var(--primary);

     

       72
       72
       +
       		}

     

       73
       73
       +
       

     

       74
       74
       +
       		.error-banner {

     

       75
       75
       +
       			background: #fecaca;

     

       76
       76
       +
       			border: 2px solid rgba(220, 38, 38, 0.8);

     

       77
       77
       +
       			border-radius: 6px;

     

       78
       78
       +
       			padding: 1rem;

     

       79
       79
       +
       			margin-bottom: 1rem;

     

       80
       80
       +
       			color: #dc2626;

     

       81
       81
       +
       			font-weight: 500;

     

       82
       82
       +
       		}

     

       83
       83
       +
       

     

       84
       84
       +
       		.btn-primary {

     

       85
       85
       +
       			width: 100%;

     

       86
       86
       +
       			padding: 0.75rem 1.5rem;

     

       87
       87
       +
       			border: 2px solid var(--primary);

     

       88
       88
       +
       			border-radius: 6px;

     

       89
       89
       +
       			font-size: 1rem;

     

       90
       90
       +
       			font-weight: 500;

     

       91
       91
       +
       			cursor: pointer;

     

       92
       92
       +
       			transition: all 0.2s;

     

       93
       93
       +
       			font-family: inherit;

     

       94
       94
       +
       			background: var(--primary);

     

       95
       95
       +
       			color: white;

     

       96
       96
       +
       			margin-top: 0.5rem;

     

       97
       97
       +
       		}

     

       98
       98
       +
       

     

       99
       99
       +
       		.btn-primary:hover:not(:disabled) {

     

       100
       100
       +
       			background: transparent;

     

       101
       101
       +
       			color: var(--primary);

     

       102
       102
       +
       		}

     

       103
       103
       +
       

     

       104
       104
       +
       		.btn-primary:disabled {

     

       105
       105
       +
       			opacity: 0.6;

     

       106
       106
       +
       			cursor: not-allowed;

     

       107
       107
       +
       		}

     

       108
       108
       +
       

     

       109
       109
       +
       		.back-link {

     

       110
       110
       +
       			display: block;

     

       111
       111
       +
       			text-align: center;

     

       112
       112
       +
       			margin-top: 1.5rem;

     

       113
       113
       +
       			color: var(--primary);

     

       114
       114
       +
       			text-decoration: none;

     

       115
       115
       +
       			font-weight: 500;

     

       116
       116
       +
       			font-size: 0.875rem;

     

       117
       117
       +
       			transition: all 0.2s;

     

       118
       118
       +
       		}

     

       119
       119
       +
       

     

       120
       120
       +
       		.back-link:hover {

     

       121
       121
       +
       			color: var(--accent);

     

       122
       122
       +
       		}

     

       123
       123
       +
       

     

       124
       124
       +
       		.success-message {

     

       125
       125
       +
       			text-align: center;

     

       126
       126
       +
       		}

     

       127
       127
       +
       

     

       128
       128
       +
       		.success-icon {

     

       129
       129
       +
       			font-size: 3rem;

     

       130
       130
       +
       			margin-bottom: 1rem;

     

       131
       131
       +
       		}

     

       132
       132
       +
       

     

       133
       133
       +
       		.success-text {

     

       134
       134
       +
       			color: var(--primary);

     

       135
       135
       +
       			font-size: 1.25rem;

     

       136
       136
       +
       			font-weight: 500;

     

       137
       137
       +
       			margin-bottom: 1.5rem;

     

       138
       138
       +
       		}

     

       139
       139
       +
       

     

       140
       140
       +
       		.success-link {

     

       141
       141
       +
       			display: inline-block;

     

       142
       142
       +
       			padding: 0.75rem 1.5rem;

     

       143
       143
       +
       			background: var(--accent);

     

       144
       144
       +
       			color: white;

     

       145
       145
       +
       			text-decoration: none;

     

       146
       146
       +
       			border-radius: 6px;

     

       147
       147
       +
       			font-weight: 500;

     

       148
       148
       +
       			transition: all 0.2s;

     

       149
       149
       +
       		}

     

       150
       150
       +
       

     

       151
       151
       +
       		.success-link:hover {

     

       152
       152
       +
       			background: var(--primary);

     

       153
       153
       +
       		}

     

       154
       154
       +
       	`;

     

       155
       155
       +
       

     

       156
       156
       +
       	override async updated(changedProperties: Map<string, unknown>) {

     

       157
       157
       +
       		super.updated(changedProperties);

     

       158
       158
       +
       

     

       159
       159
       +
       		// When token property changes and we don't have email yet, load it

     

       160
       160
       +
       		if (

     

       161
       161
       +
       			changedProperties.has("token") &&

     

       162
       162
       +
       			this.token &&

     

       163
       163
       +
       			!this.email &&

     

       164
       164
       +
       			!this.isLoadingEmail

     

       165
       165
       +
       		) {

     

       166
       166
       +
       			await this.loadEmail();

     

       167
       167
       +
       		}

     

       168
       168
       +
       	}

     

       169
       169
       +
       

     

       170
       170
       +
       	private async loadEmail() {

     

       171
       171
       +
       		this.isLoadingEmail = true;

     

       172
       172
       +
       		this.error = "";

     

       173
       173
       +
       

     

       174
       174
       +
       		try {

     

       175
       175
       +
       			const url = `/api/auth/reset-password?token=${encodeURIComponent(this.token || "")}`;

     

       176
       176
       +
       			const response = await fetch(url);

     

       177
       177
       +
       			const data = await response.json();

     

       178
       178
       +
       

     

       179
       179
       +
       			if (!response.ok) {

     

       180
       180
       +
       				throw new Error(data.error || "Invalid or expired reset token");

     

       181
       181
       +
       			}

     

       182
       182
       +
       

     

       183
       183
       +
       			this.email = data.email;

     

       184
       184
       +
       		} catch (err) {

     

       185
       185
       +
       			this.error =

     

       186
       186
       +
       				err instanceof Error ? err.message : "Failed to verify reset token";

     

       187
       187
       +
       		} finally {

     

       188
       188
       +
       			this.isLoadingEmail = false;

     

       189
       189
       +
       		}

     

       190
       190
       +
       	}

     

       191
       191
       +
       

     

       192
       192
       +
       	override render() {

     

       193
       193
       +
       		if (!this.token) {

     

       194
       194
       +
       			return html`

     

       195
       195
       +
       				<div class="reset-card">

     

       196
       196
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       197
       197
       +
       					<div class="error-banner">Invalid or missing reset token</div>

     

       198
       198
       +
       					<a href="/" class="back-link">Back to home</a>

     

       199
       199
       +
       				</div>

     

       200
       200
       +
       			`;

     

       201
       201
       +
       		}

     

       202
       202
       +
       

     

       203
       203
       +
       		if (this.isLoadingEmail) {

     

       204
       204
       +
       			return html`

     

       205
       205
       +
       				<div class="reset-card">

     

       206
       206
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       207
       207
       +
       					<p style="text-align: center; color: var(--text);">Verifying reset token...</p>

     

       208
       208
       +
       				</div>

     

       209
       209
       +
       			`;

     

       210
       210
       +
       		}

     

       211
       211
       +
       

     

       212
       212
       +
       		if (this.error && !this.email) {

     

       213
       213
       +
       			return html`

     

       214
       214
       +
       				<div class="reset-card">

     

       215
       215
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       216
       216
       +
       					<div class="error-banner">${this.error}</div>

     

       217
       217
       +
       					<a href="/" class="back-link">Back to home</a>

     

       218
       218
       +
       				</div>

     

       219
       219
       +
       			`;

     

       220
       220
       +
       		}

     

       221
       221
       +
       

     

       222
       222
       +
       		if (this.isSuccess) {

     

       223
       223
       +
       			return html`

     

       224
       224
       +
       				<div class="reset-card">

     

       225
       225
       +
       					<div class="success-message">

     

       226
       226
       +
       						<div class="success-icon">✓</div>

     

       227
       227
       +
       						<div class="success-text">Password reset successfully!</div>

     

       228
       228
       +
       						<a href="/" class="success-link">Go to home</a>

     

       229
       229
       +
       					</div>

     

       230
       230
       +
       				</div>

     

       231
       231
       +
       			`;

     

       232
       232
       +
       		}

     

       233
       233
       +
       

     

       234
       234
       +
       		return html`

     

       235
       235
       +
       			<div class="reset-card">

     

       236
       236
       +
       				<h1 class="reset-title">Reset Password</h1>

     

       237
       237
       +
       				

     

       238
       238
       +
       				<form @submit=${this.handleSubmit}>

     

       239
       239
       +
       					${

     

       240
       240
       +
       						this.error

     

       241
       241
       +
       							? html`<div class="error-banner">${this.error}</div>`

     

       242
       242
       +
       							: ""

     

       243
       243
       +
       					}

     

       244
       244
       +
       					

     

       245
       245
       +
       					<div class="form-group">

     

       246
       246
       +
       						<label for="password">New Password</label>

     

       247
       247
       +
       						<input 

     

       248
       248
       +
       							type="password" 

     

       249
       249
       +
       							id="password" 

     

       250
       250
       +
       							.value=${this.password}

     

       251
       251
       +
       							@input=${(e: Event) => {

     

       252
       252
       +
       								this.password = (e.target as HTMLInputElement).value;

     

       253
       253
       +
       							}}

     

       254
       254
       +
       							required 

     

       255
       255
       +
       							minlength="8"

     

       256
       256
       +
       							placeholder="Enter new password (min 8 characters)"

     

       257
       257
       +
       						>

     

       258
       258
       +
       					</div>

     

       259
       259
       +
       					

     

       260
       260
       +
       					<div class="form-group">

     

       261
       261
       +
       						<label for="confirm-password">Confirm Password</label>

     

       262
       262
       +
       						<input 

     

       263
       263
       +
       							type="password" 

     

       264
       264
       +
       							id="confirm-password" 

     

       265
       265
       +
       							.value=${this.confirmPassword}

     

       266
       266
       +
       							@input=${(e: Event) => {

     

       267
       267
       +
       								this.confirmPassword = (e.target as HTMLInputElement).value;

     

       268
       268
       +
       							}}

     

       269
       269
       +
       							required 

     

       270
       270
       +
       							minlength="8"

     

       271
       271
       +
       							placeholder="Confirm new password"

     

       272
       272
       +
       						>

     

       273
       273
       +
       					</div>

     

       274
       274
       +
       					

     

       275
       275
       +
       					<button type="submit" class="btn-primary" ?disabled=${this.isSubmitting}>

     

       276
       276
       +
       						${this.isSubmitting ? "Resetting..." : "Reset Password"}

     

       277
       277
       +
       					</button>

     

       278
       278
       +
       				</form>

     

       279
       279
       +
       				

     

       280
       280
       +
       				<a href="/" class="back-link">Back to home</a>

     

       281
       281
       +
       			</div>

     

       282
       282
       +
       		`;

     

       283
       283
       +
       	}

     

       284
       284
       +
       

     

       285
       285
       +
       	private async handleSubmit(e: Event) {

     

       286
       286
       +
       		e.preventDefault();

     

       287
       287
       +
       		this.error = "";

     

       288
       288
       +
       

     

       289
       289
       +
       		// Validate passwords match

     

       290
       290
       +
       		if (this.password !== this.confirmPassword) {

     

       291
       291
       +
       			this.error = "Passwords do not match";

     

       292
       292
       +
       			return;

     

       293
       293
       +
       		}

     

       294
       294
       +
       

     

       295
       295
       +
       		// Validate password length

     

       296
       296
       +
       		if (this.password.length < 8) {

     

       297
       297
       +
       			this.error = "Password must be at least 8 characters";

     

       298
       298
       +
       			return;

     

       299
       299
       +
       		}

     

       300
       300
       +
       

     

       301
       301
       +
       		this.isSubmitting = true;

     

       302
       302
       +
       

     

       303
       303
       +
       		try {

     

       304
       304
       +
       			if (!this.email) {

     

       305
       305
       +
       				throw new Error("Email not loaded");

     

       306
       306
       +
       			}

     

       307
       307
       +
       

     

       308
       308
       +
       			// Hash password client-side with user's email

     

       309
       309
       +
       			const hashedPassword = await hashPasswordClient(

     

       310
       310
       +
       				this.password,

     

       311
       311
       +
       				this.email,

     

       312
       312
       +
       			);

     

       313
       313
       +
       

     

       314
       314
       +
       			const response = await fetch("/api/auth/reset-password", {

     

       315
       315
       +
       				method: "POST",

     

       316
       316
       +
       				headers: { "Content-Type": "application/json" },

     

       317
       317
       +
       				body: JSON.stringify({ token: this.token, password: hashedPassword }),

     

       318
       318
       +
       			});

     

       319
       319
       +
       

     

       320
       320
       +
       			const data = await response.json();

     

       321
       321
       +
       

     

       322
       322
       +
       			if (!response.ok) {

     

       323
       323
       +
       				throw new Error(data.error || "Failed to reset password");

     

       324
       324
       +
       			}

     

       325
       325
       +
       

     

       326
       326
       +
       			// Show success message

     

       327
       327
       +
       			this.isSuccess = true;

     

       328
       328
       +
       		} catch (err) {

     

       329
       329
       +
       			this.error =

     

       330
       330
       +
       				err instanceof Error ? err.message : "Failed to reset password";

     

       331
       331
       +
       		} finally {

     

       332
       332
       +
       			this.isSubmitting = false;

     

       333
       333
       +
       		}

     

       334
       334
       +
       	}

     

       335
       335
       +
       }

+10 -5

src/components/transcription.ts

···

       565
       565
        
       

     

       566
       566
        
       	async checkHealth() {

     

       567
       567
        
       		try {

     

       568
       568
       -
       			const response = await fetch("/api/transcriptions/health");

     

       568
       568
       +
       			const response = await fetch("/api/health");

     

       569
       569
        
       			if (response.ok) {

     

       570
       570
        
       				const data = await response.json();

     

       571
       571
       -
       				this.serviceAvailable = data.available;

     

       571
       571
       +
       				this.serviceAvailable = data.status === "healthy";

     

       572
       572
        
       			} else {

     

       573
       573
        
       				this.serviceAvailable = false;

     

       574
       574
        
       			}

     
···

       792
       792
        
       	}

     

       793
       793
        
       

     

       794
       794
        
       	override render() {

     

       795
       795
       -
       		const canUpload = this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       795
       795
       +
       		const canUpload =

     

       796
       796
       +
       			this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       796
       797
        
       

     

       797
       798
        
       		return html`

     

       798
       798
       -
             ${!this.hasSubscription && !this.isAdmin ? html`

     

       799
       799
       +
             ${

     

       800
       800
       +
       				!this.hasSubscription && !this.isAdmin

     

       801
       801
       +
       					? html`

     

       799
       802
        
               <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin-bottom: 2rem; text-align: center;">

     

       800
       803
        
                 <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Upload Transcriptions</h3>

     

       801
       804
        
                 <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and transcribe audio files.</p>

     

       802
       805
        
                 <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       803
       806
        
               </div>

     

       804
       804
       -
             ` : ''}

     

       807
       807
       +
             `

     

       808
       808
       +
       					: ""

     

       809
       809
       +
       			}

     

       805
       810
        
       

     

       806
       811
        
             <div class="upload-area ${this.dragOver ? "drag-over" : ""} ${!canUpload ? "disabled" : ""}"

     

       807
       812
        
                  @dragover=${canUpload ? this.handleDragOver : null}

+340 -44

src/components/user-settings.ts

···

       36
       36
        
       	canceled_at: number | null;

     

       37
       37
        
       }

     

       38
       38
        
       

     

       39
       39
       -
       type SettingsPage = "account" | "sessions" | "passkeys" | "billing" | "danger";

     

       39
       39
       +
       type SettingsPage =

     

       40
       40
       +
       	| "account"

     

       41
       41
       +
       	| "sessions"

     

       42
       42
       +
       	| "passkeys"

     

       43
       43
       +
       	| "billing"

     

       44
       44
       +
       	| "notifications"

     

       45
       45
       +
       	| "danger";

     

       40
       46
        
       

     

       41
       47
        
       @customElement("user-settings")

     

       42
       48
        
       export class UserSettings extends LitElement {

     
···

       59
       65
        
       	@state() newAvatar = "";

     

       60
       66
        
       	@state() passkeySupported = false;

     

       61
       67
        
       	@state() addingPasskey = false;

     

       68
       68
       +
       	@state() emailNotificationsEnabled = true;

     

       69
       69
       +
       	@state() deletingAccount = false;

     

       70
       70
       +
       	@state() emailChangeMessage = "";

     

       71
       71
       +
       	@state() pendingEmailChange = "";

     

       72
       72
       +
       	@state() updatingEmail = false;

     

       62
       73
        
       

     

       63
       74
        
       	static override styles = css`

     

       64
       75
        
       		:host {

     
···

       286
       297
        
       			line-height: 1.5;

     

       287
       298
        
       		}

     

       288
       299
        
       

     

       300
       300
       +
       		.success-message {

     

       301
       301
       +
       			padding: 1rem;

     

       302
       302
       +
       			background: rgba(76, 175, 80, 0.1);

     

       303
       303
       +
       			border: 1px solid rgba(76, 175, 80, 0.3);

     

       304
       304
       +
       			border-radius: 0.5rem;

     

       305
       305
       +
       			color: var(--text);

     

       306
       306
       +
       		}

     

       307
       307
       +
       

     

       308
       308
       +
       		.spinner {

     

       309
       309
       +
       			display: inline-block;

     

       310
       310
       +
       			width: 1rem;

     

       311
       311
       +
       			height: 1rem;

     

       312
       312
       +
       			border: 2px solid rgba(255, 255, 255, 0.3);

     

       313
       313
       +
       			border-top-color: white;

     

       314
       314
       +
       			border-radius: 50%;

     

       315
       315
       +
       			animation: spin 0.6s linear infinite;

     

       316
       316
       +
       		}

     

       317
       317
       +
       

     

       318
       318
       +
       		@keyframes spin {

     

       319
       319
       +
       			to {

     

       320
       320
       +
       				transform: rotate(360deg);

     

       321
       321
       +
       			}

     

       322
       322
       +
       		}

     

       323
       323
       +
       

     

       289
       324
        
       		.session-list {

     

       290
       325
        
       			display: flex;

     

       291
       326
        
       			flex-direction: column;

     
···

       418
       453
        
       			color: var(--accent);

     

       419
       454
        
       		}

     

       420
       455
        
       

     

       456
       456
       +
       		.error-banner {

     

       457
       457
       +
       			background: #fecaca;

     

       458
       458
       +
       			border: 2px solid rgba(220, 38, 38, 0.8);

     

       459
       459
       +
       			border-radius: 6px;

     

       460
       460
       +
       			padding: 1rem;

     

       461
       461
       +
       			margin-bottom: 1.5rem;

     

       462
       462
       +
       			color: #dc2626;

     

       463
       463
       +
       			font-weight: 500;

     

       464
       464
       +
       		}

     

       465
       465
       +
       

     

       421
       466
        
       		.loading {

     

       422
       467
        
       			text-align: center;

     

       423
       468
        
       			color: var(--text);

     

       424
       469
        
       			padding: 2rem;

     

       425
       470
        
       		}

     

       426
       471
        
       

     

       472
       472
       +
       		.setting-row {

     

       473
       473
       +
       			display: flex;

     

       474
       474
       +
       			align-items: center;

     

       475
       475
       +
       			justify-content: space-between;

     

       476
       476
       +
       			padding: 1rem;

     

       477
       477
       +
       			border: 1px solid var(--secondary);

     

       478
       478
       +
       			border-radius: 6px;

     

       479
       479
       +
       			gap: 1rem;

     

       480
       480
       +
       		}

     

       481
       481
       +
       

     

       482
       482
       +
       		.setting-info {

     

       483
       483
       +
       			flex: 1;

     

       484
       484
       +
       		}

     

       485
       485
       +
       

     

       486
       486
       +
       		.toggle {

     

       487
       487
       +
       			position: relative;

     

       488
       488
       +
       			display: inline-block;

     

       489
       489
       +
       			width: 48px;

     

       490
       490
       +
       			height: 24px;

     

       491
       491
       +
       		}

     

       492
       492
       +
       

     

       493
       493
       +
       		.toggle input {

     

       494
       494
       +
       			opacity: 0;

     

       495
       495
       +
       			width: 0;

     

       496
       496
       +
       			height: 0;

     

       497
       497
       +
       		}

     

       498
       498
       +
       

     

       499
       499
       +
       		.toggle-slider {

     

       500
       500
       +
       			position: absolute;

     

       501
       501
       +
       			cursor: pointer;

     

       502
       502
       +
       			top: 0;

     

       503
       503
       +
       			left: 0;

     

       504
       504
       +
       			right: 0;

     

       505
       505
       +
       			bottom: 0;

     

       506
       506
       +
       			background-color: var(--secondary);

     

       507
       507
       +
       			transition: 0.2s;

     

       508
       508
       +
       			border-radius: 24px;

     

       509
       509
       +
       		}

     

       510
       510
       +
       

     

       511
       511
       +
       		.toggle-slider:before {

     

       512
       512
       +
       			position: absolute;

     

       513
       513
       +
       			content: "";

     

       514
       514
       +
       			height: 18px;

     

       515
       515
       +
       			width: 18px;

     

       516
       516
       +
       			left: 3px;

     

       517
       517
       +
       			bottom: 3px;

     

       518
       518
       +
       			background-color: white;

     

       519
       519
       +
       			transition: 0.2s;

     

       520
       520
       +
       			border-radius: 50%;

     

       521
       521
       +
       		}

     

       522
       522
       +
       

     

       523
       523
       +
       		.toggle input:checked + .toggle-slider {

     

       524
       524
       +
       			background-color: var(--primary);

     

       525
       525
       +
       		}

     

       526
       526
       +
       

     

       527
       527
       +
       		.toggle input:checked + .toggle-slider:before {

     

       528
       528
       +
       			transform: translateX(24px);

     

       529
       529
       +
       		}

     

       530
       530
       +
       

     

       427
       531
        
       		@media (max-width: 768px) {

     

       428
       532
        
       			.settings-container {

     

       429
       533
        
       				padding: 1rem;

     
···

       446
       550
        
       	override async connectedCallback() {

     

       447
       551
        
       		super.connectedCallback();

     

       448
       552
        
       		this.passkeySupported = isPasskeySupported();

     

       449
       449
       -
       		

     

       553
       553
       +
       

     

       450
       554
        
       		// Check for tab query parameter

     

       451
       555
        
       		const params = new URLSearchParams(window.location.search);

     

       452
       556
        
       		const tab = params.get("tab");

     

       453
       557
        
       		if (tab && this.isValidTab(tab)) {

     

       454
       558
        
       			this.currentPage = tab as SettingsPage;

     

       455
       559
        
       		}

     

       456
       456
       -
       		

     

       560
       560
       +
       

     

       457
       561
        
       		await this.loadUser();

     

       458
       562
        
       		await this.loadSessions();

     

       459
       563
        
       		await this.loadSubscription();

     
···

       463
       567
        
       	}

     

       464
       568
        
       

     

       465
       569
        
       	private isValidTab(tab: string): boolean {

     

       466
       466
       -
       		return ["account", "sessions", "passkeys", "billing", "danger"].includes(tab);

     

       570
       570
       +
       		return [

     

       571
       571
       +
       			"account",

     

       572
       572
       +
       			"sessions",

     

       573
       573
       +
       			"passkeys",

     

       574
       574
       +
       			"billing",

     

       575
       575
       +
       			"notifications",

     

       576
       576
       +
       			"danger",

     

       577
       577
       +
       		].includes(tab);

     

       467
       578
        
       	}

     

       468
       579
        
       

     

       469
       580
        
       	private setTab(tab: SettingsPage) {

     

       470
       581
        
       		this.currentPage = tab;

     

       582
       582
       +
       		this.error = ""; // Clear errors when switching tabs

     

       471
       583
        
       		// Update URL without reloading page

     

       472
       584
        
       		const url = new URL(window.location.href);

     

       473
       585
        
       		url.searchParams.set("tab", tab);

     
···

       483
       595
        
       				return;

     

       484
       596
        
       			}

     

       485
       597
        
       

     

       486
       486
       -
       			this.user = await response.json();

     

       598
       598
       +
       			const data = await response.json();

     

       599
       599
       +
       			this.user = data;

     

       600
       600
       +
       			this.emailNotificationsEnabled = data.email_notifications_enabled ?? true;

     

       487
       601
        
       		} finally {

     

       488
       602
        
       			this.loading = false;

     

       489
       603
        
       		}

     
···

       558
       672
        
       			return;

     

       559
       673
        
       		}

     

       560
       674
        
       

     

       675
       675
       +
       		this.error = "";

     

       561
       676
        
       		try {

     

       562
       677
        
       			const response = await fetch(`/api/passkeys/${passkeyId}`, {

     

       563
       678
        
       				method: "DELETE",

     

       564
       679
        
       			});

     

       565
       680
        
       

     

       566
       681
        
       			if (!response.ok) {

     

       567
       567
       -
       				const error = await response.json();

     

       568
       568
       -
       				this.error = error.error || "Failed to delete passkey";

     

       682
       682
       +
       				const data = await response.json();

     

       683
       683
       +
       				this.error = data.error || "Failed to delete passkey";

     

       569
       684
        
       				return;

     

       570
       685
        
       			}

     

       571
       686
        
       

     

       572
       687
        
       			// Reload passkeys

     

       573
       688
        
       			await this.loadPasskeys();

     

       574
       574
       -
       		} catch {

     

       575
       575
       -
       			this.error = "Failed to delete passkey";

     

       689
       689
       +
       		} catch (err) {

     

       690
       690
       +
       			this.error =

     

       691
       691
       +
       				err instanceof Error ? err.message : "Failed to delete passkey";

     

       576
       692
        
       		}

     

       577
       693
        
       	}

     

       578
       694
        
       

     

       579
       695
        
       	async handleLogout() {

     

       696
       696
       +
       		this.error = "";

     

       580
       697
        
       		try {

     

       581
       581
       -
       			await fetch("/api/auth/logout", { method: "POST" });

     

       698
       698
       +
       			const response = await fetch("/api/auth/logout", { method: "POST" });

     

       699
       699
       +
       

     

       700
       700
       +
       			if (!response.ok) {

     

       701
       701
       +
       				const data = await response.json();

     

       702
       702
       +
       				this.error = data.error || "Failed to logout";

     

       703
       703
       +
       				return;

     

       704
       704
       +
       			}

     

       705
       705
       +
       

     

       582
       706
        
       			window.location.href = "/";

     

       583
       583
       -
       		} catch {

     

       584
       584
       -
       			this.error = "Failed to logout";

     

       707
       707
       +
       		} catch (err) {

     

       708
       708
       +
       			this.error = err instanceof Error ? err.message : "Failed to logout";

     

       585
       709
        
       		}

     

       586
       710
        
       	}

     

       587
       711
        
       

     

       588
       712
        
       	async handleDeleteAccount() {

     

       713
       713
       +
       		this.deletingAccount = true;

     

       714
       714
       +
       		this.error = "";

     

       715
       715
       +
       		document.body.style.cursor = "wait";

     

       716
       716
       +
       

     

       589
       717
        
       		try {

     

       590
       590
       -
       			const response = await fetch("/api/auth/delete-account", {

     

       718
       718
       +
       			const response = await fetch("/api/user", {

     

       591
       719
        
       				method: "DELETE",

     

       592
       720
        
       			});

     

       593
       721
        
       

     

       594
       722
        
       			if (!response.ok) {

     

       595
       595
       -
       				this.error = "Failed to delete account";

     

       723
       723
       +
       				const data = await response.json();

     

       724
       724
       +
       				this.error = data.error || "Failed to delete account";

     

       596
       725
        
       				return;

     

       597
       726
        
       			}

     

       598
       727
        
       

     
···

       600
       729
        
       		} catch {

     

       601
       730
        
       			this.error = "Failed to delete account";

     

       602
       731
        
       		} finally {

     

       732
       732
       +
       			this.deletingAccount = false;

     

       603
       733
        
       			this.showDeleteConfirm = false;

     

       734
       734
       +
       			document.body.style.cursor = "";

     

       604
       735
        
       		}

     

       605
       736
        
       	}

     

       606
       737
        
       

     

       607
       738
        
       	async handleUpdateEmail() {

     

       739
       739
       +
       		this.error = "";

     

       740
       740
       +
       		this.emailChangeMessage = "";

     

       608
       741
        
       		if (!this.newEmail) {

     

       609
       742
        
       			this.error = "Email required";

     

       610
       743
        
       			return;

     

       611
       744
        
       		}

     

       612
       745
        
       

     

       746
       746
       +
       		this.updatingEmail = true;

     

       613
       747
        
       		try {

     

       614
       748
        
       			const response = await fetch("/api/user/email", {

     

       615
       749
        
       				method: "PUT",

     
···

       617
       751
        
       				body: JSON.stringify({ email: this.newEmail }),

     

       618
       752
        
       			});

     

       619
       753
        
       

     

       754
       754
       +
       			const data = await response.json();

     

       755
       755
       +
       

     

       620
       756
        
       			if (!response.ok) {

     

       621
       621
       -
       				const data = await response.json();

     

       622
       757
        
       				this.error = data.error || "Failed to update email";

     

       623
       758
        
       				return;

     

       624
       759
        
       			}

     

       625
       760
        
       

     

       626
       626
       -
       			// Reload user data

     

       627
       627
       -
       			await this.loadUser();

     

       761
       761
       +
       			// Show success message with pending email

     

       762
       762
       +
       			this.emailChangeMessage = data.message || "Verification email sent";

     

       763
       763
       +
       			this.pendingEmailChange = data.pendingEmail || this.newEmail;

     

       628
       764
        
       			this.editingEmail = false;

     

       629
       765
        
       			this.newEmail = "";

     

       630
       766
        
       		} catch {

     

       631
       767
        
       			this.error = "Failed to update email";

     

       768
       768
       +
       		} finally {

     

       769
       769
       +
       			this.updatingEmail = false;

     

       632
       770
        
       		}

     

       633
       771
        
       	}

     

       634
       772
        
       

     

       635
       773
        
       	async handleUpdatePassword() {

     

       774
       774
       +
       		this.error = "";

     

       636
       775
        
       		if (!this.newPassword) {

     

       637
       776
        
       			this.error = "Password required";

     

       638
       777
        
       			return;

     
···

       670
       809
        
       	}

     

       671
       810
        
       

     

       672
       811
        
       	async handleUpdateName() {

     

       812
       812
       +
       		this.error = "";

     

       673
       813
        
       		if (!this.newName) {

     

       674
       814
        
       			this.error = "Name required";

     

       675
       815
        
       			return;

     
···

       697
       837
        
       	}

     

       698
       838
        
       

     

       699
       839
        
       	async handleUpdateAvatar() {

     

       840
       840
       +
       		this.error = "";

     

       700
       841
        
       		if (!this.newAvatar) {

     

       701
       842
        
       			this.error = "Avatar required";

     

       702
       843
        
       			return;

     
···

       844
       985
        
       	}

     

       845
       986
        
       

     

       846
       987
        
       	async handleKillSession(sessionId: string) {

     

       988
       988
       +
       		this.error = "";

     

       847
       989
        
       		try {

     

       848
       990
        
       			const response = await fetch(`/api/sessions`, {

     

       849
       991
        
       				method: "DELETE",

     
···

       895
       1037
        
       

     

       896
       1038
        
       		return html`

     

       897
       1039
        
       			<div class="content-inner">

     

       1040
       1040
       +
       			${

     

       1041
       1041
       +
       				this.error

     

       1042
       1042
       +
       					? html`

     

       1043
       1043
       +
       				<div class="error-banner">

     

       1044
       1044
       +
       					${this.error}

     

       1045
       1045
       +
       				</div>

     

       1046
       1046
       +
       			`

     

       1047
       1047
       +
       					: ""

     

       1048
       1048
       +
       			}

     

       898
       1049
        
       			<div class="section">

     

       899
       1050
        
       				<h2 class="section-title">Profile Information</h2>

     

       900
       1051
        
       

     
···

       932
       1083
        
       				<div class="field-group">

     

       933
       1084
        
       					<label class="field-label">Email</label>

     

       934
       1085
        
       					${

     

       935
       935
       -
       						this.editingEmail

     

       1086
       1086
       +
       						this.emailChangeMessage

     

       936
       1087
        
       							? html`

     

       1088
       1088
       +
       							<div class="success-message" style="margin-bottom: 1rem;">

     

       1089
       1089
       +
       								${this.emailChangeMessage}

     

       1090
       1090
       +
       								${this.pendingEmailChange ? html`<br><strong>New email:</strong> ${this.pendingEmailChange}` : ""}

     

       1091
       1091
       +
       							</div>

     

       1092
       1092
       +
       							<div class="field-row">

     

       1093
       1093
       +
       								<div class="field-value">${this.user.email}</div>

     

       1094
       1094
       +
       							</div>

     

       1095
       1095
       +
       						  `

     

       1096
       1096
       +
       							: this.editingEmail

     

       1097
       1097
       +
       								? html`

     

       937
       1098
        
       							<div style="display: flex; gap: 0.5rem; align-items: center;">

     

       938
       1099
        
       								<input

     

       939
       1100
        
       									type="email"

     
···

       947
       1108
        
       								<button

     

       948
       1109
        
       									class="btn btn-affirmative btn-small"

     

       949
       1110
        
       									@click=${this.handleUpdateEmail}

     

       1111
       1111
       +
       									?disabled=${this.updatingEmail}

     

       950
       1112
        
       								>

     

       951
       951
       -
       									Save

     

       1113
       1113
       +
       									${this.updatingEmail ? html`<span class="spinner"></span>` : "Save"}

     

       952
       1114
        
       								</button>

     

       953
       1115
        
       								<button

     

       954
       1116
        
       									class="btn btn-neutral btn-small"

     
···

       961
       1123
        
       								</button>

     

       962
       1124
        
       							</div>

     

       963
       1125
        
       						  `

     

       964
       964
       -
       							: html`

     

       1126
       1126
       +
       								: html`

     

       965
       1127
        
       							<div class="field-row">

     

       966
       1128
        
       								<div class="field-value">${this.user.email}</div>

     

       967
       1129
        
       								<button

     
···

       969
       1131
        
       									@click=${() => {

     

       970
       1132
        
       										this.editingEmail = true;

     

       971
       1133
        
       										this.newEmail = this.user?.email ?? "";

     

       1134
       1134
       +
       										this.emailChangeMessage = "";

     

       972
       1135
        
       									}}

     

       973
       1136
        
       								>

     

       974
       1137
        
       									Change

     
···

       1103
       1266
        
       	renderSessionsPage() {

     

       1104
       1267
        
       		return html`

     

       1105
       1268
        
       			<div class="content-inner">

     

       1269
       1269
       +
       			${

     

       1270
       1270
       +
       				this.error

     

       1271
       1271
       +
       					? html`

     

       1272
       1272
       +
       				<div class="error-banner">

     

       1273
       1273
       +
       					${this.error}

     

       1274
       1274
       +
       				</div>

     

       1275
       1275
       +
       			`

     

       1276
       1276
       +
       					: ""

     

       1277
       1277
       +
       			}

     

       1106
       1278
        
       			<div class="section">

     

       1107
       1279
        
       				<h2 class="section-title">Active Sessions</h2>

     

       1108
       1280
        
       				${

     
···

       1180
       1352
        
       			`;

     

       1181
       1353
        
       		}

     

       1182
       1354
        
       

     

       1183
       1183
       -
       		const hasActiveSubscription = this.subscription && (

     

       1184
       1184
       -
       			this.subscription.status === "active" || 

     

       1185
       1185
       -
       			this.subscription.status === "trialing"

     

       1186
       1186
       -
       		);

     

       1355
       1355
       +
       		const hasActiveSubscription =

     

       1356
       1356
       +
       			this.subscription &&

     

       1357
       1357
       +
       			(this.subscription.status === "active" ||

     

       1358
       1358
       +
       				this.subscription.status === "trialing");

     

       1187
       1359
        
       

     

       1188
       1360
        
       		if (this.subscription && !hasActiveSubscription) {

     

       1189
       1361
        
       			// Has a subscription but it's not active (canceled, expired, etc.)

     

       1190
       1190
       -
       			const statusColor = 

     

       1191
       1191
       -
       				this.subscription.status === "canceled" ? "var(--accent)" :

     

       1192
       1192
       -
       				"var(--secondary)";

     

       1362
       1362
       +
       			const statusColor =

     

       1363
       1363
       +
       				this.subscription.status === "canceled"

     

       1364
       1364
       +
       					? "var(--accent)"

     

       1365
       1365
       +
       					: "var(--secondary)";

     

       1193
       1366
        
       

     

       1194
       1367
        
       			return html`

     

       1195
       1368
        
       				<div class="content-inner">

     

       1369
       1369
       +
       					${

     

       1370
       1370
       +
       						this.error

     

       1371
       1371
       +
       							? html`

     

       1372
       1372
       +
       						<div class="error-banner">

     

       1373
       1373
       +
       							${this.error}

     

       1374
       1374
       +
       						</div>

     

       1375
       1375
       +
       					`

     

       1376
       1376
       +
       							: ""

     

       1377
       1377
       +
       					}

     

       1196
       1378
        
       					<div class="section">

     

       1197
       1379
        
       						<h2 class="section-title">Subscription</h2>

     

       1198
       1380
        
       						

     
···

       1214
       1396
        
       							</div>

     

       1215
       1397
        
       						</div>

     

       1216
       1398
        
       

     

       1217
       1217
       -
       						${this.subscription.canceled_at ? html`

     

       1399
       1399
       +
       						${

     

       1400
       1400
       +
       							this.subscription.canceled_at

     

       1401
       1401
       +
       								? html`

     

       1218
       1402
        
       							<div class="field-group">

     

       1219
       1403
        
       								<label class="field-label">Canceled At</label>

     

       1220
       1404
        
       								<div class="field-value" style="color: var(--accent);">

     

       1221
       1405
        
       									${this.formatDate(this.subscription.canceled_at)}

     

       1222
       1406
        
       								</div>

     

       1223
       1407
        
       							</div>

     

       1224
       1224
       -
       						` : ""}

     

       1408
       1408
       +
       						`

     

       1409
       1409
       +
       								: ""

     

       1410
       1410
       +
       						}

     

       1225
       1411
        
       

     

       1226
       1412
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1227
       1413
        
       							<button

     
···

       1235
       1421
        
       								Reactivate your subscription to unlock unlimited transcriptions.

     

       1236
       1422
        
       							</p>

     

       1237
       1423
        
       						</div>

     

       1238
       1238
       -
       

     

       1239
       1239
       -
       						${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1240
       1424
        
       					</div>

     

       1241
       1425
        
       				</div>

     

       1242
       1426
        
       			`;

     
···

       1245
       1429
        
       		if (hasActiveSubscription) {

     

       1246
       1430
        
       			return html`

     

       1247
       1431
        
       				<div class="content-inner">

     

       1432
       1432
       +
       					${

     

       1433
       1433
       +
       						this.error

     

       1434
       1434
       +
       							? html`

     

       1435
       1435
       +
       						<div class="error-banner">

     

       1436
       1436
       +
       							${this.error}

     

       1437
       1437
       +
       						</div>

     

       1438
       1438
       +
       					`

     

       1439
       1439
       +
       							: ""

     

       1440
       1440
       +
       					}

     

       1248
       1441
        
       					<div class="section">

     

       1249
       1442
        
       						<h2 class="section-title">Subscription</h2>

     

       1250
       1443
        
       						

     
···

       1263
       1456
        
       								">

     

       1264
       1457
        
       									${this.subscription.status}

     

       1265
       1458
        
       								</span>

     

       1266
       1266
       -
       								${this.subscription.cancel_at_period_end ? html`

     

       1459
       1459
       +
       								${

     

       1460
       1460
       +
       									this.subscription.cancel_at_period_end

     

       1461
       1461
       +
       										? html`

     

       1267
       1462
        
       									<span style="color: var(--accent); font-size: 0.875rem;">

     

       1268
       1463
        
       										(Cancels at end of period)

     

       1269
       1464
        
       									</span>

     

       1270
       1270
       -
       								` : ""}

     

       1465
       1465
       +
       								`

     

       1466
       1466
       +
       										: ""

     

       1467
       1467
       +
       								}

     

       1271
       1468
        
       							</div>

     

       1272
       1469
        
       						</div>

     

       1273
       1470
        
       

     

       1274
       1274
       -
       						${this.subscription.current_period_start && this.subscription.current_period_end ? html`

     

       1471
       1471
       +
       						${

     

       1472
       1472
       +
       							this.subscription.current_period_start &&

     

       1473
       1473
       +
       							this.subscription.current_period_end

     

       1474
       1474
       +
       								? html`

     

       1275
       1475
        
       							<div class="field-group">

     

       1276
       1476
        
       								<label class="field-label">Current Period</label>

     

       1277
       1477
        
       								<div class="field-value">

     
···

       1279
       1479
        
       									${this.formatDate(this.subscription.current_period_end)}

     

       1280
       1480
        
       								</div>

     

       1281
       1481
        
       							</div>

     

       1282
       1282
       -
       						` : ""}

     

       1482
       1482
       +
       						`

     

       1483
       1483
       +
       								: ""

     

       1484
       1484
       +
       						}

     

       1283
       1485
        
       

     

       1284
       1486
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1285
       1487
        
       							<button

     
···

       1293
       1495
        
       								Opens the customer portal where you can update payment methods, view invoices, and manage your subscription.

     

       1294
       1496
        
       							</p>

     

       1295
       1497
        
       						</div>

     

       1296
       1296
       -
       

     

       1297
       1297
       -
       						${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1298
       1498
        
       					</div>

     

       1299
       1499
        
       				</div>

     

       1300
       1500
        
       			`;

     
···

       1302
       1502
        
       

     

       1303
       1503
        
       		return html`

     

       1304
       1504
        
       			<div class="content-inner">

     

       1505
       1505
       +
       				${

     

       1506
       1506
       +
       					this.error

     

       1507
       1507
       +
       						? html`

     

       1508
       1508
       +
       					<div class="error-banner">

     

       1509
       1509
       +
       						${this.error}

     

       1510
       1510
       +
       					</div>

     

       1511
       1511
       +
       				`

     

       1512
       1512
       +
       						: ""

     

       1513
       1513
       +
       				}

     

       1305
       1514
        
       				<div class="section">

     

       1306
       1515
        
       					<h2 class="section-title">Billing & Subscription</h2>

     

       1307
       1516
        
       					<p class="field-description" style="margin-bottom: 1.5rem;">

     
···

       1314
       1523
        
       					>

     

       1315
       1524
        
       						${this.loading ? "Loading..." : "Activate Your Subscription"}

     

       1316
       1525
        
       					</button>

     

       1317
       1317
       -
       					${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1318
       1526
        
       				</div>

     

       1319
       1527
        
       			</div>

     

       1320
       1528
        
       		`;

     
···

       1323
       1531
        
       	renderDangerPage() {

     

       1324
       1532
        
       		return html`

     

       1325
       1533
        
       			<div class="content-inner">

     

       1534
       1534
       +
       			${

     

       1535
       1535
       +
       				this.error

     

       1536
       1536
       +
       					? html`

     

       1537
       1537
       +
       				<div class="error-banner">

     

       1538
       1538
       +
       					${this.error}

     

       1539
       1539
       +
       				</div>

     

       1540
       1540
       +
       			`

     

       1541
       1541
       +
       					: ""

     

       1542
       1542
       +
       			}

     

       1326
       1543
        
       			<div class="section danger-section">

     

       1327
       1544
        
       				<h2 class="section-title">Delete Account</h2>

     

       1328
       1545
        
       				<p class="danger-text">

     
···

       1342
       1559
        
       		`;

     

       1343
       1560
        
       	}

     

       1344
       1561
        
       

     

       1562
       1562
       +
       	renderNotificationsPage() {

     

       1563
       1563
       +
       		return html`

     

       1564
       1564
       +
       			<div class="content-inner">

     

       1565
       1565
       +
       				${

     

       1566
       1566
       +
       					this.error

     

       1567
       1567
       +
       						? html`

     

       1568
       1568
       +
       					<div class="error-banner">

     

       1569
       1569
       +
       						${this.error}

     

       1570
       1570
       +
       					</div>

     

       1571
       1571
       +
       				`

     

       1572
       1572
       +
       						: ""

     

       1573
       1573
       +
       				}

     

       1574
       1574
       +
       				<div class="section">

     

       1575
       1575
       +
       					<h2 class="section-title">Email Notifications</h2>

     

       1576
       1576
       +
       					<p style="color: var(--text); margin-bottom: 1rem;">

     

       1577
       1577
       +
       						Control which emails you receive from Thistle.

     

       1578
       1578
       +
       					</p>

     

       1579
       1579
       +
       					

     

       1580
       1580
       +
       					<div class="setting-row">

     

       1581
       1581
       +
       						<div class="setting-info">

     

       1582
       1582
       +
       							<strong>Transcription Complete</strong>

     

       1583
       1583
       +
       							<p style="color: var(--paynes-gray); font-size: 0.875rem; margin: 0.25rem 0 0 0;">

     

       1584
       1584
       +
       								Get notified when your transcription is ready

     

       1585
       1585
       +
       							</p>

     

       1586
       1586
       +
       						</div>

     

       1587
       1587
       +
       						<label class="toggle">

     

       1588
       1588
       +
       							<input

     

       1589
       1589
       +
       								type="checkbox"

     

       1590
       1590
       +
       								.checked=${this.emailNotificationsEnabled}

     

       1591
       1591
       +
       								@change=${async (e: Event) => {

     

       1592
       1592
       +
       									const target = e.target as HTMLInputElement;

     

       1593
       1593
       +
       									this.emailNotificationsEnabled = target.checked;

     

       1594
       1594
       +
       									this.error = "";

     

       1595
       1595
       +
       

     

       1596
       1596
       +
       									try {

     

       1597
       1597
       +
       										const response = await fetch("/api/user/notifications", {

     

       1598
       1598
       +
       											method: "PUT",

     

       1599
       1599
       +
       											headers: { "Content-Type": "application/json" },

     

       1600
       1600
       +
       											body: JSON.stringify({

     

       1601
       1601
       +
       												email_notifications_enabled:

     

       1602
       1602
       +
       													this.emailNotificationsEnabled,

     

       1603
       1603
       +
       											}),

     

       1604
       1604
       +
       										});

     

       1605
       1605
       +
       

     

       1606
       1606
       +
       										if (!response.ok) {

     

       1607
       1607
       +
       											const data = await response.json();

     

       1608
       1608
       +
       											throw new Error(

     

       1609
       1609
       +
       												data.error || "Failed to update notification settings",

     

       1610
       1610
       +
       											);

     

       1611
       1611
       +
       										}

     

       1612
       1612
       +
       									} catch (err) {

     

       1613
       1613
       +
       										// Revert on error

     

       1614
       1614
       +
       										this.emailNotificationsEnabled = !target.checked;

     

       1615
       1615
       +
       										target.checked = !target.checked;

     

       1616
       1616
       +
       										this.error =

     

       1617
       1617
       +
       											err instanceof Error

     

       1618
       1618
       +
       												? err.message

     

       1619
       1619
       +
       												: "Failed to update notification settings";

     

       1620
       1620
       +
       									}

     

       1621
       1621
       +
       								}}

     

       1622
       1622
       +
       							/>

     

       1623
       1623
       +
       							<span class="toggle-slider"></span>

     

       1624
       1624
       +
       						</label>

     

       1625
       1625
       +
       					</div>

     

       1626
       1626
       +
       				</div>

     

       1627
       1627
       +
       			</div>

     

       1628
       1628
       +
       		`;

     

       1629
       1629
       +
       	}

     

       1630
       1630
       +
       

     

       1345
       1631
        
       	override render() {

     

       1346
       1632
        
       		if (this.loading) {

     

       1347
       1633
        
       			return html`<div class="loading">Loading...</div>`;

     

       1348
       1348
       -
       		}

     

       1349
       1349
       -
       

     

       1350
       1350
       -
       		if (this.error) {

     

       1351
       1351
       -
       			return html`<div class="error">${this.error}</div>`;

     

       1352
       1634
        
       		}

     

       1353
       1635
        
       

     

       1354
       1636
        
       		if (!this.user) {

     
···

       1385
       1667
        
       						Billing

     

       1386
       1668
        
       					</button>

     

       1387
       1669
        
       					<button

     

       1670
       1670
       +
       						class="tab ${this.currentPage === "notifications" ? "active" : ""}"

     

       1671
       1671
       +
       						@click=${() => {

     

       1672
       1672
       +
       							this.setTab("notifications");

     

       1673
       1673
       +
       						}}

     

       1674
       1674
       +
       					>

     

       1675
       1675
       +
       						Notifications

     

       1676
       1676
       +
       					</button>

     

       1677
       1677
       +
       					<button

     

       1388
       1678
        
       						class="tab ${this.currentPage === "danger" ? "active" : ""}"

     

       1389
       1679
        
       						@click=${() => {

     

       1390
       1680
        
       							this.setTab("danger");

     
···

       1397
       1687
        
       				${this.currentPage === "account" ? this.renderAccountPage() : ""}

     

       1398
       1688
        
       				${this.currentPage === "sessions" ? this.renderSessionsPage() : ""}

     

       1399
       1689
        
       				${this.currentPage === "billing" ? this.renderBillingPage() : ""}

     

       1690
       1690
       +
       				${this.currentPage === "notifications" ? this.renderNotificationsPage() : ""}

     

       1400
       1691
        
       				${this.currentPage === "danger" ? this.renderDangerPage() : ""}

     

       1401
       1692
        
       			</div>

     

       1402
       1693
        
       

     
···

       1416
       1707
        
       									permanently deleted.

     

       1417
       1708
        
       								</p>

     

       1418
       1709
        
       								<div class="modal-actions">

     

       1419
       1419
       -
       									<button class="btn btn-rejection" @click=${this.handleDeleteAccount}>

     

       1420
       1420
       -
       										Yes, Delete My Account

     

       1710
       1710
       +
       									<button 

     

       1711
       1711
       +
       										class="btn btn-rejection" 

     

       1712
       1712
       +
       										@click=${this.handleDeleteAccount}

     

       1713
       1713
       +
       										?disabled=${this.deletingAccount}

     

       1714
       1714
       +
       									>

     

       1715
       1715
       +
       										${this.deletingAccount ? "Deleting..." : "Yes, Delete My Account"}

     

       1421
       1716
        
       									</button>

     

       1422
       1717
        
       									<button

     

       1423
       1718
        
       										class="btn btn-neutral"

     

       1424
       1719
        
       										@click=${() => {

     

       1425
       1720
        
       											this.showDeleteConfirm = false;

     

       1426
       1721
        
       										}}

     

       1722
       1722
       +
       										?disabled=${this.deletingAccount}

     

       1427
       1723
        
       									>

     

       1428
       1724
        
       										Cancel

     

       1429
       1725
        
       									</button>

+128 -39

src/db/schema.ts

···

       1
       1
        
       import { Database } from "bun:sqlite";

     

       2
       2
        
       

     

       3
       3
       -
       export const db = new Database("thistle.db");

     

       3
       3
       +
       // Use test database when NODE_ENV is test

     

       4
       4
       +
       const dbPath =

     

       5
       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
       6
       +
       export const db = new Database(dbPath);

     

       7
       7
       +
       

     

       8
       8
       +
       console.log(`[Database] Using database: ${dbPath}`);

     

       4
       9
        
       

     

       5
       10
        
       // Schema version tracking

     

       6
       11
        
       db.run(`

     
···

       13
       18
        
       const migrations = [

     

       14
       19
        
       	{

     

       15
       20
        
       		version: 1,

     

       16
       16
       -
       		name: "Complete schema with class system",

     

       21
       21
       +
       		name: "Initial schema with all tables and constraints",

     

       17
       22
        
       		sql: `

     

       18
       23
        
             -- Users table

     

       19
       24
        
             CREATE TABLE IF NOT EXISTS users (

     
···

       24
       29
        
               avatar TEXT DEFAULT 'd',

     

       25
       30
        
               role TEXT NOT NULL DEFAULT 'user',

     

       26
       31
        
               last_login INTEGER,

     

       32
       32
       +
               email_verified BOOLEAN DEFAULT 0,

     

       33
       33
       +
               email_notifications_enabled BOOLEAN DEFAULT 1,

     

       27
       34
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))

     

       28
       35
        
             );

     

       29
       36
        
       

     

       30
       37
        
             CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);

     

       31
       38
        
             CREATE INDEX IF NOT EXISTS idx_users_last_login ON users(last_login);

     

       39
       39
       +
             CREATE INDEX IF NOT EXISTS idx_users_email_verified ON users(email_verified);

     

       32
       40
        
       

     

       33
       41
        
             -- Sessions table

     

       34
       42
        
             CREATE TABLE IF NOT EXISTS sessions (

     
···

       84
       92
        
       

     

       85
       93
        
             CREATE INDEX IF NOT EXISTS idx_classes_semester_year ON classes(semester, year);

     

       86
       94
        
             CREATE INDEX IF NOT EXISTS idx_classes_archived ON classes(archived);

     

       95
       95
       +
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       87
       96
        
       

     

       88
       97
        
             -- Class members table

     

       89
       98
        
             CREATE TABLE IF NOT EXISTS class_members (

     
···

       132
       141
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_class_id ON transcriptions(class_id);

     

       133
       142
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_status ON transcriptions(status);

     

       134
       143
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_whisper_job_id ON transcriptions(whisper_job_id);

     

       135
       135
       -
           `,

     

       136
       136
       -
       	},

     

       137
       137
       -
       	{

     

       138
       138
       -
       		version: 2,

     

       139
       139
       -
       		name: "Add section column to classes table",

     

       140
       140
       -
       		sql: `

     

       141
       141
       -
             ALTER TABLE classes ADD COLUMN section TEXT;

     

       142
       142
       -
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       143
       143
       -
           `,

     

       144
       144
       -
       	},

     

       145
       145
       -
       	{

     

       146
       146
       -
       		version: 3,

     

       147
       147
       -
       		name: "Add class waitlist table",

     

       148
       148
       -
       		sql: `

     

       144
       144
       +
             CREATE INDEX IF NOT EXISTS idx_transcriptions_meeting_time_id ON transcriptions(meeting_time_id);

     

       145
       145
       +
       

     

       146
       146
       +
             -- Class waitlist table

     

       149
       147
        
             CREATE TABLE IF NOT EXISTS class_waitlist (

     

       150
       148
        
               id TEXT PRIMARY KEY,

     

       151
       149
        
               user_id INTEGER NOT NULL,

     

       152
       150
        
               course_code TEXT NOT NULL,

     

       153
       151
        
               course_name TEXT NOT NULL,

     

       154
       152
        
               professor TEXT NOT NULL,

     

       155
       155
       -
               section TEXT,

     

       156
       153
        
               semester TEXT NOT NULL,

     

       157
       154
        
               year INTEGER NOT NULL,

     

       155
       155
       +
               meeting_times TEXT,

     

       158
       156
        
               additional_info TEXT,

     

       159
       157
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       160
       158
        
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     
···

       162
       160
        
       

     

       163
       161
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_user_id ON class_waitlist(user_id);

     

       164
       162
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_course_code ON class_waitlist(course_code);

     

       165
       165
       -
           `,

     

       166
       166
       -
       	},

     

       167
       167
       -
       	{

     

       168
       168
       -
       		version: 4,

     

       169
       169
       -
       		name: "Add meeting_times to class_waitlist",

     

       170
       170
       -
       		sql: `

     

       171
       171
       -
             ALTER TABLE class_waitlist ADD COLUMN meeting_times TEXT;

     

       172
       172
       -
           `,

     

       173
       173
       -
       	},

     

       174
       174
       -
       	{

     

       175
       175
       -
       		version: 5,

     

       176
       176
       -
       		name: "Remove section columns",

     

       177
       177
       -
       		sql: `

     

       178
       178
       -
             DROP INDEX IF EXISTS idx_classes_section;

     

       179
       179
       -
             ALTER TABLE classes DROP COLUMN section;

     

       180
       180
       -
             ALTER TABLE class_waitlist DROP COLUMN section;

     

       181
       181
       -
           `,

     

       182
       182
       -
       	},

     

       183
       183
       -
       	{

     

       184
       184
       -
       		version: 6,

     

       185
       185
       -
       		name: "Add subscriptions table for Polar integration",

     

       186
       186
       -
       		sql: `

     

       163
       163
       +
       

     

       187
       164
        
             -- Subscriptions table

     

       188
       165
        
             CREATE TABLE IF NOT EXISTS subscriptions (

     

       189
       166
        
               id TEXT PRIMARY KEY,

     
···

       202
       179
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_user_id ON subscriptions(user_id);

     

       203
       180
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);

     

       204
       181
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);

     

       182
       182
       +
       

     

       183
       183
       +
             -- Email verification tokens table

     

       184
       184
       +
             CREATE TABLE IF NOT EXISTS email_verification_tokens (

     

       185
       185
       +
               id TEXT PRIMARY KEY,

     

       186
       186
       +
               user_id INTEGER NOT NULL,

     

       187
       187
       +
               token TEXT NOT NULL UNIQUE,

     

       188
       188
       +
               expires_at INTEGER NOT NULL,

     

       189
       189
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       190
       190
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       191
       191
       +
             );

     

       192
       192
       +
       

     

       193
       193
       +
             CREATE INDEX IF NOT EXISTS idx_verification_tokens_user_id ON email_verification_tokens(user_id);

     

       194
       194
       +
             CREATE INDEX IF NOT EXISTS idx_verification_tokens_token ON email_verification_tokens(token);

     

       195
       195
       +
       

     

       196
       196
       +
             -- Password reset tokens table

     

       197
       197
       +
             CREATE TABLE IF NOT EXISTS password_reset_tokens (

     

       198
       198
       +
               id TEXT PRIMARY KEY,

     

       199
       199
       +
               user_id INTEGER NOT NULL,

     

       200
       200
       +
               token TEXT NOT NULL UNIQUE,

     

       201
       201
       +
               expires_at INTEGER NOT NULL,

     

       202
       202
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       203
       203
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       204
       204
       +
             );

     

       205
       205
       +
       

     

       206
       206
       +
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user_id ON password_reset_tokens(user_id);

     

       207
       207
       +
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_token ON password_reset_tokens(token);

     

       208
       208
       +
       

     

       209
       209
       +
             -- Email change tokens table

     

       210
       210
       +
             CREATE TABLE IF NOT EXISTS email_change_tokens (

     

       211
       211
       +
               id TEXT PRIMARY KEY,

     

       212
       212
       +
               user_id INTEGER NOT NULL,

     

       213
       213
       +
               new_email TEXT NOT NULL,

     

       214
       214
       +
               token TEXT NOT NULL UNIQUE,

     

       215
       215
       +
               expires_at INTEGER NOT NULL,

     

       216
       216
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       217
       217
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       218
       218
       +
             );

     

       219
       219
       +
       

     

       220
       220
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_user_id ON email_change_tokens(user_id);

     

       221
       221
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_token ON email_change_tokens(token);

     

       222
       222
       +
       

     

       223
       223
       +
             -- Create ghost user for deleted accounts

     

       224
       224
       +
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       225
       225
       +
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       205
       226
        
           `,

     

       227
       227
       +
       	},

     

       228
       228
       +
       	{

     

       229
       229
       +
       		version: 2,

     

       230
       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       231
       +
       		sql: `

     

       232
       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       234
       +
       

     

       235
       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       237
       +
       

     

       238
       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       241
       +
       				class_id TEXT NOT NULL,

     

       242
       242
       +
       				section_number TEXT NOT NULL,

     

       243
       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       246
       +
       			);

     

       247
       247
       +
       

     

       248
       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       249
       +
       

     

       250
       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       252
       +
       

     

       253
       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       254
       +
       		`,

     

       255
       255
       +
       	},

     

       256
       256
       +
       	{

     

       257
       257
       +
       		version: 3,

     

       258
       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       259
       259
       +
       		sql: `

     

       260
       260
       +
       			-- Add vote count to transcriptions

     

       261
       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       262
       +
       

     

       263
       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       265
       +
       

     

       266
       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       275
       +
       			);

     

       276
       276
       +
       

     

       277
       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       279
       +
       		`,

     

       280
       280
       +
       	},

     

       281
       281
       +
       	{

     

       282
       282
       +
       		version: 4,

     

       283
       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
       284
       +
       		sql: `

     

       285
       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       286
       +
       			-- Defaults to created_at for existing records

     

       287
       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       288
       +
       			

     

       289
       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       291
       +
       

     

       292
       292
       +
       			-- Create index for ordering by recording date

     

       293
       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       294
       +
       		`,

     

       206
       295
        
       	},

     

       207
       296
        
       ];

     

       208
       297

+4 -2

src/index.test.README.md

···

       55
       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
       57
        
       

     

       58
       58
       +
       ### Health Endpoint

     

       59
       59
       +
       - `GET /api/health` - Check service health (database, whisper, storage)

     

       60
       60
       +
       

     

       58
       61
        
       ### Transcription Endpoints

     

       59
       59
       -
       - `GET /api/transcriptions/health` - Check transcription service health

     

       60
       62
        
       - `GET /api/transcriptions` - List user transcriptions

     

       61
       63
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       62
       64
        
       - `GET /api/transcriptions/:id` - Get transcription details

     
···

       70
       72
        
       - `PUT /api/admin/users/:id/role` - Update user role

     

       71
       73
        
       - `PUT /api/admin/users/:id/name` - Update user name

     

       72
       74
        
       - `PUT /api/admin/users/:id/email` - Update user email

     

       73
       73
       -
       - `PUT /api/admin/users/:id/password` - Update user password

     

       75
       75
       +
       - `POST /api/admin/users/:id/password-reset` - Send password reset email

     

       74
       76
        
       - `GET /api/admin/users/:id/sessions` - List user sessions

     

       75
       77
        
       - `DELETE /api/admin/users/:id/sessions` - Delete all user sessions

     

       76
       78
        
       - `DELETE /api/admin/users/:id/sessions/:sessionId` - Delete specific session

+353 -747

src/index.test.ts

···

       6
       6
        
       	expect,

     

       7
       7
        
       	test,

     

       8
       8
        
       } from "bun:test";

     

       9
       9
       -
       import db from "./db/schema";

     

       9
       9
       +
       import type { Subprocess } from "bun";

     

       10
       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
       11
        
       

     

       12
       12
       -
       // Test server URL - uses port 3001 for testing to avoid conflicts

     

       12
       12
       +
       // Test server configuration

     

       13
       13
        
       const TEST_PORT = 3001;

     

       14
       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       15
       15
       +
       const TEST_DB_PATH = "./thistle.test.db";

     

       15
       16
        
       

     

       16
       16
       -
       // Check if server is available

     

       17
       17
       -
       let serverAvailable = false;

     

       17
       17
       +
       // Test server process

     

       18
       18
       +
       let serverProcess: Subprocess | null = null;

     

       18
       19
        
       

     

       19
       20
        
       beforeAll(async () => {

     

       21
       21
       +
       	// Clean up any existing test database

     

       20
       22
        
       	try {

     

       21
       21
       -
       		const response = await fetch(`${BASE_URL}/api/transcriptions/health`, {

     

       22
       22
       -
       			signal: AbortSignal.timeout(1000),

     

       23
       23
       -
       		});

     

       24
       24
       -
       		serverAvailable = response.ok || response.status === 404;

     

       23
       23
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       25
       24
        
       	} catch {

     

       26
       26
       -
       		console.warn(

     

       27
       27
       -
       			`\n⚠️  Test server not running on port ${TEST_PORT}. Start it with:\n   PORT=${TEST_PORT} bun run src/index.ts\n   Then run tests in another terminal.\n`,

     

       28
       28
       -
       		);

     

       29
       29
       -
       		serverAvailable = false;

     

       25
       25
       +
       		// Ignore if doesn't exist

     

       30
       26
        
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	// Start test server as subprocess

     

       29
       29
       +
       	serverProcess = Bun.spawn(["bun", "run", "src/index.ts"], {

     

       30
       30
       +
       		env: {

     

       31
       31
       +
       			...process.env,

     

       32
       32
       +
       			NODE_ENV: "test",

     

       33
       33
       +
       			PORT: TEST_PORT.toString(),

     

       34
       34
       +
       			SKIP_EMAILS: "true",

     

       35
       35
       +
       			SKIP_POLAR_SYNC: "true",

     

       36
       36
       +
       			// Dummy env vars to pass startup validation (won't be used due to SKIP_EMAILS/SKIP_POLAR_SYNC)

     

       37
       37
       +
       			MAILCHANNELS_API_KEY: "test-key",

     

       38
       38
       +
       			DKIM_PRIVATE_KEY: "test-key",

     

       39
       39
       +
       			LLM_API_KEY: "test-key",

     

       40
       40
       +
       			LLM_API_BASE_URL: "https://test.com",

     

       41
       41
       +
       			LLM_MODEL: "test-model",

     

       42
       42
       +
       			POLAR_ACCESS_TOKEN: "test-token",

     

       43
       43
       +
       			POLAR_ORGANIZATION_ID: "test-org",

     

       44
       44
       +
       			POLAR_PRODUCT_ID: "test-product",

     

       45
       45
       +
       			POLAR_SUCCESS_URL: "http://localhost:3001/success",

     

       46
       46
       +
       			POLAR_WEBHOOK_SECRET: "test-webhook-secret",

     

       47
       47
       +
       			ORIGIN: "http://localhost:3001",

     

       48
       48
       +
       		},

     

       49
       49
       +
       		stdout: "pipe",

     

       50
       50
       +
       		stderr: "pipe",

     

       51
       51
       +
       	});

     

       52
       52
       +
       

     

       53
       53
       +
       	// Log server output for debugging

     

       54
       54
       +
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       55
       +
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       56
       +
       	const decoder = new TextDecoder();

     

       57
       57
       +
       

     

       58
       58
       +
       	(async () => {

     

       59
       59
       +
       		try {

     

       60
       60
       +
       			while (true) {

     

       61
       61
       +
       				const { value, done } = await stdoutReader.read();

     

       62
       62
       +
       				if (done) break;

     

       63
       63
       +
       				const text = decoder.decode(value);

     

       64
       64
       +
       				console.log("[SERVER OUT]", text.trim());

     

       65
       65
       +
       			}

     

       66
       66
       +
       		} catch {}

     

       67
       67
       +
       	})();

     

       68
       68
       +
       

     

       69
       69
       +
       	(async () => {

     

       70
       70
       +
       		try {

     

       71
       71
       +
       			while (true) {

     

       72
       72
       +
       				const { value, done } = await stderrReader.read();

     

       73
       73
       +
       				if (done) break;

     

       74
       74
       +
       				const text = decoder.decode(value);

     

       75
       75
       +
       				console.error("[SERVER ERR]", text.trim());

     

       76
       76
       +
       			}

     

       77
       77
       +
       		} catch {}

     

       78
       78
       +
       	})();

     

       79
       79
       +
       

     

       80
       80
       +
       	// Wait for server to be ready

     

       81
       81
       +
       	let retries = 30;

     

       82
       82
       +
       	let ready = false;

     

       83
       83
       +
       	while (retries > 0 && !ready) {

     

       84
       84
       +
       		try {

     

       85
       85
       +
       			const response = await fetch(`${BASE_URL}/api/health`, {

     

       86
       86
       +
       				signal: AbortSignal.timeout(1000),

     

       87
       87
       +
       			});

     

       88
       88
       +
       			if (response.ok) {

     

       89
       89
       +
       				ready = true;

     

       90
       90
       +
       				break;

     

       91
       91
       +
       			}

     

       92
       92
       +
       		} catch {

     

       93
       93
       +
       			// Server not ready yet

     

       94
       94
       +
       		}

     

       95
       95
       +
       		await new Promise((resolve) => setTimeout(resolve, 500));

     

       96
       96
       +
       		retries--;

     

       97
       97
       +
       	}

     

       98
       98
       +
       

     

       99
       99
       +
       	if (!ready) {

     

       100
       100
       +
       		throw new Error("Test server failed to start within 15 seconds");

     

       101
       101
       +
       	}

     

       102
       102
       +
       

     

       103
       103
       +
       	console.log(`✓ Test server running on port ${TEST_PORT}`);

     

       104
       104
       +
       });

     

       105
       105
       +
       

     

       106
       106
       +
       afterAll(async () => {

     

       107
       107
       +
       	// Kill test server

     

       108
       108
       +
       	if (serverProcess) {

     

       109
       109
       +
       		serverProcess.kill();

     

       110
       110
       +
       		await new Promise((resolve) => setTimeout(resolve, 1000));

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Clean up test database

     

       114
       114
       +
       	try {

     

       115
       115
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       116
       116
       +
       	} catch {

     

       117
       117
       +
       		// Ignore if doesn't exist

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       121
       +
       });

     

       122
       122
       +
       

     

       123
       123
       +
       // Clear database between each test

     

       124
       124
       +
       beforeEach(async () => {

     

       125
       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       126
       +
       

     

       127
       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       138
       +
       	db.run("DELETE FROM classes");

     

       139
       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       141
       +
       

     

       142
       142
       +
       	db.close();

     

       31
       143
        
       });

     

       32
       144
        
       

     

       33
       145
        
       // Test user credentials

     
···

       81
       193
        
       	});

     

       82
       194
        
       }

     

       83
       195
        
       

     

       84
       84
       -
       // Cleanup helpers

     

       85
       85
       -
       function cleanupTestData() {

     

       86
       86
       -
       	// Delete test users and their related data (cascade will handle most of it)

     

       87
       87
       -
       	// Include 'newemail%' to catch users whose emails were updated during tests

     

       88
       88
       -
       	db.run(

     

       89
       89
       -
       		"DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       90
       90
       -
       	);

     

       91
       91
       -
       	db.run(

     

       92
       92
       -
       		"DELETE FROM passkeys WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       93
       93
       -
       	);

     

       94
       94
       -
       	db.run(

     

       95
       95
       -
       		"DELETE FROM transcriptions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       96
       96
       -
       	);

     

       97
       97
       -
       	db.run(

     

       98
       98
       -
       		"DELETE FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%'",

     

       99
       99
       -
       	);

     

       196
       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       197
       +
       async function registerAndLogin(user: {

     

       198
       198
       +
       	email: string;

     

       199
       199
       +
       	password: string;

     

       200
       200
       +
       	name?: string;

     

       201
       201
       +
       }): Promise<string> {

     

       202
       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       203
       +
       

     

       204
       204
       +
       	// Register the user

     

       205
       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       206
       +
       		method: "POST",

     

       207
       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       208
       +
       		body: JSON.stringify({

     

       209
       209
       +
       			email: user.email,

     

       210
       210
       +
       			password: hashedPassword,

     

       211
       211
       +
       			name: user.name || "Test User",

     

       212
       212
       +
       		}),

     

       213
       213
       +
       	});

     

       214
       214
       +
       

     

       215
       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       216
       +
       		const error = await registerResponse.json();

     

       217
       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       218
       +
       	}

     

       219
       219
       +
       

     

       220
       220
       +
       	const registerData = await registerResponse.json();

     

       221
       221
       +
       	const userId = registerData.user.id;

     

       222
       222
       +
       

     

       223
       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       226
       +
       	db.close();

     

       100
       227
        
       

     

       101
       101
       -
       	// Clear ALL rate limit data to prevent accumulation across tests

     

       102
       102
       -
       	// (IP-based rate limits don't contain test/admin in the key)

     

       103
       103
       -
       	db.run("DELETE FROM rate_limit_attempts");

     

       104
       104
       -
       }

     

       228
       228
       +
       	// Now login to get a session

     

       229
       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       230
       +
       		method: "POST",

     

       231
       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       232
       +
       		body: JSON.stringify({

     

       233
       233
       +
       			email: user.email,

     

       234
       234
       +
       			password: hashedPassword,

     

       235
       235
       +
       		}),

     

       236
       236
       +
       	});

     

       105
       237
        
       

     

       106
       106
       -
       beforeEach(() => {

     

       107
       107
       -
       	if (serverAvailable) {

     

       108
       108
       -
       		cleanupTestData();

     

       238
       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       239
       +
       		const error = await loginResponse.json();

     

       240
       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       109
       241
        
       	}

     

       110
       110
       -
       });

     

       111
       242
        
       

     

       112
       112
       -
       afterAll(() => {

     

       113
       113
       -
       	if (serverAvailable) {

     

       114
       114
       -
       		cleanupTestData();

     

       243
       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       // Helper to add active subscription to a user

     

       247
       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       249
       +
       	const user = db

     

       250
       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       251
       +
       		.get(userEmail) as { id: number };

     

       252
       252
       +
       	if (!user) {

     

       253
       253
       +
       		db.close();

     

       254
       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       115
       255
        
       	}

     

       116
       116
       -
       });

     

       117
       256
        
       

     

       118
       118
       -
       // Helper to skip tests if server is not available

     

       119
       119
       -
       function serverTest(name: string, fn: () => void | Promise<void>) {

     

       120
       120
       -
       	test(name, async () => {

     

       121
       121
       -
       		if (!serverAvailable) {

     

       122
       122
       -
       			console.log(`⏭️  Skipping: ${name} (server not running)`);

     

       123
       123
       -
       			return;

     

       124
       124
       -
       		}

     

       125
       125
       -
       		await fn();

     

       126
       126
       -
       	});

     

       257
       257
       +
       	db.run(

     

       258
       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       260
       +
       	);

     

       261
       261
       +
       	db.close();

     

       127
       262
        
       }

     

       128
       263
        
       

     

       264
       264
       +
       // All tests run against a fresh database, no cleanup needed

     

       265
       265
       +
       

     

       129
       266
        
       describe("API Endpoints - Authentication", () => {

     

       130
       267
        
       	describe("POST /api/auth/register", () => {

     

       131
       131
       -
       		serverTest("should register a new user successfully", async () => {

     

       268
       268
       +
       		test("should register a new user successfully", async () => {

     

       132
       269
        
       			const hashedPassword = await clientHashPassword(

     

       133
       270
        
       				TEST_USER.email,

     

       134
       271
        
       				TEST_USER.password,

     
···

       144
       281
        
       				}),

     

       145
       282
        
       			});

     

       146
       283
        
       

     

       147
       147
       -
       			expect(response.status).toBe(200);

     

       284
       284
       +
       			if (response.status !== 201) {

     

       285
       285
       +
       				const error = await response.json();

     

       286
       286
       +
       				console.error("Registration failed:", response.status, error);

     

       287
       287
       +
       			}

     

       288
       288
       +
       

     

       289
       289
       +
       			expect(response.status).toBe(201);

     

       290
       290
       +
       

     

       148
       291
        
       			const data = await response.json();

     

       149
       292
        
       			expect(data.user).toBeDefined();

     

       150
       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       151
       151
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       294
       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       152
       295
        
       		});

     

       153
       296
        
       

     

       154
       154
       -
       		serverTest("should reject registration with missing email", async () => {

     

       297
       297
       +
       		test("should reject registration with missing email", async () => {

     

       155
       298
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       156
       299
        
       				method: "POST",

     

       157
       300
        
       				headers: { "Content-Type": "application/json" },

     
···

       165
       308
        
       			expect(data.error).toBe("Email and password required");

     

       166
       309
        
       		});

     

       167
       310
        
       

     

       168
       168
       -
       		serverTest(

     

       169
       169
       -
       			"should reject registration with invalid password format",

     

       170
       170
       -
       			async () => {

     

       171
       171
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       172
       172
       -
       					method: "POST",

     

       173
       173
       -
       					headers: { "Content-Type": "application/json" },

     

       174
       174
       -
       					body: JSON.stringify({

     

       175
       175
       -
       						email: TEST_USER.email,

     

       176
       176
       -
       						password: "short",

     

       177
       177
       -
       					}),

     

       178
       178
       -
       				});

     

       179
       179
       -
       

     

       180
       180
       -
       				expect(response.status).toBe(400);

     

       181
       181
       -
       				const data = await response.json();

     

       182
       182
       -
       				expect(data.error).toBe("Invalid password format");

     

       183
       183
       -
       			},

     

       184
       184
       -
       		);

     

       185
       185
       -
       

     

       186
       186
       -
       		serverTest("should reject duplicate email registration", async () => {

     

       187
       187
       -
       			const hashedPassword = await clientHashPassword(

     

       188
       188
       -
       				TEST_USER.email,

     

       189
       189
       -
       				TEST_USER.password,

     

       190
       190
       -
       			);

     

       191
       191
       -
       

     

       192
       192
       -
       			// First registration

     

       193
       193
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       194
       194
       -
       				method: "POST",

     

       195
       195
       -
       				headers: { "Content-Type": "application/json" },

     

       196
       196
       -
       				body: JSON.stringify({

     

       197
       197
       -
       					email: TEST_USER.email,

     

       198
       198
       -
       					password: hashedPassword,

     

       199
       199
       -
       					name: TEST_USER.name,

     

       200
       200
       -
       				}),

     

       201
       201
       -
       			});

     

       202
       202
       -
       

     

       203
       203
       -
       			// Duplicate registration

     

       311
       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       204
       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       205
       313
        
       				method: "POST",

     

       206
       314
        
       				headers: { "Content-Type": "application/json" },

     

       207
       315
        
       				body: JSON.stringify({

     

       208
       316
        
       					email: TEST_USER.email,

     

       209
       209
       -
       					password: hashedPassword,

     

       210
       210
       -
       					name: TEST_USER.name,

     

       317
       317
       +
       					password: "short",

     

       211
       318
        
       				}),

     

       212
       319
        
       			});

     

       213
       320
        
       

     

       214
       321
        
       			expect(response.status).toBe(400);

     

       215
       322
        
       			const data = await response.json();

     

       216
       216
       -
       			expect(data.error).toBe("Email already registered");

     

       323
       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       217
       324
        
       		});

     

       218
       325
        
       

     

       219
       219
       -
       		serverTest("should enforce rate limiting on registration", async () => {

     

       220
       220
       -
       			const hashedPassword = await clientHashPassword(

     

       221
       221
       -
       				"test@example.com",

     

       222
       222
       -
       				"password",

     

       223
       223
       -
       			);

     

       224
       224
       -
       

     

       225
       225
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       226
       226
       -
       			let rateLimitHit = false;

     

       227
       227
       -
       			for (let i = 0; i < 10; i++) {

     

       228
       228
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       229
       229
       -
       					method: "POST",

     

       230
       230
       -
       					headers: { "Content-Type": "application/json" },

     

       231
       231
       -
       					body: JSON.stringify({

     

       232
       232
       -
       						email: `test${i}@example.com`,

     

       233
       233
       -
       						password: hashedPassword,

     

       234
       234
       -
       					}),

     

       235
       235
       -
       				});

     

       236
       236
       -
       

     

       237
       237
       -
       				if (response.status === 429) {

     

       238
       238
       -
       					rateLimitHit = true;

     

       239
       239
       -
       					break;

     

       240
       240
       -
       				}

     

       241
       241
       -
       			}

     

       242
       242
       -
       

     

       243
       243
       -
       			// Verify that rate limiting was triggered

     

       244
       244
       -
       			expect(rateLimitHit).toBe(true);

     

       245
       245
       -
       		});

     

       246
       246
       -
       	});

     

       247
       247
       -
       

     

       248
       248
       -
       	describe("POST /api/auth/login", () => {

     

       249
       249
       -
       		serverTest("should login successfully with valid credentials", async () => {

     

       250
       250
       -
       			// Register user first

     

       326
       326
       +
       		test("should reject duplicate email registration", async () => {

     

       251
       327
        
       			const hashedPassword = await clientHashPassword(

     

       252
       328
        
       				TEST_USER.email,

     

       253
       329
        
       				TEST_USER.password,

     

       254
       330
        
       			);

     

       331
       331
       +
       

     

       332
       332
       +
       			// First registration

     

       255
       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       256
       334
        
       				method: "POST",

     

       257
       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       262
       340
        
       				}),

     

       263
       341
        
       			});

     

       264
       342
        
       

     

       265
       265
       -
       			// Login

     

       266
       266
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       343
       343
       +
       			// Duplicate registration

     

       344
       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       267
       345
        
       				method: "POST",

     

       268
       346
        
       				headers: { "Content-Type": "application/json" },

     

       269
       347
        
       				body: JSON.stringify({

     

       270
       348
        
       					email: TEST_USER.email,

     

       271
       349
        
       					password: hashedPassword,

     

       350
       350
       +
       					name: TEST_USER.name,

     

       272
       351
        
       				}),

     

       273
       352
        
       			});

     

       274
       353
        
       

     

       275
       275
       -
       			expect(response.status).toBe(200);

     

       354
       354
       +
       			expect(response.status).toBe(409);

     

       276
       355
        
       			const data = await response.json();

     

       277
       277
       -
       			expect(data.user).toBeDefined();

     

       278
       278
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       279
       279
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       356
       356
       +
       			expect(data.error).toBe("Email already registered");

     

       280
       357
        
       		});

     

       281
       358
        
       

     

       282
       282
       -
       		serverTest("should reject login with invalid credentials", async () => {

     

       283
       283
       -
       			// Register user first

     

       359
       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       284
       360
        
       			const hashedPassword = await clientHashPassword(

     

       285
       285
       -
       				TEST_USER.email,

     

       286
       286
       -
       				TEST_USER.password,

     

       361
       361
       +
       				"ratelimit@example.com",

     

       362
       362
       +
       				"password",

     

       287
       363
        
       			);

     

       364
       364
       +
       

     

       365
       365
       +
       			// First registration succeeds

     

       288
       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       289
       367
        
       				method: "POST",

     

       290
       368
        
       				headers: { "Content-Type": "application/json" },

     

       291
       369
        
       				body: JSON.stringify({

     

       292
       292
       -
       					email: TEST_USER.email,

     

       370
       370
       +
       					email: "ratelimit@example.com",

     

       293
       371
        
       					password: hashedPassword,

     

       294
       372
        
       				}),

     

       295
       373
        
       			});

     

       296
       374
        
       

     

       297
       297
       -
       			// Login with wrong password

     

       298
       298
       -
       			const wrongPassword = await clientHashPassword(

     

       299
       299
       -
       				TEST_USER.email,

     

       300
       300
       -
       				"WrongPassword123!",

     

       301
       301
       -
       			);

     

       302
       302
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       303
       303
       -
       				method: "POST",

     

       304
       304
       -
       				headers: { "Content-Type": "application/json" },

     

       305
       305
       -
       				body: JSON.stringify({

     

       306
       306
       -
       					email: TEST_USER.email,

     

       307
       307
       -
       					password: wrongPassword,

     

       308
       308
       -
       				}),

     

       309
       309
       -
       			});

     

       310
       310
       -
       

     

       311
       311
       -
       			expect(response.status).toBe(401);

     

       312
       312
       -
       			const data = await response.json();

     

       313
       313
       -
       			expect(data.error).toBe("Invalid email or password");

     

       314
       314
       -
       		});

     

       315
       315
       -
       

     

       316
       316
       -
       		serverTest("should reject login with missing fields", async () => {

     

       317
       317
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       318
       318
       -
       				method: "POST",

     

       319
       319
       -
       				headers: { "Content-Type": "application/json" },

     

       320
       320
       -
       				body: JSON.stringify({

     

       321
       321
       -
       					email: TEST_USER.email,

     

       322
       322
       -
       				}),

     

       323
       323
       -
       			});

     

       324
       324
       -
       

     

       325
       325
       -
       			expect(response.status).toBe(400);

     

       326
       326
       -
       			const data = await response.json();

     

       327
       327
       -
       			expect(data.error).toBe("Email and password required");

     

       328
       328
       -
       		});

     

       329
       329
       -
       

     

       330
       330
       -
       		serverTest("should enforce rate limiting on login attempts", async () => {

     

       331
       331
       -
       			const hashedPassword = await clientHashPassword(

     

       332
       332
       -
       				TEST_USER.email,

     

       333
       333
       -
       				TEST_USER.password,

     

       334
       334
       -
       			);

     

       335
       335
       -
       

     

       336
       336
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       375
       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       337
       377
        
       			let rateLimitHit = false;

     

       338
       338
       -
       			for (let i = 0; i < 11; i++) {

     

       339
       339
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       378
       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       340
       380
        
       					method: "POST",

     

       341
       381
        
       					headers: { "Content-Type": "application/json" },

     

       342
       382
        
       					body: JSON.stringify({

     

       343
       343
       -
       						email: TEST_USER.email,

     

       383
       383
       +
       						email: "ratelimit@example.com",

     

       344
       384
        
       						password: hashedPassword,

     

       345
       385
        
       					}),

     

       346
       386
        
       				});

     
···

       356
       396
        
       		});

     

       357
       397
        
       	});

     

       358
       398
        
       

     

       359
       359
       -
       	describe("POST /api/auth/logout", () => {

     

       360
       360
       -
       		serverTest("should logout successfully", async () => {

     

       399
       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       361
       401
        
       			// Register and login

     

       362
       362
       -
       			const hashedPassword = await clientHashPassword(

     

       363
       363
       -
       				TEST_USER.email,

     

       364
       364
       -
       				TEST_USER.password,

     

       365
       365
       -
       			);

     

       366
       366
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
       367
       -
       				method: "POST",

     

       368
       368
       -
       				headers: { "Content-Type": "application/json" },

     

       369
       369
       -
       				body: JSON.stringify({

     

       370
       370
       -
       					email: TEST_USER.email,

     

       371
       371
       -
       					password: hashedPassword,

     

       372
       372
       -
       				}),

     

       373
       373
       -
       			});

     

       374
       374
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       375
       375
       -
       

     

       376
       376
       -
       			// Logout

     

       377
       377
       -
       			const response = await authRequest(

     

       378
       378
       -
       				`${BASE_URL}/api/auth/logout`,

     

       379
       379
       -
       				sessionCookie,

     

       380
       380
       -
       				{

     

       381
       381
       -
       					method: "POST",

     

       382
       382
       -
       				},

     

       383
       383
       -
       			);

     

       384
       384
       -
       

     

       385
       385
       -
       			expect(response.status).toBe(200);

     

       386
       386
       -
       			const data = await response.json();

     

       387
       387
       -
       			expect(data.success).toBe(true);

     

       388
       388
       -
       

     

       389
       389
       -
       			// Verify cookie is cleared

     

       390
       390
       -
       			const setCookie = response.headers.get("set-cookie");

     

       391
       391
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       392
       392
       -
       		});

     

       393
       393
       -
       

     

       394
       394
       -
       		serverTest("should logout even without valid session", async () => {

     

       395
       395
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       396
       396
       -
       				method: "POST",

     

       397
       397
       -
       			});

     

       398
       398
       -
       

     

       399
       399
       -
       			expect(response.status).toBe(200);

     

       400
       400
       -
       			const data = await response.json();

     

       401
       401
       -
       			expect(data.success).toBe(true);

     

       402
       402
       -
       		});

     

       403
       403
       -
       	});

     

       404
       404
       -
       

     

       405
       405
       -
       	describe("GET /api/auth/me", () => {

     

       406
       406
       -
       		serverTest(

     

       407
       407
       -
       			"should return current user info when authenticated",

     

       408
       408
       -
       			async () => {

     

       409
       409
       -
       				// Register user

     

       410
       410
       -
       				const hashedPassword = await clientHashPassword(

     

       411
       411
       -
       					TEST_USER.email,

     

       412
       412
       -
       					TEST_USER.password,

     

       413
       413
       -
       				);

     

       414
       414
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       415
       415
       -
       					method: "POST",

     

       416
       416
       -
       					headers: { "Content-Type": "application/json" },

     

       417
       417
       -
       					body: JSON.stringify({

     

       418
       418
       -
       						email: TEST_USER.email,

     

       419
       419
       -
       						password: hashedPassword,

     

       420
       420
       -
       						name: TEST_USER.name,

     

       421
       421
       -
       					}),

     

       422
       422
       -
       				});

     

       423
       423
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       -
       

     

       425
       425
       -
       				// Get current user

     

       426
       426
       -
       				const response = await authRequest(

     

       427
       427
       -
       					`${BASE_URL}/api/auth/me`,

     

       428
       428
       -
       					sessionCookie,

     

       429
       429
       -
       				);

     

       430
       430
       -
       

     

       431
       431
       -
       				expect(response.status).toBe(200);

     

       432
       432
       -
       				const data = await response.json();

     

       433
       433
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       434
       434
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       435
       435
       -
       				expect(data.role).toBeDefined();

     

       436
       436
       -
       			},

     

       437
       437
       -
       		);

     

       438
       438
       -
       

     

       439
       439
       -
       		serverTest("should return 401 when not authenticated", async () => {

     

       440
       440
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       441
       441
       -
       

     

       442
       442
       -
       			expect(response.status).toBe(401);

     

       443
       443
       -
       			const data = await response.json();

     

       444
       444
       -
       			expect(data.error).toBe("Not authenticated");

     

       445
       445
       -
       		});

     

       446
       446
       -
       

     

       447
       447
       -
       		serverTest("should return 401 with invalid session", async () => {

     

       448
       448
       -
       			const response = await authRequest(

     

       449
       449
       -
       				`${BASE_URL}/api/auth/me`,

     

       450
       450
       -
       				"invalid-session",

     

       451
       451
       -
       			);

     

       452
       452
       -
       

     

       453
       453
       -
       			expect(response.status).toBe(401);

     

       454
       454
       -
       			const data = await response.json();

     

       455
       455
       -
       			expect(data.error).toBe("Invalid session");

     

       456
       456
       -
       		});

     

       457
       457
       -
       	});

     

       458
       458
       -
       });

     

       459
       459
       -
       

     

       460
       460
       -
       describe("API Endpoints - Session Management", () => {

     

       461
       461
       -
       	describe("GET /api/sessions", () => {

     

       462
       462
       -
       		serverTest("should return user sessions", async () => {

     

       463
       463
       -
       			// Register user

     

       464
       464
       -
       			const hashedPassword = await clientHashPassword(

     

       465
       465
       -
       				TEST_USER.email,

     

       466
       466
       -
       				TEST_USER.password,

     

       467
       467
       -
       			);

     

       468
       468
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       469
       469
       -
       				method: "POST",

     

       470
       470
       -
       				headers: { "Content-Type": "application/json" },

     

       471
       471
       -
       				body: JSON.stringify({

     

       472
       472
       -
       					email: TEST_USER.email,

     

       473
       473
       -
       					password: hashedPassword,

     

       474
       474
       -
       				}),

     

       475
       475
       -
       			});

     

       476
       476
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       477
       477
       -
       

     

       478
       478
       -
       			// Get sessions

     

       479
       479
       -
       			const response = await authRequest(

     

       480
       480
       -
       				`${BASE_URL}/api/sessions`,

     

       481
       481
       -
       				sessionCookie,

     

       482
       482
       -
       			);

     

       483
       483
       -
       

     

       484
       484
       -
       			expect(response.status).toBe(200);

     

       485
       485
       -
       			const data = await response.json();

     

       486
       486
       -
       			expect(data.sessions).toBeDefined();

     

       487
       487
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       488
       488
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       489
       489
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       490
       490
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       491
       491
       -
       		});

     

       492
       492
       -
       

     

       493
       493
       -
       		serverTest("should require authentication", async () => {

     

       494
       494
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       495
       495
       -
       

     

       496
       496
       -
       			expect(response.status).toBe(401);

     

       497
       497
       -
       		});

     

       498
       498
       -
       	});

     

       499
       499
       -
       

     

       500
       500
       -
       	describe("DELETE /api/sessions", () => {

     

       501
       501
       -
       		serverTest("should delete specific session", async () => {

     

       502
       502
       -
       			// Register user and create multiple sessions

     

       503
       503
       -
       			const hashedPassword = await clientHashPassword(

     

       504
       504
       -
       				TEST_USER.email,

     

       505
       505
       -
       				TEST_USER.password,

     

       506
       506
       -
       			);

     

       507
       507
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       508
       508
       -
       				method: "POST",

     

       509
       509
       -
       				headers: { "Content-Type": "application/json" },

     

       510
       510
       -
       				body: JSON.stringify({

     

       511
       511
       -
       					email: TEST_USER.email,

     

       512
       512
       -
       					password: hashedPassword,

     

       513
       513
       -
       				}),

     

       514
       514
       -
       			});

     

       515
       515
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       516
       516
       -
       

     

       517
       517
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       518
       518
       -
       				method: "POST",

     

       519
       519
       -
       				headers: { "Content-Type": "application/json" },

     

       520
       520
       -
       				body: JSON.stringify({

     

       521
       521
       -
       					email: TEST_USER.email,

     

       522
       522
       -
       					password: hashedPassword,

     

       523
       523
       -
       				}),

     

       524
       524
       -
       			});

     

       525
       525
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       526
       526
       -
       

     

       527
       527
       -
       			// Get sessions list

     

       528
       528
       -
       			const sessionsResponse = await authRequest(

     

       529
       529
       -
       				`${BASE_URL}/api/sessions`,

     

       530
       530
       -
       				session1Cookie,

     

       531
       531
       -
       			);

     

       532
       532
       -
       			const sessionsData = await sessionsResponse.json();

     

       533
       533
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       534
       534
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       535
       535
       -
       			)?.id;

     

       536
       536
       -
       

     

       537
       537
       -
       			// Delete session 2

     

       538
       538
       -
       			const response = await authRequest(

     

       539
       539
       -
       				`${BASE_URL}/api/sessions`,

     

       540
       540
       -
       				session1Cookie,

     

       541
       541
       -
       				{

     

       542
       542
       -
       					method: "DELETE",

     

       543
       543
       -
       					headers: { "Content-Type": "application/json" },

     

       544
       544
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       545
       545
       -
       				},

     

       546
       546
       -
       			);

     

       547
       547
       -
       

     

       548
       548
       -
       			expect(response.status).toBe(200);

     

       549
       549
       -
       			const data = await response.json();

     

       550
       550
       -
       			expect(data.success).toBe(true);

     

       551
       551
       -
       

     

       552
       552
       -
       			// Verify session 2 is deleted

     

       553
       553
       -
       			const verifyResponse = await authRequest(

     

       554
       554
       -
       				`${BASE_URL}/api/auth/me`,

     

       555
       555
       -
       				session2Cookie,

     

       556
       556
       -
       			);

     

       557
       557
       -
       			expect(verifyResponse.status).toBe(401);

     

       558
       558
       -
       		});

     

       559
       559
       -
       

     

       560
       560
       -
       		serverTest("should not delete another user's session", async () => {

     

       561
       561
       -
       			// Register two users

     

       562
       562
       -
       			const hashedPassword1 = await clientHashPassword(

     

       563
       563
       -
       				TEST_USER.email,

     

       564
       564
       -
       				TEST_USER.password,

     

       565
       565
       -
       			);

     

       566
       566
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       567
       567
       -
       				method: "POST",

     

       568
       568
       -
       				headers: { "Content-Type": "application/json" },

     

       569
       569
       -
       				body: JSON.stringify({

     

       570
       570
       -
       					email: TEST_USER.email,

     

       571
       571
       -
       					password: hashedPassword1,

     

       572
       572
       -
       				}),

     

       573
       573
       -
       			});

     

       574
       574
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       575
       575
       -
       

     

       576
       576
       -
       			const hashedPassword2 = await clientHashPassword(

     

       577
       577
       -
       				TEST_USER_2.email,

     

       578
       578
       -
       				TEST_USER_2.password,

     

       579
       579
       -
       			);

     

       580
       580
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       581
       581
       -
       				method: "POST",

     

       582
       582
       -
       				headers: { "Content-Type": "application/json" },

     

       583
       583
       -
       				body: JSON.stringify({

     

       584
       584
       -
       					email: TEST_USER_2.email,

     

       585
       585
       -
       					password: hashedPassword2,

     

       586
       586
       -
       				}),

     

       587
       587
       -
       			});

     

       588
       588
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       589
       589
       -
       

     

       590
       590
       -
       			// Try to delete user2's session using user1's credentials

     

       591
       591
       -
       			const response = await authRequest(

     

       592
       592
       -
       				`${BASE_URL}/api/sessions`,

     

       593
       593
       -
       				user1Cookie,

     

       594
       594
       -
       				{

     

       595
       595
       -
       					method: "DELETE",

     

       596
       596
       -
       					headers: { "Content-Type": "application/json" },

     

       597
       597
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       598
       598
       -
       				},

     

       599
       599
       -
       			);

     

       600
       600
       -
       

     

       601
       601
       -
       			expect(response.status).toBe(404);

     

       602
       602
       -
       		});

     

       603
       603
       -
       

     

       604
       604
       -
       		serverTest("should not delete current session", async () => {

     

       605
       605
       -
       			// Register user

     

       606
       606
       -
       			const hashedPassword = await clientHashPassword(

     

       607
       607
       -
       				TEST_USER.email,

     

       608
       608
       -
       				TEST_USER.password,

     

       609
       609
       -
       			);

     

       610
       610
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       611
       611
       -
       				method: "POST",

     

       612
       612
       -
       				headers: { "Content-Type": "application/json" },

     

       613
       613
       -
       				body: JSON.stringify({

     

       614
       614
       -
       					email: TEST_USER.email,

     

       615
       615
       -
       					password: hashedPassword,

     

       616
       616
       -
       				}),

     

       617
       617
       -
       			});

     

       618
       618
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       402
       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       619
       403
        
       

     

       620
       404
        
       			// Try to delete own current session

     

       621
       405
        
       			const response = await authRequest(

     
···

       637
       421
        
       

     

       638
       422
        
       describe("API Endpoints - User Management", () => {

     

       639
       423
        
       	describe("DELETE /api/user", () => {

     

       640
       640
       -
       		serverTest("should delete user account", async () => {

     

       641
       641
       -
       			// Register user

     

       642
       642
       -
       			const hashedPassword = await clientHashPassword(

     

       643
       643
       -
       				TEST_USER.email,

     

       644
       644
       -
       				TEST_USER.password,

     

       645
       645
       -
       			);

     

       646
       646
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       647
       647
       -
       				method: "POST",

     

       648
       648
       -
       				headers: { "Content-Type": "application/json" },

     

       649
       649
       -
       				body: JSON.stringify({

     

       650
       650
       -
       					email: TEST_USER.email,

     

       651
       651
       -
       					password: hashedPassword,

     

       652
       652
       -
       				}),

     

       653
       653
       -
       			});

     

       654
       654
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       +
       		test("should delete user account", async () => {

     

       425
       425
       +
       			// Register and login

     

       426
       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       655
       427
        
       

     

       656
       428
        
       			// Delete account

     

       657
       429
        
       			const response = await authRequest(

     
···

       662
       434
        
       				},

     

       663
       435
        
       			);

     

       664
       436
        
       

     

       665
       665
       -
       			expect(response.status).toBe(200);

     

       666
       666
       -
       			const data = await response.json();

     

       667
       667
       -
       			expect(data.success).toBe(true);

     

       437
       437
       +
       			expect(response.status).toBe(204);

     

       668
       438
        
       

     

       669
       439
        
       			// Verify user is deleted

     

       670
       440
        
       			const verifyResponse = await authRequest(

     
···

       674
       444
        
       			expect(verifyResponse.status).toBe(401);

     

       675
       445
        
       		});

     

       676
       446
        
       

     

       677
       677
       -
       		serverTest("should require authentication", async () => {

     

       447
       447
       +
       		test("should require authentication", async () => {

     

       678
       448
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       679
       449
        
       				method: "DELETE",

     

       680
       450
        
       			});

     
···

       684
       454
        
       	});

     

       685
       455
        
       

     

       686
       456
        
       	describe("PUT /api/user/email", () => {

     

       687
       687
       -
       		serverTest("should update user email", async () => {

     

       688
       688
       -
       			// Register user

     

       689
       689
       -
       			const hashedPassword = await clientHashPassword(

     

       690
       690
       -
       				TEST_USER.email,

     

       691
       691
       -
       				TEST_USER.password,

     

       692
       692
       -
       			);

     

       693
       693
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       694
       694
       -
       				method: "POST",

     

       695
       695
       -
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       -
       				body: JSON.stringify({

     

       697
       697
       -
       					email: TEST_USER.email,

     

       698
       698
       -
       					password: hashedPassword,

     

       699
       699
       -
       				}),

     

       700
       700
       -
       			});

     

       701
       701
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       457
       457
       +
       		test("should update user email", async () => {

     

       458
       458
       +
       			// Register and login

     

       459
       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       702
       460
        
       

     

       703
       703
       -
       			// Update email

     

       461
       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       704
       462
        
       			const newEmail = "newemail@example.com";

     

       705
       463
        
       			const response = await authRequest(

     

       706
       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       716
       474
        
       			const data = await response.json();

     

       717
       475
        
       			expect(data.success).toBe(true);

     

       718
       476
        
       

     

       477
       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       479
       +
       			const tokenData = db

     

       480
       480
       +
       				.query(

     

       481
       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       482
       +
       				)

     

       483
       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       485
       +
       				tokenData.new_email,

     

       486
       486
       +
       				tokenData.user_id,

     

       487
       487
       +
       			]);

     

       488
       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       489
       +
       				tokenData.user_id,

     

       490
       490
       +
       			]);

     

       491
       491
       +
       			db.close();

     

       492
       492
       +
       

     

       719
       493
        
       			// Verify email updated

     

       720
       494
        
       			const meResponse = await authRequest(

     

       721
       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       725
       499
        
       			expect(meData.email).toBe(newEmail);

     

       726
       500
        
       		});

     

       727
       501
        
       

     

       728
       728
       -
       		serverTest("should reject duplicate email", async () => {

     

       502
       502
       +
       		test("should reject duplicate email", async () => {

     

       729
       503
        
       			// Register two users

     

       730
       730
       -
       			const hashedPassword1 = await clientHashPassword(

     

       731
       731
       -
       				TEST_USER.email,

     

       732
       732
       -
       				TEST_USER.password,

     

       733
       733
       -
       			);

     

       734
       734
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       735
       735
       -
       				method: "POST",

     

       736
       736
       -
       				headers: { "Content-Type": "application/json" },

     

       737
       737
       -
       				body: JSON.stringify({

     

       738
       738
       -
       					email: TEST_USER.email,

     

       739
       739
       -
       					password: hashedPassword1,

     

       740
       740
       -
       				}),

     

       741
       741
       -
       			});

     

       742
       742
       -
       

     

       743
       743
       -
       			const hashedPassword2 = await clientHashPassword(

     

       744
       744
       -
       				TEST_USER_2.email,

     

       745
       745
       -
       				TEST_USER_2.password,

     

       746
       746
       -
       			);

     

       747
       747
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       748
       748
       -
       				method: "POST",

     

       749
       749
       -
       				headers: { "Content-Type": "application/json" },

     

       750
       750
       -
       				body: JSON.stringify({

     

       751
       751
       -
       					email: TEST_USER_2.email,

     

       752
       752
       -
       					password: hashedPassword2,

     

       753
       753
       -
       				}),

     

       754
       754
       -
       			});

     

       755
       755
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       504
       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       756
       506
        
       

     

       757
       507
        
       			// Try to update user2's email to user1's email

     

       758
       508
        
       			const response = await authRequest(

     
···

       765
       515
        
       				},

     

       766
       516
        
       			);

     

       767
       517
        
       

     

       768
       768
       -
       			expect(response.status).toBe(400);

     

       518
       518
       +
       			expect(response.status).toBe(409);

     

       769
       519
        
       			const data = await response.json();

     

       770
       520
        
       			expect(data.error).toBe("Email already in use");

     

       771
       521
        
       		});

     

       772
       522
        
       	});

     

       773
       523
        
       

     

       774
       524
        
       	describe("PUT /api/user/password", () => {

     

       775
       775
       -
       		serverTest("should update user password", async () => {

     

       776
       776
       -
       			// Register user

     

       777
       777
       -
       			const hashedPassword = await clientHashPassword(

     

       778
       778
       -
       				TEST_USER.email,

     

       779
       779
       -
       				TEST_USER.password,

     

       780
       780
       -
       			);

     

       781
       781
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       782
       782
       -
       				method: "POST",

     

       783
       783
       -
       				headers: { "Content-Type": "application/json" },

     

       784
       784
       -
       				body: JSON.stringify({

     

       785
       785
       -
       					email: TEST_USER.email,

     

       786
       786
       -
       					password: hashedPassword,

     

       787
       787
       -
       				}),

     

       788
       788
       -
       			});

     

       789
       789
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       525
       525
       +
       		test("should update user password", async () => {

     

       526
       526
       +
       			// Register and login

     

       527
       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       790
       528
        
       

     

       791
       529
        
       			// Update password

     

       792
       530
        
       			const newPassword = await clientHashPassword(

     
···

       819
       557
        
       			expect(loginResponse.status).toBe(200);

     

       820
       558
        
       		});

     

       821
       559
        
       

     

       822
       822
       -
       		serverTest("should reject invalid password format", async () => {

     

       823
       823
       -
       			// Register user

     

       824
       824
       -
       			const hashedPassword = await clientHashPassword(

     

       825
       825
       -
       				TEST_USER.email,

     

       826
       826
       -
       				TEST_USER.password,

     

       827
       827
       -
       			);

     

       828
       828
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       829
       829
       -
       				method: "POST",

     

       830
       830
       -
       				headers: { "Content-Type": "application/json" },

     

       831
       831
       -
       				body: JSON.stringify({

     

       832
       832
       -
       					email: TEST_USER.email,

     

       833
       833
       -
       					password: hashedPassword,

     

       834
       834
       -
       				}),

     

       835
       835
       -
       			});

     

       836
       836
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       560
       560
       +
       		test("should reject invalid password format", async () => {

     

       561
       561
       +
       			// Register and login

     

       562
       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       837
       563
        
       

     

       838
       564
        
       			// Try to update with invalid format

     

       839
       565
        
       			const response = await authRequest(

     
···

       853
       579
        
       	});

     

       854
       580
        
       

     

       855
       581
        
       	describe("PUT /api/user/name", () => {

     

       856
       856
       -
       		serverTest("should update user name", async () => {

     

       857
       857
       -
       			// Register user

     

       858
       858
       -
       			const hashedPassword = await clientHashPassword(

     

       859
       859
       -
       				TEST_USER.email,

     

       860
       860
       -
       				TEST_USER.password,

     

       861
       861
       -
       			);

     

       862
       862
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       863
       863
       -
       				method: "POST",

     

       864
       864
       -
       				headers: { "Content-Type": "application/json" },

     

       865
       865
       -
       				body: JSON.stringify({

     

       866
       866
       -
       					email: TEST_USER.email,

     

       867
       867
       -
       					password: hashedPassword,

     

       868
       868
       -
       					name: TEST_USER.name,

     

       869
       869
       -
       				}),

     

       870
       870
       -
       			});

     

       871
       871
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       582
       582
       +
       		test("should update user name", async () => {

     

       583
       583
       +
       			// Register and login

     

       584
       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       872
       585
        
       

     

       873
       586
        
       			// Update name

     

       874
       587
        
       			const newName = "Updated Name";

     
···

       883
       596
        
       			);

     

       884
       597
        
       

     

       885
       598
        
       			expect(response.status).toBe(200);

     

       886
       886
       -
       			const data = await response.json();

     

       887
       887
       -
       			expect(data.success).toBe(true);

     

       888
       599
        
       

     

       889
       600
        
       			// Verify name updated

     

       890
       601
        
       			const meResponse = await authRequest(

     
···

       895
       606
        
       			expect(meData.name).toBe(newName);

     

       896
       607
        
       		});

     

       897
       608
        
       

     

       898
       898
       -
       		serverTest("should reject missing name", async () => {

     

       899
       899
       -
       			// Register user

     

       900
       900
       -
       			const hashedPassword = await clientHashPassword(

     

       901
       901
       -
       				TEST_USER.email,

     

       902
       902
       -
       				TEST_USER.password,

     

       903
       903
       -
       			);

     

       904
       904
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       905
       905
       -
       				method: "POST",

     

       906
       906
       -
       				headers: { "Content-Type": "application/json" },

     

       907
       907
       -
       				body: JSON.stringify({

     

       908
       908
       -
       					email: TEST_USER.email,

     

       909
       909
       -
       					password: hashedPassword,

     

       910
       910
       -
       				}),

     

       911
       911
       -
       			});

     

       912
       912
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       609
       609
       +
       		test("should reject missing name", async () => {

     

       610
       610
       +
       			// Register and login

     

       611
       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       913
       612
        
       

     

       914
       613
        
       			const response = await authRequest(

     

       915
       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       926
       625
        
       	});

     

       927
       626
        
       

     

       928
       627
        
       	describe("PUT /api/user/avatar", () => {

     

       929
       929
       -
       		serverTest("should update user avatar", async () => {

     

       930
       930
       -
       			// Register user

     

       931
       931
       -
       			const hashedPassword = await clientHashPassword(

     

       932
       932
       -
       				TEST_USER.email,

     

       933
       933
       -
       				TEST_USER.password,

     

       934
       934
       -
       			);

     

       935
       935
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       936
       936
       -
       				method: "POST",

     

       937
       937
       -
       				headers: { "Content-Type": "application/json" },

     

       938
       938
       -
       				body: JSON.stringify({

     

       939
       939
       -
       					email: TEST_USER.email,

     

       940
       940
       -
       					password: hashedPassword,

     

       941
       941
       -
       				}),

     

       942
       942
       -
       			});

     

       943
       943
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       628
       628
       +
       		test("should update user avatar", async () => {

     

       629
       629
       +
       			// Register and login

     

       630
       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       944
       631
        
       

     

       945
       632
        
       			// Update avatar

     

       946
       633
        
       			const newAvatar = "👨‍💻";

     
···

       969
       656
        
       	});

     

       970
       657
        
       });

     

       971
       658
        
       

     

       972
       972
       -
       describe("API Endpoints - Transcriptions", () => {

     

       973
       973
       -
       	describe("GET /api/transcriptions/health", () => {

     

       974
       974
       -
       		serverTest(

     

       975
       975
       -
       			"should return transcription service health status",

     

       976
       976
       -
       			async () => {

     

       977
       977
       -
       				const response = await fetch(`${BASE_URL}/api/transcriptions/health`);

     

       659
       659
       +
       describe("API Endpoints - Health", () => {

     

       660
       660
       +
       	describe("GET /api/health", () => {

     

       661
       661
       +
       		test("should return service health status with details", async () => {

     

       662
       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       978
       663
        
       

     

       979
       979
       -
       				expect(response.status).toBe(200);

     

       980
       980
       -
       				const data = await response.json();

     

       981
       981
       -
       				expect(data).toHaveProperty("available");

     

       982
       982
       -
       				expect(typeof data.available).toBe("boolean");

     

       983
       983
       -
       			},

     

       984
       984
       -
       		);

     

       664
       664
       +
       			expect(response.status).toBe(200);

     

       665
       665
       +
       			const data = await response.json();

     

       666
       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       672
       +
       		});

     

       985
       673
        
       	});

     

       674
       674
       +
       });

     

       986
       675
        
       

     

       676
       676
       +
       describe("API Endpoints - Transcriptions", () => {

     

       987
       677
        
       	describe("GET /api/transcriptions", () => {

     

       988
       988
       -
       		serverTest("should return user transcriptions", async () => {

     

       989
       989
       -
       			// Register user

     

       990
       990
       -
       			const hashedPassword = await clientHashPassword(

     

       991
       991
       -
       				TEST_USER.email,

     

       992
       992
       -
       				TEST_USER.password,

     

       993
       993
       -
       			);

     

       994
       994
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       995
       995
       -
       				method: "POST",

     

       996
       996
       -
       				headers: { "Content-Type": "application/json" },

     

       997
       997
       -
       				body: JSON.stringify({

     

       998
       998
       -
       					email: TEST_USER.email,

     

       999
       999
       -
       					password: hashedPassword,

     

       1000
       1000
       -
       				}),

     

       1001
       1001
       -
       			});

     

       1002
       1002
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       678
       678
       +
       		test("should return user transcriptions", async () => {

     

       679
       679
       +
       			// Register and login

     

       680
       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       681
       +
       

     

       682
       682
       +
       			// Add subscription

     

       683
       683
       +
       			addSubscription(TEST_USER.email);

     

       1003
       684
        
       

     

       1004
       685
        
       			// Get transcriptions

     

       1005
       686
        
       			const response = await authRequest(

     
···

       1013
       694
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       1014
       695
        
       		});

     

       1015
       696
        
       

     

       1016
       1016
       -
       		serverTest("should require authentication", async () => {

     

       697
       697
       +
       		test("should require authentication", async () => {

     

       1017
       698
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       1018
       699
        
       

     

       1019
       700
        
       			expect(response.status).toBe(401);

     
···

       1021
       702
        
       	});

     

       1022
       703
        
       

     

       1023
       704
        
       	describe("POST /api/transcriptions", () => {

     

       1024
       1024
       -
       		serverTest("should upload audio file and start transcription", async () => {

     

       1025
       1025
       -
       			// Register user

     

       1026
       1026
       -
       			const hashedPassword = await clientHashPassword(

     

       1027
       1027
       -
       				TEST_USER.email,

     

       1028
       1028
       -
       				TEST_USER.password,

     

       1029
       1029
       -
       			);

     

       1030
       1030
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1031
       1031
       -
       				method: "POST",

     

       1032
       1032
       -
       				headers: { "Content-Type": "application/json" },

     

       1033
       1033
       -
       				body: JSON.stringify({

     

       1034
       1034
       -
       					email: TEST_USER.email,

     

       1035
       1035
       -
       					password: hashedPassword,

     

       1036
       1036
       -
       				}),

     

       1037
       1037
       -
       			});

     

       1038
       1038
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       705
       705
       +
       		test("should upload audio file and start transcription", async () => {

     

       706
       706
       +
       			// Register and login

     

       707
       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       708
       +
       

     

       709
       709
       +
       			// Add subscription

     

       710
       710
       +
       			addSubscription(TEST_USER.email);

     

       1039
       711
        
       

     

       1040
       712
        
       			// Create a test audio file

     

       1041
       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1053
       725
        
       				},

     

       1054
       726
        
       			);

     

       1055
       727
        
       

     

       1056
       1056
       -
       			expect(response.status).toBe(200);

     

       728
       728
       +
       			expect(response.status).toBe(201);

     

       1057
       729
        
       			const data = await response.json();

     

       1058
       730
        
       			expect(data.id).toBeDefined();

     

       1059
       731
        
       			expect(data.message).toContain("Upload successful");

     

       1060
       732
        
       		});

     

       1061
       733
        
       

     

       1062
       1062
       -
       		serverTest("should reject non-audio files", async () => {

     

       1063
       1063
       -
       			// Register user

     

       1064
       1064
       -
       			const hashedPassword = await clientHashPassword(

     

       1065
       1065
       -
       				TEST_USER.email,

     

       1066
       1066
       -
       				TEST_USER.password,

     

       1067
       1067
       -
       			);

     

       1068
       1068
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1069
       1069
       -
       				method: "POST",

     

       1070
       1070
       -
       				headers: { "Content-Type": "application/json" },

     

       1071
       1071
       -
       				body: JSON.stringify({

     

       1072
       1072
       -
       					email: TEST_USER.email,

     

       1073
       1073
       -
       					password: hashedPassword,

     

       1074
       1074
       -
       				}),

     

       1075
       1075
       -
       			});

     

       1076
       1076
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       734
       734
       +
       		test("should reject non-audio files", async () => {

     

       735
       735
       +
       			// Register and login

     

       736
       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       737
       +
       

     

       738
       738
       +
       			// Add subscription

     

       739
       739
       +
       			addSubscription(TEST_USER.email);

     

       1077
       740
        
       

     

       1078
       741
        
       			// Try to upload non-audio file

     

       1079
       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1092
       755
        
       			expect(response.status).toBe(400);

     

       1093
       756
        
       		});

     

       1094
       757
        
       

     

       1095
       1095
       -
       		serverTest("should reject files exceeding size limit", async () => {

     

       1096
       1096
       -
       			// Register user

     

       1097
       1097
       -
       			const hashedPassword = await clientHashPassword(

     

       1098
       1098
       -
       				TEST_USER.email,

     

       1099
       1099
       -
       				TEST_USER.password,

     

       1100
       1100
       -
       			);

     

       1101
       1101
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1102
       1102
       -
       				method: "POST",

     

       1103
       1103
       -
       				headers: { "Content-Type": "application/json" },

     

       1104
       1104
       -
       				body: JSON.stringify({

     

       1105
       1105
       -
       					email: TEST_USER.email,

     

       1106
       1106
       -
       					password: hashedPassword,

     

       1107
       1107
       -
       				}),

     

       1108
       1108
       -
       			});

     

       1109
       1109
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       758
       758
       +
       		test("should reject files exceeding size limit", async () => {

     

       759
       759
       +
       			// Register and login

     

       760
       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       761
       +
       

     

       762
       762
       +
       			// Add subscription

     

       763
       763
       +
       			addSubscription(TEST_USER.email);

     

       1110
       764
        
       

     

       1111
       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       1112
       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1129
       783
        
       			expect(data.error).toContain("File size must be less than");

     

       1130
       784
        
       		});

     

       1131
       785
        
       

     

       1132
       1132
       -
       		serverTest("should require authentication", async () => {

     

       786
       786
       +
       		test("should require authentication", async () => {

     

       1133
       787
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       1134
       788
        
       			const formData = new FormData();

     

       1135
       789
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       1150
       804
        
       	let userId: number;

     

       1151
       805
        
       

     

       1152
       806
        
       	beforeEach(async () => {

     

       1153
       1153
       -
       		if (!serverAvailable) return;

     

       1154
       1154
       -
       

     

       1155
       807
        
       		// Create admin user

     

       1156
       1156
       -
       		const adminHash = await clientHashPassword(

     

       1157
       1157
       -
       			TEST_ADMIN.email,

     

       1158
       1158
       -
       			TEST_ADMIN.password,

     

       1159
       1159
       -
       		);

     

       1160
       1160
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1161
       1161
       -
       			method: "POST",

     

       1162
       1162
       -
       			headers: { "Content-Type": "application/json" },

     

       1163
       1163
       -
       			body: JSON.stringify({

     

       1164
       1164
       -
       				email: TEST_ADMIN.email,

     

       1165
       1165
       -
       				password: adminHash,

     

       1166
       1166
       -
       				name: TEST_ADMIN.name,

     

       1167
       1167
       -
       			}),

     

       1168
       1168
       -
       		});

     

       1169
       1169
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       808
       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       1170
       809
        
       

     

       1171
       810
        
       		// Manually set admin role in database

     

       811
       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       1172
       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1173
       813
        
       			TEST_ADMIN.email,

     

       1174
       814
        
       		]);

     

       1175
       815
        
       

     

       1176
       816
        
       		// Create regular user

     

       1177
       1177
       -
       		const userHash = await clientHashPassword(

     

       1178
       1178
       -
       			TEST_USER.email,

     

       1179
       1179
       -
       			TEST_USER.password,

     

       1180
       1180
       -
       		);

     

       1181
       1181
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1182
       1182
       -
       			method: "POST",

     

       1183
       1183
       -
       			headers: { "Content-Type": "application/json" },

     

       1184
       1184
       -
       			body: JSON.stringify({

     

       1185
       1185
       -
       				email: TEST_USER.email,

     

       1186
       1186
       -
       				password: userHash,

     

       1187
       1187
       -
       				name: TEST_USER.name,

     

       1188
       1188
       -
       			}),

     

       1189
       1189
       -
       		});

     

       1190
       1190
       -
       		userCookie = extractSessionCookie(userResponse);

     

       817
       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       1191
       818
        
       

     

       1192
       819
        
       		// Get user ID

     

       1193
       820
        
       		const userIdResult = db

     

       1194
       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1195
       822
        
       			.get(TEST_USER.email);

     

       1196
       823
        
       		userId = userIdResult?.id;

     

       824
       824
       +
       

     

       825
       825
       +
       		db.close();

     

       1197
       826
        
       	});

     

       1198
       827
        
       

     

       1199
       828
        
       	describe("GET /api/admin/users", () => {

     

       1200
       1200
       -
       		serverTest("should return all users for admin", async () => {

     

       829
       829
       +
       		test("should return all users for admin", async () => {

     

       1201
       830
        
       			const response = await authRequest(

     

       1202
       831
        
       				`${BASE_URL}/api/admin/users`,

     

       1203
       832
        
       				adminCookie,

     
···

       1209
       838
        
       			expect(data.length).toBeGreaterThan(0);

     

       1210
       839
        
       		});

     

       1211
       840
        
       

     

       1212
       1212
       -
       		serverTest("should reject non-admin users", async () => {

     

       841
       841
       +
       		test("should reject non-admin users", async () => {

     

       1213
       842
        
       			const response = await authRequest(

     

       1214
       843
        
       				`${BASE_URL}/api/admin/users`,

     

       1215
       844
        
       				userCookie,

     
···

       1218
       847
        
       			expect(response.status).toBe(403);

     

       1219
       848
        
       		});

     

       1220
       849
        
       

     

       1221
       1221
       -
       		serverTest("should require authentication", async () => {

     

       850
       850
       +
       		test("should require authentication", async () => {

     

       1222
       851
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       1223
       852
        
       

     

       1224
       853
        
       			expect(response.status).toBe(401);

     
···

       1226
       855
        
       	});

     

       1227
       856
        
       

     

       1228
       857
        
       	describe("GET /api/admin/transcriptions", () => {

     

       1229
       1229
       -
       		serverTest("should return all transcriptions for admin", async () => {

     

       858
       858
       +
       		test("should return all transcriptions for admin", async () => {

     

       1230
       859
        
       			const response = await authRequest(

     

       1231
       860
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1232
       861
        
       				adminCookie,

     
···

       1237
       866
        
       			expect(Array.isArray(data)).toBe(true);

     

       1238
       867
        
       		});

     

       1239
       868
        
       

     

       1240
       1240
       -
       		serverTest("should reject non-admin users", async () => {

     

       869
       869
       +
       		test("should reject non-admin users", async () => {

     

       1241
       870
        
       			const response = await authRequest(

     

       1242
       871
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1243
       872
        
       				userCookie,

     
···

       1248
       877
        
       	});

     

       1249
       878
        
       

     

       1250
       879
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       1251
       1251
       -
       		serverTest("should delete user as admin", async () => {

     

       880
       880
       +
       		test("should delete user as admin", async () => {

     

       1252
       881
        
       			const response = await authRequest(

     

       1253
       882
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1254
       883
        
       				adminCookie,

     
···

       1257
       886
        
       				},

     

       1258
       887
        
       			);

     

       1259
       888
        
       

     

       1260
       1260
       -
       			expect(response.status).toBe(200);

     

       1261
       1261
       -
       			const data = await response.json();

     

       1262
       1262
       -
       			expect(data.success).toBe(true);

     

       889
       889
       +
       			expect(response.status).toBe(204);

     

       1263
       890
        
       

     

       1264
       891
        
       			// Verify user is deleted

     

       1265
       892
        
       			const verifyResponse = await authRequest(

     
···

       1269
       896
        
       			expect(verifyResponse.status).toBe(401);

     

       1270
       897
        
       		});

     

       1271
       898
        
       

     

       1272
       1272
       -
       		serverTest("should reject non-admin users", async () => {

     

       899
       899
       +
       		test("should reject non-admin users", async () => {

     

       1273
       900
        
       			const response = await authRequest(

     

       1274
       901
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1275
       902
        
       				userCookie,

     
···

       1283
       910
        
       	});

     

       1284
       911
        
       

     

       1285
       912
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       1286
       1286
       -
       		serverTest("should update user role as admin", async () => {

     

       913
       913
       +
       		test("should update user role as admin", async () => {

     

       1287
       914
        
       			const response = await authRequest(

     

       1288
       915
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1289
       916
        
       				adminCookie,

     
···

       1295
       922
        
       			);

     

       1296
       923
        
       

     

       1297
       924
        
       			expect(response.status).toBe(200);

     

       1298
       1298
       -
       			const data = await response.json();

     

       1299
       1299
       -
       			expect(data.success).toBe(true);

     

       1300
       925
        
       

     

       1301
       926
        
       			// Verify role updated

     

       1302
       927
        
       			const meResponse = await authRequest(

     
···

       1307
       932
        
       			expect(meData.role).toBe("admin");

     

       1308
       933
        
       		});

     

       1309
       934
        
       

     

       1310
       1310
       -
       		serverTest("should reject invalid roles", async () => {

     

       935
       935
       +
       		test("should reject invalid roles", async () => {

     

       1311
       936
        
       			const response = await authRequest(

     

       1312
       937
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1313
       938
        
       				adminCookie,

     
···

       1323
       948
        
       	});

     

       1324
       949
        
       

     

       1325
       950
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       1326
       1326
       -
       		serverTest("should return user details for admin", async () => {

     

       951
       951
       +
       		test("should return user details for admin", async () => {

     

       1327
       952
        
       			const response = await authRequest(

     

       1328
       953
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1329
       954
        
       				adminCookie,

     
···

       1337
       962
        
       			expect(data).toHaveProperty("sessions");

     

       1338
       963
        
       		});

     

       1339
       964
        
       

     

       1340
       1340
       -
       		serverTest("should reject non-admin users", async () => {

     

       965
       965
       +
       		test("should reject non-admin users", async () => {

     

       1341
       966
        
       			const response = await authRequest(

     

       1342
       967
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1343
       968
        
       				userCookie,

     
···

       1348
       973
        
       	});

     

       1349
       974
        
       

     

       1350
       975
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       1351
       1351
       -
       		serverTest("should update user name as admin", async () => {

     

       976
       976
       +
       		test("should update user name as admin", async () => {

     

       1352
       977
        
       			const newName = "Admin Updated Name";

     

       1353
       978
        
       			const response = await authRequest(

     

       1354
       979
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       1365
       990
        
       			expect(data.success).toBe(true);

     

       1366
       991
        
       		});

     

       1367
       992
        
       

     

       1368
       1368
       -
       		serverTest("should reject empty names", async () => {

     

       993
       993
       +
       		test("should reject empty names", async () => {

     

       1369
       994
        
       			const response = await authRequest(

     

       1370
       995
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       1371
       996
        
       				adminCookie,

     
···

       1381
       1006
        
       	});

     

       1382
       1007
        
       

     

       1383
       1008
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1384
       1384
       -
       		serverTest("should update user email as admin", async () => {

     

       1009
       1009
       +
       		test("should update user email as admin", async () => {

     

       1385
       1010
        
       			const newEmail = "newemail@admin.com";

     

       1386
       1011
        
       			const response = await authRequest(

     

       1387
       1012
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1398
       1023
        
       			expect(data.success).toBe(true);

     

       1399
       1024
        
       		});

     

       1400
       1025
        
       

     

       1401
       1401
       -
       		serverTest("should reject duplicate emails", async () => {

     

       1026
       1026
       +
       		test("should reject duplicate emails", async () => {

     

       1402
       1027
        
       			const response = await authRequest(

     

       1403
       1028
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1404
       1029
        
       				adminCookie,

     
···

       1409
       1034
        
       				},

     

       1410
       1035
        
       			);

     

       1411
       1036
        
       

     

       1412
       1412
       -
       			expect(response.status).toBe(400);

     

       1037
       1037
       +
       			expect(response.status).toBe(409);

     

       1413
       1038
        
       			const data = await response.json();

     

       1414
       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1415
       1040
        
       		});

     

       1416
       1041
        
       	});

     

       1417
       1042
        
       

     

       1418
       1043
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1419
       1419
       -
       		serverTest("should return user sessions as admin", async () => {

     

       1044
       1044
       +
       		test("should return user sessions as admin", async () => {

     

       1420
       1045
        
       			const response = await authRequest(

     

       1421
       1046
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1422
       1047
        
       				adminCookie,

     
···

       1429
       1054
        
       	});

     

       1430
       1055
        
       

     

       1431
       1056
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1432
       1432
       -
       		serverTest("should delete all user sessions as admin", async () => {

     

       1057
       1057
       +
       		test("should delete all user sessions as admin", async () => {

     

       1433
       1058
        
       			const response = await authRequest(

     

       1434
       1059
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1435
       1060
        
       				adminCookie,

     
···

       1438
       1063
        
       				},

     

       1439
       1064
        
       			);

     

       1440
       1065
        
       

     

       1441
       1441
       -
       			expect(response.status).toBe(200);

     

       1442
       1442
       -
       			const data = await response.json();

     

       1443
       1443
       -
       			expect(data.success).toBe(true);

     

       1066
       1066
       +
       			expect(response.status).toBe(204);

     

       1444
       1067
        
       

     

       1445
       1068
        
       			// Verify sessions are deleted

     

       1446
       1069
        
       			const verifyResponse = await authRequest(

     
···

       1456
       1079
        
       	let sessionCookie: string;

     

       1457
       1080
        
       

     

       1458
       1081
        
       	beforeEach(async () => {

     

       1459
       1459
       -
       		if (!serverAvailable) return;

     

       1460
       1460
       -
       

     

       1461
       1461
       -
       		// Register user

     

       1462
       1462
       -
       		const hashedPassword = await clientHashPassword(

     

       1463
       1463
       -
       			TEST_USER.email,

     

       1464
       1464
       -
       			TEST_USER.password,

     

       1465
       1465
       -
       		);

     

       1466
       1466
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1467
       1467
       -
       			method: "POST",

     

       1468
       1468
       -
       			headers: { "Content-Type": "application/json" },

     

       1469
       1469
       -
       			body: JSON.stringify({

     

       1470
       1470
       -
       				email: TEST_USER.email,

     

       1471
       1471
       -
       				password: hashedPassword,

     

       1472
       1472
       -
       			}),

     

       1473
       1473
       -
       		});

     

       1474
       1474
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1082
       1082
       +
       		// Register and login

     

       1083
       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       1475
       1084
        
       	});

     

       1476
       1085
        
       

     

       1477
       1086
        
       	describe("GET /api/passkeys", () => {

     

       1478
       1478
       -
       		serverTest("should return user passkeys", async () => {

     

       1087
       1087
       +
       		test("should return user passkeys", async () => {

     

       1479
       1088
        
       			const response = await authRequest(

     

       1480
       1089
        
       				`${BASE_URL}/api/passkeys`,

     

       1481
       1090
        
       				sessionCookie,

     
···

       1487
       1096
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1488
       1097
        
       		});

     

       1489
       1098
        
       

     

       1490
       1490
       -
       		serverTest("should require authentication", async () => {

     

       1099
       1099
       +
       		test("should require authentication", async () => {

     

       1491
       1100
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1492
       1101
        
       

     

       1493
       1102
        
       			expect(response.status).toBe(401);

     
···

       1495
       1104
        
       	});

     

       1496
       1105
        
       

     

       1497
       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1498
       1498
       -
       		serverTest(

     

       1499
       1499
       -
       			"should return registration options for authenticated user",

     

       1500
       1500
       -
       			async () => {

     

       1501
       1501
       -
       				const response = await authRequest(

     

       1502
       1502
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1503
       1503
       -
       					sessionCookie,

     

       1504
       1504
       -
       					{

     

       1505
       1505
       -
       						method: "POST",

     

       1506
       1506
       -
       					},

     

       1507
       1507
       -
       				);

     

       1107
       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       1108
       +
       			const response = await authRequest(

     

       1109
       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       1110
       +
       				sessionCookie,

     

       1111
       1111
       +
       				{

     

       1112
       1112
       +
       					method: "POST",

     

       1113
       1113
       +
       				},

     

       1114
       1114
       +
       			);

     

       1508
       1115
        
       

     

       1509
       1509
       -
       				expect(response.status).toBe(200);

     

       1510
       1510
       -
       				const data = await response.json();

     

       1511
       1511
       -
       				expect(data).toHaveProperty("challenge");

     

       1512
       1512
       -
       				expect(data).toHaveProperty("rp");

     

       1513
       1513
       -
       				expect(data).toHaveProperty("user");

     

       1514
       1514
       -
       			},

     

       1515
       1515
       -
       		);

     

       1116
       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       1117
       +
       			const data = await response.json();

     

       1118
       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       1121
       +
       		});

     

       1516
       1122
        
       

     

       1517
       1517
       -
       		serverTest("should require authentication", async () => {

     

       1123
       1123
       +
       		test("should require authentication", async () => {

     

       1518
       1124
        
       			const response = await fetch(

     

       1519
       1125
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1520
       1126
        
       				{

     
···

       1527
       1133
        
       	});

     

       1528
       1134
        
       

     

       1529
       1135
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1530
       1530
       -
       		serverTest("should return authentication options for email", async () => {

     

       1136
       1136
       +
       		test("should return authentication options for email", async () => {

     

       1531
       1137
        
       			const response = await fetch(

     

       1532
       1138
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1533
       1139
        
       				{

     
···

       1542
       1148
        
       			expect(data).toHaveProperty("challenge");

     

       1543
       1149
        
       		});

     

       1544
       1150
        
       

     

       1545
       1545
       -
       		serverTest("should handle non-existent email", async () => {

     

       1151
       1151
       +
       		test("should handle non-existent email", async () => {

     

       1546
       1152
        
       			const response = await fetch(

     

       1547
       1153
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1548
       1154
        
       				{

+2123 -506

src/index.ts

···

       2
       2
        
       import {

     

       3
       3
        
       	authenticateUser,

     

       4
       4
        
       	cleanupExpiredSessions,

     

       5
       5
       +
       	consumeEmailChangeToken,

     

       6
       6
       +
       	consumePasswordResetToken,

     

       7
       7
       +
       	createEmailChangeToken,

     

       8
       8
       +
       	createEmailVerificationToken,

     

       9
       9
       +
       	createPasswordResetToken,

     

       5
       10
        
       	createSession,

     

       6
       11
        
       	createUser,

     

       7
       12
        
       	deleteAllUserSessions,

     
···

       17
       22
        
       	getUserByEmail,

     

       18
       23
        
       	getUserBySession,

     

       19
       24
        
       	getUserSessionsForUser,

     

       25
       25
       +
       	getVerificationCodeSentAt,

     

       26
       26
       +
       	isEmailVerified,

     

       20
       27
        
       	type UserRole,

     

       21
       28
        
       	updateUserAvatar,

     

       22
       29
        
       	updateUserEmail,

     
···

       24
       31
        
       	updateUserName,

     

       25
       32
        
       	updateUserPassword,

     

       26
       33
        
       	updateUserRole,

     

       34
       34
       +
       	verifyEmailChangeToken,

     

       35
       35
       +
       	verifyEmailCode,

     

       36
       36
       +
       	verifyEmailToken,

     

       37
       37
       +
       	verifyPasswordResetToken,

     

       27
       38
        
       } from "./lib/auth";

     

       28
       39
        
       import {

     

       29
       40
        
       	addToWaitlist,

     
···

       37
       48
        
       	getClassById,

     

       38
       49
        
       	getClassesForUser,

     

       39
       50
        
       	getClassMembers,

     

       51
       51
       +
       	getClassSections,

     

       52
       52
       +
       	getMeetingById,

     

       40
       53
        
       	getMeetingTimesForClass,

     

       41
       54
        
       	getTranscriptionsForClass,

     

       55
       55
       +
       	getUserSection,

     

       42
       56
        
       	isUserEnrolledInClass,

     

       43
       57
        
       	joinClass,

     

       44
       58
        
       	removeUserFromClass,

     

       45
       59
        
       	searchClassesByCourseCode,

     

       46
       60
        
       	toggleClassArchive,

     

       47
       61
        
       	updateMeetingTime,

     

       62
       62
       +
       	createClassSection,

     

       48
       63
        
       } from "./lib/classes";

     

       49
       49
       -
       import { handleError, ValidationErrors } from "./lib/errors";

     

       64
       64
       +
       import { sendEmail } from "./lib/email";

     

       50
       65
        
       import {

     

       66
       66
       +
       	emailChangeTemplate,

     

       67
       67
       +
       	passwordResetTemplate,

     

       68
       68
       +
       	verifyEmailTemplate,

     

       69
       69
       +
       } from "./lib/email-templates";

     

       70
       70
       +
       import { AuthErrors, handleError, ValidationErrors } from "./lib/errors";

     

       71
       71
       +
       import {

     

       72
       72
       +
       	hasActiveSubscription,

     

       51
       73
        
       	requireAdmin,

     

       52
       74
        
       	requireAuth,

     

       53
       75
        
       	requireSubscription,

     
···

       61
       83
        
       	verifyAndAuthenticatePasskey,

     

       62
       84
        
       	verifyAndCreatePasskey,

     

       63
       85
        
       } from "./lib/passkey";

     

       64
       64
       -
       import { enforceRateLimit } from "./lib/rate-limit";

     

       86
       86
       +
       import { clearRateLimit, enforceRateLimit } from "./lib/rate-limit";

     

       65
       87
        
       import { getTranscriptVTT } from "./lib/transcript-storage";

     

       66
       88
        
       import {

     

       67
       89
        
       	MAX_FILE_SIZE,

     
···

       69
       91
        
       	type TranscriptionUpdate,

     

       70
       92
        
       	WhisperServiceManager,

     

       71
       93
        
       } from "./lib/transcription";

     

       94
       94
       +
       import {

     

       95
       95
       +
       	findMatchingMeetingTime,

     

       96
       96
       +
       	getDayName,

     

       97
       97
       +
       } from "./lib/audio-metadata";

     

       98
       98
       +
       import {

     

       99
       99
       +
       	checkAutoSubmit,

     

       100
       100
       +
       	deletePendingRecording,

     

       101
       101
       +
       	getEnrolledUserCount,

     

       102
       102
       +
       	getPendingRecordings,

     

       103
       103
       +
       	getUserVoteForMeeting,

     

       104
       104
       +
       	markAsAutoSubmitted,

     

       105
       105
       +
       	removeVote,

     

       106
       106
       +
       	voteForRecording,

     

       107
       107
       +
       } from "./lib/voting";

     

       108
       108
       +
       import {

     

       109
       109
       +
       	validateClassId,

     

       110
       110
       +
       	validateCourseCode,

     

       111
       111
       +
       	validateCourseName,

     

       112
       112
       +
       	validateEmail,

     

       113
       113
       +
       	validateName,

     

       114
       114
       +
       	validatePasswordHash,

     

       115
       115
       +
       	validateSemester,

     

       116
       116
       +
       	validateYear,

     

       117
       117
       +
       } from "./lib/validation";

     

       72
       118
        
       import adminHTML from "./pages/admin.html";

     

       73
       119
        
       import checkoutHTML from "./pages/checkout.html";

     

       74
       120
        
       import classHTML from "./pages/class.html";

     

       75
       121
        
       import classesHTML from "./pages/classes.html";

     

       76
       122
        
       import indexHTML from "./pages/index.html";

     

       123
       123
       +
       import resetPasswordHTML from "./pages/reset-password.html";

     

       77
       124
        
       import settingsHTML from "./pages/settings.html";

     

       78
       125
        
       import transcribeHTML from "./pages/transcribe.html";

     

       79
       126
        
       

     

       127
       127
       +
       // Validate required environment variables at startup

     

       128
       128
       +
       function validateEnvVars() {

     

       129
       129
       +
       	const required = [

     

       130
       130
       +
       		"POLAR_ORGANIZATION_ID",

     

       131
       131
       +
       		"POLAR_PRODUCT_ID",

     

       132
       132
       +
       		"POLAR_SUCCESS_URL",

     

       133
       133
       +
       		"POLAR_WEBHOOK_SECRET",

     

       134
       134
       +
       		"MAILCHANNELS_API_KEY",

     

       135
       135
       +
       		"DKIM_PRIVATE_KEY",

     

       136
       136
       +
       		"LLM_API_KEY",

     

       137
       137
       +
       		"LLM_API_BASE_URL",

     

       138
       138
       +
       		"LLM_MODEL",

     

       139
       139
       +
       	];

     

       140
       140
       +
       

     

       141
       141
       +
       	const missing = required.filter((key) => !process.env[key]);

     

       142
       142
       +
       

     

       143
       143
       +
       	if (missing.length > 0) {

     

       144
       144
       +
       		console.error(

     

       145
       145
       +
       			`[Startup] Missing required environment variables: ${missing.join(", ")}`,

     

       146
       146
       +
       		);

     

       147
       147
       +
       		console.error("[Startup] Please check your .env file");

     

       148
       148
       +
       		process.exit(1);

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	// Validate ORIGIN is set for production

     

       152
       152
       +
       	if (!process.env.ORIGIN) {

     

       153
       153
       +
       		console.warn(

     

       154
       154
       +
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       155
       155
       +
       		);

     

       156
       156
       +
       		console.warn("[Startup] Set ORIGIN in production for correct email links");

     

       157
       157
       +
       	}

     

       158
       158
       +
       

     

       159
       159
       +
       	console.log("[Startup] Environment variable validation passed");

     

       160
       160
       +
       }

     

       161
       161
       +
       

     

       162
       162
       +
       validateEnvVars();

     

       163
       163
       +
       

     

       80
       164
        
       // Environment variables

     

       81
       165
        
       const WHISPER_SERVICE_URL =

     

       82
       166
        
       	process.env.WHISPER_SERVICE_URL || "http://localhost:8000";

     
···

       96
       180
        
       	transcriptionEvents,

     

       97
       181
        
       );

     

       98
       182
        
       

     

       99
       99
       -
       // Clean up expired sessions every hour

     

       100
       100
       -
       setInterval(cleanupExpiredSessions, 60 * 60 * 1000);

     

       183
       183
       +
       // Clean up expired sessions every 15 minutes

     

       184
       184
       +
       const sessionCleanupInterval = setInterval(

     

       185
       185
       +
       	cleanupExpiredSessions,

     

       186
       186
       +
       	15 * 60 * 1000,

     

       187
       187
       +
       );

     

       188
       188
       +
       

     

       189
       189
       +
       // Helper function to sync user subscriptions from Polar

     

       190
       190
       +
       async function syncUserSubscriptionsFromPolar(

     

       191
       191
       +
       	userId: number,

     

       192
       192
       +
       	email: string,

     

       193
       193
       +
       ): Promise<void> {

     

       194
       194
       +
       	// Skip Polar sync in test mode

     

       195
       195
       +
       	if (

     

       196
       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       198
       +
       	) {

     

       199
       199
       +
       		return;

     

       200
       200
       +
       	}

     

       201
       201
       +
       

     

       202
       202
       +
       	try {

     

       203
       203
       +
       		const { polar } = await import("./lib/polar");

     

       204
       204
       +
       

     

       205
       205
       +
       		// Search for customer by email (validated at startup)

     

       206
       206
       +
       		const customers = await polar.customers.list({

     

       207
       207
       +
       			organizationId: process.env.POLAR_ORGANIZATION_ID as string,

     

       208
       208
       +
       			query: email,

     

       209
       209
       +
       		});

     

       210
       210
       +
       

     

       211
       211
       +
       		if (!customers.result.items || customers.result.items.length === 0) {

     

       212
       212
       +
       			console.log(`[Sync] No Polar customer found for ${email}`);

     

       213
       213
       +
       			return;

     

       214
       214
       +
       		}

     

       215
       215
       +
       

     

       216
       216
       +
       		const customer = customers.result.items[0];

     

       217
       217
       +
       

     

       218
       218
       +
       		// Get all subscriptions for this customer

     

       219
       219
       +
       		const subscriptions = await polar.subscriptions.list({

     

       220
       220
       +
       			customerId: customer.id,

     

       221
       221
       +
       		});

     

       222
       222
       +
       

     

       223
       223
       +
       		if (

     

       224
       224
       +
       			!subscriptions.result.items ||

     

       225
       225
       +
       			subscriptions.result.items.length === 0

     

       226
       226
       +
       		) {

     

       227
       227
       +
       			console.log(`[Sync] No subscriptions found for customer ${customer.id}`);

     

       228
       228
       +
       			return;

     

       229
       229
       +
       		}

     

       230
       230
       +
       

     

       231
       231
       +
       		// Filter to only active/trialing/past_due subscriptions (not canceled/expired)

     

       232
       232
       +
       		const currentSubscriptions = subscriptions.result.items.filter(

     

       233
       233
       +
       			(sub) =>

     

       234
       234
       +
       				sub.status === "active" ||

     

       235
       235
       +
       				sub.status === "trialing" ||

     

       236
       236
       +
       				sub.status === "past_due",

     

       237
       237
       +
       		);

     

       238
       238
       +
       

     

       239
       239
       +
       		if (currentSubscriptions.length === 0) {

     

       240
       240
       +
       			console.log(

     

       241
       241
       +
       				`[Sync] No current subscriptions found for customer ${customer.id}`,

     

       242
       242
       +
       			);

     

       243
       243
       +
       			return;

     

       244
       244
       +
       		}

     

       245
       245
       +
       

     

       246
       246
       +
       		// Update each current subscription in the database

     

       247
       247
       +
       		for (const subscription of currentSubscriptions) {

     

       248
       248
       +
       			db.run(

     

       249
       249
       +
       				`INSERT INTO subscriptions (id, user_id, customer_id, status, current_period_start, current_period_end, cancel_at_period_end, canceled_at, updated_at)

     

       250
       250
       +
       				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

     

       251
       251
       +
       				 ON CONFLICT(id) DO UPDATE SET

     

       252
       252
       +
       				   user_id = excluded.user_id,

     

       253
       253
       +
       				   status = excluded.status,

     

       254
       254
       +
       				   current_period_start = excluded.current_period_start,

     

       255
       255
       +
       				   current_period_end = excluded.current_period_end,

     

       256
       256
       +
       				   cancel_at_period_end = excluded.cancel_at_period_end,

     

       257
       257
       +
       				   canceled_at = excluded.canceled_at,

     

       258
       258
       +
       				   updated_at = excluded.updated_at`,

     

       259
       259
       +
       				[

     

       260
       260
       +
       					subscription.id,

     

       261
       261
       +
       					userId,

     

       262
       262
       +
       					subscription.customerId,

     

       263
       263
       +
       					subscription.status,

     

       264
       264
       +
       					subscription.currentPeriodStart

     

       265
       265
       +
       						? Math.floor(

     

       266
       266
       +
       								new Date(subscription.currentPeriodStart).getTime() / 1000,

     

       267
       267
       +
       							)

     

       268
       268
       +
       						: null,

     

       269
       269
       +
       					subscription.currentPeriodEnd

     

       270
       270
       +
       						? Math.floor(

     

       271
       271
       +
       								new Date(subscription.currentPeriodEnd).getTime() / 1000,

     

       272
       272
       +
       							)

     

       273
       273
       +
       						: null,

     

       274
       274
       +
       					subscription.cancelAtPeriodEnd ? 1 : 0,

     

       275
       275
       +
       					subscription.canceledAt

     

       276
       276
       +
       						? Math.floor(new Date(subscription.canceledAt).getTime() / 1000)

     

       277
       277
       +
       						: null,

     

       278
       278
       +
       					Math.floor(Date.now() / 1000),

     

       279
       279
       +
       				],

     

       280
       280
       +
       			);

     

       281
       281
       +
       		}

     

       282
       282
       +
       

     

       283
       283
       +
       		console.log(

     

       284
       284
       +
       			`[Sync] Linked ${currentSubscriptions.length} current subscription(s) to user ${userId} (${email})`,

     

       285
       285
       +
       		);

     

       286
       286
       +
       	} catch (error) {

     

       287
       287
       +
       		console.error(

     

       288
       288
       +
       			`[Sync] Failed to sync subscriptions for ${email}:`,

     

       289
       289
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       290
       290
       +
       		);

     

       291
       291
       +
       		// Don't throw - registration should succeed even if sync fails

     

       292
       292
       +
       	}

     

       293
       293
       +
       }

     

       101
       294
        
       

     

       102
       295
        
       // Sync with Whisper DB on startup

     

       103
       296
        
       try {

     
···

       111
       304
        
       }

     

       112
       305
        
       

     

       113
       306
        
       // Periodic sync every 5 minutes as backup (SSE handles real-time updates)

     

       114
       114
       -
       setInterval(

     

       307
       307
       +
       const syncInterval = setInterval(

     

       115
       308
        
       	async () => {

     

       116
       309
        
       		try {

     

       117
       310
        
       			await whisperService.syncWithWhisper();

     
···

       125
       318
        
       	5 * 60 * 1000,

     

       126
       319
        
       );

     

       127
       320
        
       

     

       128
       128
       -
       // Clean up stale files daily

     

       129
       129
       -
       setInterval(() => whisperService.cleanupStaleFiles(), 24 * 60 * 60 * 1000);

     

       321
       321
       +
       // Clean up stale files hourly

     

       322
       322
       +
       const fileCleanupInterval = setInterval(

     

       323
       323
       +
       	() => whisperService.cleanupStaleFiles(),

     

       324
       324
       +
       	60 * 60 * 1000, // 1 hour

     

       325
       325
       +
       );

     

       130
       326
        
       

     

       131
       327
        
       const server = Bun.serve({

     

       132
       132
       -
       	port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000,

     

       328
       328
       +
       	port:

     

       329
       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       330
       +
       			? 3001

     

       331
       331
       +
       			: process.env.PORT

     

       332
       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       333
       +
       				: 3000,

     

       133
       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       134
       335
        
       	routes: {

     

       135
       336
        
       		"/": indexHTML,

     

       136
       337
        
       		"/admin": adminHTML,

     

       137
       338
        
       		"/checkout": checkoutHTML,

     

       138
       339
        
       		"/settings": settingsHTML,

     

       340
       340
       +
       		"/reset-password": resetPasswordHTML,

     

       139
       341
        
       		"/transcribe": transcribeHTML,

     

       140
       342
        
       		"/classes": classesHTML,

     

       141
       343
        
       		"/classes/*": classHTML,

     
···

       149
       351
        
       				try {

     

       150
       352
        
       					// Rate limiting

     

       151
       353
        
       					const rateLimitError = enforceRateLimit(req, "register", {

     

       152
       152
       -
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       354
       354
       +
       						ip: { max: 5, windowSeconds: 30 * 60 },

     

       153
       355
        
       					});

     

       154
       356
        
       					if (rateLimitError) return rateLimitError;

     

       155
       357
        
       

     
···

       161
       363
        
       							{ status: 400 },

     

       162
       364
        
       						);

     

       163
       365
        
       					}

     

       164
       164
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       165
       165
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       366
       366
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       367
       367
       +
       					const passwordValidation = validatePasswordHash(password);

     

       368
       368
       +
       					if (!passwordValidation.valid) {

     

       166
       369
        
       						return Response.json(

     

       167
       167
       -
       							{ error: "Invalid password format" },

     

       370
       370
       +
       							{ error: passwordValidation.error },

     

       168
       371
        
       							{ status: 400 },

     

       169
       372
        
       						);

     

       170
       373
        
       					}

     

       171
       374
        
       					const user = await createUser(email, password, name);

     

       375
       375
       +
       

     

       376
       376
       +
       					// Send verification email - MUST succeed for registration to complete

     

       377
       377
       +
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       378
       378
       +
       

     

       379
       379
       +
       					try {

     

       380
       380
       +
       						await sendEmail({

     

       381
       381
       +
       							to: user.email,

     

       382
       382
       +
       							subject: "Verify your email - Thistle",

     

       383
       383
       +
       							html: verifyEmailTemplate({

     

       384
       384
       +
       								name: user.name,

     

       385
       385
       +
       								code,

     

       386
       386
       +
       								token,

     

       387
       387
       +
       							}),

     

       388
       388
       +
       						});

     

       389
       389
       +
       					} catch (err) {

     

       390
       390
       +
       						console.error("[Email] Failed to send verification email:", err);

     

       391
       391
       +
       						// Rollback user creation - direct DB delete since user was just created

     

       392
       392
       +
       						db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [

     

       393
       393
       +
       							user.id,

     

       394
       394
       +
       						]);

     

       395
       395
       +
       						db.run("DELETE FROM sessions WHERE user_id = ?", [user.id]);

     

       396
       396
       +
       						db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       397
       397
       +
       						return Response.json(

     

       398
       398
       +
       							{

     

       399
       399
       +
       								error:

     

       400
       400
       +
       									"Failed to send verification email. Please try again later.",

     

       401
       401
       +
       							},

     

       402
       402
       +
       							{ status: 500 },

     

       403
       403
       +
       						);

     

       404
       404
       +
       					}

     

       405
       405
       +
       

     

       406
       406
       +
       					// Attempt to sync existing Polar subscriptions (after email succeeds)

     

       407
       407
       +
       					syncUserSubscriptionsFromPolar(user.id, user.email).catch(() => {

     

       408
       408
       +
       						// Silent fail - don't block registration

     

       409
       409
       +
       					});

     

       410
       410
       +
       

     

       411
       411
       +
       					// Clear rate limits on successful registration

     

       172
       412
        
       					const ipAddress =

     

       173
       413
        
       						req.headers.get("x-forwarded-for") ??

     

       174
       414
        
       						req.headers.get("x-real-ip") ??

     

       175
       415
        
       						"unknown";

     

       176
       176
       -
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       177
       177
       -
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       416
       416
       +
       					clearRateLimit("register", email, ipAddress);

     

       417
       417
       +
       

     

       418
       418
       +
       					// Return success but indicate email verification is needed

     

       419
       419
       +
       					// Don't create session yet - they need to verify first

     

       178
       420
        
       					return Response.json(

     

       179
       179
       -
       						{ user: { id: user.id, email: user.email } },

     

       180
       421
        
       						{

     

       181
       181
       -
       							headers: {

     

       182
       182
       -
       								"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       183
       183
       -
       							},

     

       422
       422
       +
       							user: { id: user.id, email: user.email },

     

       423
       423
       +
       							email_verification_required: true,

     

       424
       424
       +
       							verification_code_sent_at: sentAt,

     

       184
       425
        
       						},

     

       426
       426
       +
       						{ status: 201 },

     

       185
       427
        
       					);

     

       186
       428
        
       				} catch (err: unknown) {

     

       187
       429
        
       					const error = err as { message?: string };

     

       188
       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       189
       431
        
       						return Response.json(

     

       190
       432
        
       							{ error: "Email already registered" },

     

       191
       191
       -
       							{ status: 400 },

     

       433
       433
       +
       							{ status: 409 },

     

       192
       434
        
       						);

     

       193
       435
        
       					}

     

       436
       436
       +
       					console.error("[Auth] Registration error:", err);

     

       194
       437
        
       					return Response.json(

     

       195
       438
        
       						{ error: "Registration failed" },

     

       196
       439
        
       						{ status: 500 },

     
···

       212
       455
        
       

     

       213
       456
        
       					// Rate limiting: Per IP and per account

     

       214
       457
        
       					const rateLimitError = enforceRateLimit(req, "login", {

     

       215
       215
       -
       						ip: { max: 10, windowSeconds: 15 * 60 },

     

       216
       216
       -
       						account: { max: 5, windowSeconds: 15 * 60, email },

     

       458
       458
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       459
       459
       +
       						account: { max: 5, windowSeconds: 5 * 60, email },

     

       217
       460
        
       					});

     

       218
       461
        
       					if (rateLimitError) return rateLimitError;

     

       219
       462
        
       

     

       220
       220
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       221
       221
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       463
       463
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       464
       464
       +
       					const passwordValidation = validatePasswordHash(password);

     

       465
       465
       +
       					if (!passwordValidation.valid) {

     

       222
       466
        
       						return Response.json(

     

       223
       223
       -
       							{ error: "Invalid password format" },

     

       467
       467
       +
       							{ error: passwordValidation.error },

     

       224
       468
        
       							{ status: 400 },

     

       225
       469
        
       						);

     

       226
       470
        
       					}

     
···

       231
       475
        
       							{ status: 401 },

     

       232
       476
        
       						);

     

       233
       477
        
       					}

     

       478
       478
       +
       

     

       479
       479
       +
       					// Clear rate limits on successful authentication

     

       234
       480
        
       					const ipAddress =

     

       235
       481
        
       						req.headers.get("x-forwarded-for") ??

     

       236
       482
        
       						req.headers.get("x-real-ip") ??

     

       237
       483
        
       						"unknown";

     

       484
       484
       +
       					clearRateLimit("login", email, ipAddress);

     

       485
       485
       +
       

     

       486
       486
       +
       					// Check if email is verified

     

       487
       487
       +
       					if (!isEmailVerified(user.id)) {

     

       488
       488
       +
       						let codeSentAt = getVerificationCodeSentAt(user.id);

     

       489
       489
       +
       

     

       490
       490
       +
       						// If no verification code exists, auto-send one

     

       491
       491
       +
       						if (!codeSentAt) {

     

       492
       492
       +
       							const { code, token, sentAt } = createEmailVerificationToken(

     

       493
       493
       +
       								user.id,

     

       494
       494
       +
       							);

     

       495
       495
       +
       							codeSentAt = sentAt;

     

       496
       496
       +
       

     

       497
       497
       +
       							try {

     

       498
       498
       +
       								await sendEmail({

     

       499
       499
       +
       									to: user.email,

     

       500
       500
       +
       									subject: "Verify your email - Thistle",

     

       501
       501
       +
       									html: verifyEmailTemplate({

     

       502
       502
       +
       										name: user.name,

     

       503
       503
       +
       										code,

     

       504
       504
       +
       										token,

     

       505
       505
       +
       									}),

     

       506
       506
       +
       								});

     

       507
       507
       +
       							} catch (err) {

     

       508
       508
       +
       								console.error(

     

       509
       509
       +
       									"[Email] Failed to send verification email on login:",

     

       510
       510
       +
       									err,

     

       511
       511
       +
       								);

     

       512
       512
       +
       								// Don't fail login - just return null timestamp so client can try resend

     

       513
       513
       +
       								codeSentAt = null;

     

       514
       514
       +
       							}

     

       515
       515
       +
       						}

     

       516
       516
       +
       

     

       517
       517
       +
       						return Response.json(

     

       518
       518
       +
       							{

     

       519
       519
       +
       								user: { id: user.id, email: user.email },

     

       520
       520
       +
       								email_verification_required: true,

     

       521
       521
       +
       								verification_code_sent_at: codeSentAt,

     

       522
       522
       +
       							},

     

       523
       523
       +
       							{ status: 200 },

     

       524
       524
       +
       						);

     

       525
       525
       +
       					}

     

       526
       526
       +
       

     

       238
       527
        
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       239
       528
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       240
       529
        
       					return Response.json(

     
···

       245
       534
        
       							},

     

       246
       535
        
       						},

     

       247
       536
        
       					);

     

       248
       248
       -
       				} catch {

     

       537
       537
       +
       				} catch (error) {

     

       538
       538
       +
       					console.error("[Auth] Login error:", error);

     

       249
       539
        
       					return Response.json({ error: "Login failed" }, { status: 500 });

     

       250
       540
        
       				}

     

       251
       541
        
       			},

     

       252
       542
        
       		},

     

       543
       543
       +
       		"/api/auth/verify-email": {

     

       544
       544
       +
       			GET: async (req) => {

     

       545
       545
       +
       				try {

     

       546
       546
       +
       					const url = new URL(req.url);

     

       547
       547
       +
       					const token = url.searchParams.get("token");

     

       548
       548
       +
       

     

       549
       549
       +
       					if (!token) {

     

       550
       550
       +
       						return Response.redirect("/", 302);

     

       551
       551
       +
       					}

     

       552
       552
       +
       

     

       553
       553
       +
       					const result = verifyEmailToken(token);

     

       554
       554
       +
       

     

       555
       555
       +
       					if (!result) {

     

       556
       556
       +
       						return Response.redirect("/", 302);

     

       557
       557
       +
       					}

     

       558
       558
       +
       

     

       559
       559
       +
       					// Create session for the verified user

     

       560
       560
       +
       					const ipAddress =

     

       561
       561
       +
       						req.headers.get("x-forwarded-for") ??

     

       562
       562
       +
       						req.headers.get("x-real-ip") ??

     

       563
       563
       +
       						"unknown";

     

       564
       564
       +
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       565
       565
       +
       					const sessionId = createSession(result.userId, ipAddress, userAgent);

     

       566
       566
       +
       

     

       567
       567
       +
       					// Redirect to classes with session cookie

     

       568
       568
       +
       					return new Response(null, {

     

       569
       569
       +
       						status: 302,

     

       570
       570
       +
       						headers: {

     

       571
       571
       +
       							Location: "/classes",

     

       572
       572
       +
       							"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       573
       573
       +
       						},

     

       574
       574
       +
       					});

     

       575
       575
       +
       				} catch (error) {

     

       576
       576
       +
       					console.error("[Email] Verification error:", error);

     

       577
       577
       +
       					return Response.redirect("/", 302);

     

       578
       578
       +
       				}

     

       579
       579
       +
       			},

     

       580
       580
       +
       			POST: async (req) => {

     

       581
       581
       +
       				try {

     

       582
       582
       +
       					const body = await req.json();

     

       583
       583
       +
       					const { email, code } = body;

     

       584
       584
       +
       

     

       585
       585
       +
       					if (!email || !code) {

     

       586
       586
       +
       						return Response.json(

     

       587
       587
       +
       							{ error: "Email and verification code required" },

     

       588
       588
       +
       							{ status: 400 },

     

       589
       589
       +
       						);

     

       590
       590
       +
       					}

     

       591
       591
       +
       

     

       592
       592
       +
       					// Get user by email

     

       593
       593
       +
       					const user = getUserByEmail(email);

     

       594
       594
       +
       					if (!user) {

     

       595
       595
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       596
       596
       +
       					}

     

       597
       597
       +
       

     

       598
       598
       +
       					// Check if already verified

     

       599
       599
       +
       					if (isEmailVerified(user.id)) {

     

       600
       600
       +
       						return Response.json(

     

       601
       601
       +
       							{ error: "Email already verified" },

     

       602
       602
       +
       							{ status: 400 },

     

       603
       603
       +
       						);

     

       604
       604
       +
       					}

     

       605
       605
       +
       

     

       606
       606
       +
       					const success = verifyEmailCode(user.id, code);

     

       607
       607
       +
       

     

       608
       608
       +
       					if (!success) {

     

       609
       609
       +
       						return Response.json(

     

       610
       610
       +
       							{ error: "Invalid or expired verification code" },

     

       611
       611
       +
       							{ status: 400 },

     

       612
       612
       +
       						);

     

       613
       613
       +
       					}

     

       614
       614
       +
       

     

       615
       615
       +
       					// Create session after successful verification

     

       616
       616
       +
       					const ipAddress =

     

       617
       617
       +
       						req.headers.get("x-forwarded-for") ??

     

       618
       618
       +
       						req.headers.get("x-real-ip") ??

     

       619
       619
       +
       						"unknown";

     

       620
       620
       +
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       621
       621
       +
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       622
       622
       +
       

     

       623
       623
       +
       					return Response.json(

     

       624
       624
       +
       						{

     

       625
       625
       +
       							success: true,

     

       626
       626
       +
       							message: "Email verified successfully",

     

       627
       627
       +
       							email_verified: true,

     

       628
       628
       +
       							user: { id: user.id, email: user.email },

     

       629
       629
       +
       						},

     

       630
       630
       +
       						{

     

       631
       631
       +
       							headers: {

     

       632
       632
       +
       								"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       633
       633
       +
       							},

     

       634
       634
       +
       						},

     

       635
       635
       +
       					);

     

       636
       636
       +
       				} catch (error) {

     

       637
       637
       +
       					return handleError(error);

     

       638
       638
       +
       				}

     

       639
       639
       +
       			},

     

       640
       640
       +
       		},

     

       641
       641
       +
       		"/api/auth/resend-verification": {

     

       642
       642
       +
       			POST: async (req) => {

     

       643
       643
       +
       				try {

     

       644
       644
       +
       					const user = requireAuth(req);

     

       645
       645
       +
       

     

       646
       646
       +
       					// Rate limiting

     

       647
       647
       +
       					const rateLimitError = enforceRateLimit(req, "resend-verification", {

     

       648
       648
       +
       						account: { max: 3, windowSeconds: 60 * 60, email: user.email },

     

       649
       649
       +
       					});

     

       650
       650
       +
       					if (rateLimitError) return rateLimitError;

     

       651
       651
       +
       

     

       652
       652
       +
       					// Check if already verified

     

       653
       653
       +
       					if (isEmailVerified(user.id)) {

     

       654
       654
       +
       						return Response.json(

     

       655
       655
       +
       							{ error: "Email already verified" },

     

       656
       656
       +
       							{ status: 400 },

     

       657
       657
       +
       						);

     

       658
       658
       +
       					}

     

       659
       659
       +
       

     

       660
       660
       +
       					// Generate new code and send email

     

       661
       661
       +
       					const { code, token } = createEmailVerificationToken(user.id);

     

       662
       662
       +
       

     

       663
       663
       +
       					await sendEmail({

     

       664
       664
       +
       						to: user.email,

     

       665
       665
       +
       						subject: "Verify your email - Thistle",

     

       666
       666
       +
       						html: verifyEmailTemplate({

     

       667
       667
       +
       							name: user.name,

     

       668
       668
       +
       							code,

     

       669
       669
       +
       							token,

     

       670
       670
       +
       						}),

     

       671
       671
       +
       					});

     

       672
       672
       +
       

     

       673
       673
       +
       					return Response.json({

     

       674
       674
       +
       						success: true,

     

       675
       675
       +
       						message: "Verification email sent",

     

       676
       676
       +
       					});

     

       677
       677
       +
       				} catch (error) {

     

       678
       678
       +
       					return handleError(error);

     

       679
       679
       +
       				}

     

       680
       680
       +
       			},

     

       681
       681
       +
       		},

     

       682
       682
       +
       		"/api/auth/resend-verification-code": {

     

       683
       683
       +
       			POST: async (req) => {

     

       684
       684
       +
       				try {

     

       685
       685
       +
       					const body = await req.json();

     

       686
       686
       +
       					const { email } = body;

     

       687
       687
       +
       

     

       688
       688
       +
       					if (!email) {

     

       689
       689
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       690
       690
       +
       					}

     

       691
       691
       +
       

     

       692
       692
       +
       					// Rate limiting by email

     

       693
       693
       +
       					const rateLimitError = enforceRateLimit(

     

       694
       694
       +
       						req,

     

       695
       695
       +
       						"resend-verification-code",

     

       696
       696
       +
       						{

     

       697
       697
       +
       							account: { max: 3, windowSeconds: 5 * 60, email },

     

       698
       698
       +
       						},

     

       699
       699
       +
       					);

     

       700
       700
       +
       					if (rateLimitError) return rateLimitError;

     

       701
       701
       +
       

     

       702
       702
       +
       					// Get user by email

     

       703
       703
       +
       					const user = getUserByEmail(email);

     

       704
       704
       +
       					if (!user) {

     

       705
       705
       +
       						// Don't reveal if user exists

     

       706
       706
       +
       						return Response.json({

     

       707
       707
       +
       							success: true,

     

       708
       708
       +
       							message:

     

       709
       709
       +
       								"If an account exists with that email, a verification code has been sent",

     

       710
       710
       +
       						});

     

       711
       711
       +
       					}

     

       712
       712
       +
       

     

       713
       713
       +
       					// Check if already verified

     

       714
       714
       +
       					if (isEmailVerified(user.id)) {

     

       715
       715
       +
       						return Response.json(

     

       716
       716
       +
       							{ error: "Email already verified" },

     

       717
       717
       +
       							{ status: 400 },

     

       718
       718
       +
       						);

     

       719
       719
       +
       					}

     

       720
       720
       +
       

     

       721
       721
       +
       					// Generate new code and send email

     

       722
       722
       +
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       723
       723
       +
       

     

       724
       724
       +
       					await sendEmail({

     

       725
       725
       +
       						to: user.email,

     

       726
       726
       +
       						subject: "Verify your email - Thistle",

     

       727
       727
       +
       						html: verifyEmailTemplate({

     

       728
       728
       +
       							name: user.name,

     

       729
       729
       +
       							code,

     

       730
       730
       +
       							token,

     

       731
       731
       +
       						}),

     

       732
       732
       +
       					});

     

       733
       733
       +
       

     

       734
       734
       +
       					return Response.json({

     

       735
       735
       +
       						success: true,

     

       736
       736
       +
       						message: "Verification code sent",

     

       737
       737
       +
       						verification_code_sent_at: sentAt,

     

       738
       738
       +
       					});

     

       739
       739
       +
       				} catch (error) {

     

       740
       740
       +
       					return handleError(error);

     

       741
       741
       +
       				}

     

       742
       742
       +
       			},

     

       743
       743
       +
       		},

     

       744
       744
       +
       		"/api/auth/forgot-password": {

     

       745
       745
       +
       			POST: async (req) => {

     

       746
       746
       +
       				try {

     

       747
       747
       +
       					// Rate limiting

     

       748
       748
       +
       					const rateLimitError = enforceRateLimit(req, "forgot-password", {

     

       749
       749
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       750
       750
       +
       					});

     

       751
       751
       +
       					if (rateLimitError) return rateLimitError;

     

       752
       752
       +
       

     

       753
       753
       +
       					const body = await req.json();

     

       754
       754
       +
       					const { email } = body;

     

       755
       755
       +
       

     

       756
       756
       +
       					if (!email) {

     

       757
       757
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       758
       758
       +
       					}

     

       759
       759
       +
       

     

       760
       760
       +
       					// Always return success to prevent email enumeration

     

       761
       761
       +
       					const user = getUserByEmail(email);

     

       762
       762
       +
       					if (user) {

     

       763
       763
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       764
       764
       +
       						const resetToken = createPasswordResetToken(user.id);

     

       765
       765
       +
       						const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       766
       766
       +
       

     

       767
       767
       +
       						await sendEmail({

     

       768
       768
       +
       							to: user.email,

     

       769
       769
       +
       							subject: "Reset your password - Thistle",

     

       770
       770
       +
       							html: passwordResetTemplate({

     

       771
       771
       +
       								name: user.name,

     

       772
       772
       +
       								resetLink,

     

       773
       773
       +
       							}),

     

       774
       774
       +
       						}).catch((err) => {

     

       775
       775
       +
       							console.error("[Email] Failed to send password reset:", err);

     

       776
       776
       +
       						});

     

       777
       777
       +
       					}

     

       778
       778
       +
       

     

       779
       779
       +
       					return Response.json({

     

       780
       780
       +
       						success: true,

     

       781
       781
       +
       						message:

     

       782
       782
       +
       							"If an account exists with that email, a password reset link has been sent",

     

       783
       783
       +
       					});

     

       784
       784
       +
       				} catch (error) {

     

       785
       785
       +
       					console.error("[Email] Forgot password error:", error);

     

       786
       786
       +
       					return Response.json(

     

       787
       787
       +
       						{ error: "Failed to process request" },

     

       788
       788
       +
       						{ status: 500 },

     

       789
       789
       +
       					);

     

       790
       790
       +
       				}

     

       791
       791
       +
       			},

     

       792
       792
       +
       		},

     

       793
       793
       +
       		"/api/auth/reset-password": {

     

       794
       794
       +
       			GET: async (req) => {

     

       795
       795
       +
       				try {

     

       796
       796
       +
       					const url = new URL(req.url);

     

       797
       797
       +
       					const token = url.searchParams.get("token");

     

       798
       798
       +
       

     

       799
       799
       +
       					if (!token) {

     

       800
       800
       +
       						return Response.json({ error: "Token required" }, { status: 400 });

     

       801
       801
       +
       					}

     

       802
       802
       +
       

     

       803
       803
       +
       					const userId = verifyPasswordResetToken(token);

     

       804
       804
       +
       					if (!userId) {

     

       805
       805
       +
       						return Response.json(

     

       806
       806
       +
       							{ error: "Invalid or expired reset token" },

     

       807
       807
       +
       							{ status: 400 },

     

       808
       808
       +
       						);

     

       809
       809
       +
       					}

     

       810
       810
       +
       

     

       811
       811
       +
       					// Get user's email for client-side password hashing

     

       812
       812
       +
       					const user = db

     

       813
       813
       +
       						.query<{ email: string }, [number]>(

     

       814
       814
       +
       							"SELECT email FROM users WHERE id = ?",

     

       815
       815
       +
       						)

     

       816
       816
       +
       						.get(userId);

     

       817
       817
       +
       

     

       818
       818
       +
       					if (!user) {

     

       819
       819
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       820
       820
       +
       					}

     

       821
       821
       +
       

     

       822
       822
       +
       					return Response.json({ email: user.email });

     

       823
       823
       +
       				} catch (error) {

     

       824
       824
       +
       					console.error("[Email] Get reset token info error:", error);

     

       825
       825
       +
       					return Response.json(

     

       826
       826
       +
       						{ error: "Failed to verify token" },

     

       827
       827
       +
       						{ status: 500 },

     

       828
       828
       +
       					);

     

       829
       829
       +
       				}

     

       830
       830
       +
       			},

     

       831
       831
       +
       			POST: async (req) => {

     

       832
       832
       +
       				try {

     

       833
       833
       +
       					const body = await req.json();

     

       834
       834
       +
       					const { token, password } = body;

     

       835
       835
       +
       

     

       836
       836
       +
       					if (!token || !password) {

     

       837
       837
       +
       						return Response.json(

     

       838
       838
       +
       							{ error: "Token and password required" },

     

       839
       839
       +
       							{ status: 400 },

     

       840
       840
       +
       						);

     

       841
       841
       +
       					}

     

       842
       842
       +
       

     

       843
       843
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       844
       844
       +
       					const passwordValidation = validatePasswordHash(password);

     

       845
       845
       +
       					if (!passwordValidation.valid) {

     

       846
       846
       +
       						return Response.json(

     

       847
       847
       +
       							{ error: passwordValidation.error },

     

       848
       848
       +
       							{ status: 400 },

     

       849
       849
       +
       						);

     

       850
       850
       +
       					}

     

       851
       851
       +
       

     

       852
       852
       +
       					const userId = verifyPasswordResetToken(token);

     

       853
       853
       +
       					if (!userId) {

     

       854
       854
       +
       						return Response.json(

     

       855
       855
       +
       							{ error: "Invalid or expired reset token" },

     

       856
       856
       +
       							{ status: 400 },

     

       857
       857
       +
       						);

     

       858
       858
       +
       					}

     

       859
       859
       +
       

     

       860
       860
       +
       					// Update password and consume token

     

       861
       861
       +
       					await updateUserPassword(userId, password);

     

       862
       862
       +
       					consumePasswordResetToken(token);

     

       863
       863
       +
       

     

       864
       864
       +
       					return Response.json({

     

       865
       865
       +
       						success: true,

     

       866
       866
       +
       						message: "Password reset successfully",

     

       867
       867
       +
       					});

     

       868
       868
       +
       				} catch (error) {

     

       869
       869
       +
       					console.error("[Email] Reset password error:", error);

     

       870
       870
       +
       					return Response.json(

     

       871
       871
       +
       						{ error: "Failed to reset password" },

     

       872
       872
       +
       						{ status: 500 },

     

       873
       873
       +
       					);

     

       874
       874
       +
       				}

     

       875
       875
       +
       			},

     

       876
       876
       +
       		},

     

       253
       877
        
       		"/api/auth/logout": {

     

       254
       878
        
       			POST: async (req) => {

     

       255
       879
        
       				const sessionId = getSessionFromRequest(req);

     
···

       269
       893
        
       		},

     

       270
       894
        
       		"/api/auth/me": {

     

       271
       895
        
       			GET: (req) => {

     

       272
       272
       -
       				const sessionId = getSessionFromRequest(req);

     

       273
       273
       -
       				if (!sessionId) {

     

       274
       274
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       275
       275
       -
       				}

     

       276
       276
       -
       				const user = getUserBySession(sessionId);

     

       277
       277
       -
       				if (!user) {

     

       278
       278
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       279
       279
       -
       				}

     

       896
       896
       +
       				try {

     

       897
       897
       +
       					const user = requireAuth(req);

     

       898
       898
       +
       

     

       899
       899
       +
       					// Check subscription status

     

       900
       900
       +
       					const subscription = db

     

       901
       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       903
       +
       						)

     

       904
       904
       +
       						.get(user.id);

     

       280
       905
        
       

     

       281
       281
       -
       				// Check subscription status

     

       282
       282
       -
       				const subscription = db

     

       283
       283
       -
       					.query<{ status: string }, [number]>(

     

       284
       284
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       285
       285
       -
       					)

     

       286
       286
       -
       					.get(user.id);

     

       906
       906
       +
       					// Get notification preferences

     

       907
       907
       +
       					const prefs = db

     

       908
       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       910
       +
       						)

     

       911
       911
       +
       						.get(user.id);

     

       287
       912
        
       

     

       288
       288
       -
       				return Response.json({

     

       289
       289
       -
       					email: user.email,

     

       290
       290
       -
       					name: user.name,

     

       291
       291
       -
       					avatar: user.avatar,

     

       292
       292
       -
       					created_at: user.created_at,

     

       293
       293
       -
       					role: user.role,

     

       294
       294
       -
       					has_subscription: !!subscription,

     

       295
       295
       -
       				});

     

       913
       913
       +
       					return Response.json({

     

       914
       914
       +
       						email: user.email,

     

       915
       915
       +
       						name: user.name,

     

       916
       916
       +
       						avatar: user.avatar,

     

       917
       917
       +
       						created_at: user.created_at,

     

       918
       918
       +
       						role: user.role,

     

       919
       919
       +
       						has_subscription: !!subscription,

     

       920
       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       921
       +
       						email_notifications_enabled:

     

       922
       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       923
       +
       					});

     

       924
       924
       +
       				} catch (err) {

     

       925
       925
       +
       					return handleError(err);

     

       926
       926
       +
       				}

     

       296
       927
        
       			},

     

       297
       928
        
       		},

     

       298
       929
        
       		"/api/passkeys/register/options": {

     

       299
       930
        
       			POST: async (req) => {

     

       300
       931
        
       				try {

     

       301
       932
        
       					const user = requireAuth(req);

     

       933
       933
       +
       

     

       934
       934
       +
       					const rateLimitError = enforceRateLimit(

     

       935
       935
       +
       						req,

     

       936
       936
       +
       						"passkey-register-options",

     

       937
       937
       +
       						{

     

       938
       938
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       939
       939
       +
       						},

     

       940
       940
       +
       					);

     

       941
       941
       +
       					if (rateLimitError) return rateLimitError;

     

       942
       942
       +
       

     

       302
       943
        
       					const options = await createRegistrationOptions(user);

     

       303
       944
        
       					return Response.json(options);

     

       304
       945
        
       				} catch (err) {

     
···

       310
       951
        
       			POST: async (req) => {

     

       311
       952
        
       				try {

     

       312
       953
        
       					const _user = requireAuth(req);

     

       954
       954
       +
       

     

       955
       955
       +
       					const rateLimitError = enforceRateLimit(

     

       956
       956
       +
       						req,

     

       957
       957
       +
       						"passkey-register-verify",

     

       958
       958
       +
       						{

     

       959
       959
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       960
       960
       +
       						},

     

       961
       961
       +
       					);

     

       962
       962
       +
       					if (rateLimitError) return rateLimitError;

     

       963
       963
       +
       

     

       313
       964
        
       					const body = await req.json();

     

       314
       965
        
       					const { response: credentialResponse, challenge, name } = body;

     

       315
       966
        
       

     
···

       335
       986
        
       		"/api/passkeys/authenticate/options": {

     

       336
       987
        
       			POST: async (req) => {

     

       337
       988
        
       				try {

     

       989
       989
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-options", {

     

       990
       990
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       991
       991
       +
       					});

     

       992
       992
       +
       					if (rateLimitError) return rateLimitError;

     

       993
       993
       +
       

     

       338
       994
        
       					const body = await req.json();

     

       339
       995
        
       					const { email } = body;

     

       340
       996
        
       

     
···

       348
       1004
        
       		"/api/passkeys/authenticate/verify": {

     

       349
       1005
        
       			POST: async (req) => {

     

       350
       1006
        
       				try {

     

       1007
       1007
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-verify", {

     

       1008
       1008
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1009
       1009
       +
       					});

     

       1010
       1010
       +
       					if (rateLimitError) return rateLimitError;

     

       1011
       1011
       +
       

     

       351
       1012
        
       					const body = await req.json();

     

       352
       1013
        
       					const { response: credentialResponse, challenge } = body;

     

       353
       1014
        
       

     
···

       413
       1074
        
       			PUT: async (req) => {

     

       414
       1075
        
       				try {

     

       415
       1076
        
       					const user = requireAuth(req);

     

       1077
       1077
       +
       

     

       1078
       1078
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-update", {

     

       1079
       1079
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1080
       1080
       +
       					});

     

       1081
       1081
       +
       					if (rateLimitError) return rateLimitError;

     

       1082
       1082
       +
       

     

       416
       1083
        
       					const body = await req.json();

     

       417
       1084
        
       					const { name } = body;

     

       418
       1085
        
       					const passkeyId = req.params.id;

     
···

       422
       1089
        
       					}

     

       423
       1090
        
       

     

       424
       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       425
       425
       -
       					return Response.json({ success: true });

     

       1092
       1092
       +
       					return new Response(null, { status: 204 });

     

       426
       1093
        
       				} catch (err) {

     

       427
       1094
        
       					return handleError(err);

     

       428
       1095
        
       				}

     
···

       430
       1097
        
       			DELETE: async (req) => {

     

       431
       1098
        
       				try {

     

       432
       1099
        
       					const user = requireAuth(req);

     

       1100
       1100
       +
       

     

       1101
       1101
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-delete", {

     

       1102
       1102
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1103
       1103
       +
       					});

     

       1104
       1104
       +
       					if (rateLimitError) return rateLimitError;

     

       1105
       1105
       +
       

     

       433
       1106
        
       					const passkeyId = req.params.id;

     

       434
       1107
        
       					deletePasskey(passkeyId, user.id);

     

       435
       435
       -
       					return Response.json({ success: true });

     

       1108
       1108
       +
       					return new Response(null, { status: 204 });

     

       436
       1109
        
       				} catch (err) {

     

       437
       1110
        
       					return handleError(err);

     

       438
       1111
        
       				}

     
···

       440
       1113
        
       		},

     

       441
       1114
        
       		"/api/sessions": {

     

       442
       1115
        
       			GET: (req) => {

     

       443
       443
       -
       				const sessionId = getSessionFromRequest(req);

     

       444
       444
       -
       				if (!sessionId) {

     

       445
       445
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       446
       446
       -
       				}

     

       447
       447
       -
       				const user = getUserBySession(sessionId);

     

       448
       448
       -
       				if (!user) {

     

       449
       449
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1116
       1116
       +
       				try {

     

       1117
       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       1118
       +
       					if (!sessionId) {

     

       1119
       1119
       +
       						return Response.json(

     

       1120
       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       1121
       +
       							{ status: 401 },

     

       1122
       1122
       +
       						);

     

       1123
       1123
       +
       					}

     

       1124
       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       1125
       +
       					if (!user) {

     

       1126
       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       1127
       +
       					}

     

       1128
       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       1129
       +
       					return Response.json({

     

       1130
       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       1131
       +
       							id: s.id,

     

       1132
       1132
       +
       							ip_address: s.ip_address,

     

       1133
       1133
       +
       							user_agent: s.user_agent,

     

       1134
       1134
       +
       							created_at: s.created_at,

     

       1135
       1135
       +
       							expires_at: s.expires_at,

     

       1136
       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       1137
       +
       						})),

     

       1138
       1138
       +
       					});

     

       1139
       1139
       +
       				} catch (err) {

     

       1140
       1140
       +
       					return handleError(err);

     

       450
       1141
        
       				}

     

       451
       451
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       452
       452
       -
       				return Response.json({

     

       453
       453
       -
       					sessions: sessions.map((s) => ({

     

       454
       454
       -
       						id: s.id,

     

       455
       455
       -
       						ip_address: s.ip_address,

     

       456
       456
       -
       						user_agent: s.user_agent,

     

       457
       457
       -
       						created_at: s.created_at,

     

       458
       458
       -
       						expires_at: s.expires_at,

     

       459
       459
       -
       						is_current: s.id === sessionId,

     

       460
       460
       -
       					})),

     

       461
       461
       -
       				});

     

       462
       1142
        
       			},

     

       463
       1143
        
       			DELETE: async (req) => {

     

       464
       464
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       465
       465
       -
       				if (!currentSessionId) {

     

       466
       466
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       467
       467
       -
       				}

     

       468
       468
       -
       				const user = getUserBySession(currentSessionId);

     

       469
       469
       -
       				if (!user) {

     

       470
       470
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       471
       471
       -
       				}

     

       472
       472
       -
       				const body = await req.json();

     

       473
       473
       -
       				const targetSessionId = body.sessionId;

     

       474
       474
       -
       				if (!targetSessionId) {

     

       475
       475
       -
       					return Response.json(

     

       476
       476
       -
       						{ error: "Session ID required" },

     

       477
       477
       -
       						{ status: 400 },

     

       478
       478
       -
       					);

     

       479
       479
       -
       				}

     

       480
       480
       -
       				// Prevent deleting current session

     

       481
       481
       -
       				if (targetSessionId === currentSessionId) {

     

       482
       482
       -
       					return Response.json(

     

       483
       483
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       484
       484
       -
       						{ status: 400 },

     

       485
       485
       -
       					);

     

       486
       486
       -
       				}

     

       487
       487
       -
       				// Verify the session belongs to the user

     

       488
       488
       -
       				const targetSession = getSession(targetSessionId);

     

       489
       489
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       490
       490
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       1144
       1144
       +
       				try {

     

       1145
       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       1146
       +
       					if (!currentSessionId) {

     

       1147
       1147
       +
       						return Response.json(

     

       1148
       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       1149
       +
       							{ status: 401 },

     

       1150
       1150
       +
       						);

     

       1151
       1151
       +
       					}

     

       1152
       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       1153
       +
       					if (!user) {

     

       1154
       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       1155
       +
       					}

     

       1156
       1156
       +
       

     

       1157
       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       1159
       +
       					});

     

       1160
       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1161
       1161
       +
       

     

       1162
       1162
       +
       					const body = await req.json();

     

       1163
       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       1164
       +
       					if (!targetSessionId) {

     

       1165
       1165
       +
       						return Response.json(

     

       1166
       1166
       +
       							{ error: "Session ID required" },

     

       1167
       1167
       +
       							{ status: 400 },

     

       1168
       1168
       +
       						);

     

       1169
       1169
       +
       					}

     

       1170
       1170
       +
       					// Prevent deleting current session

     

       1171
       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       1172
       +
       						return Response.json(

     

       1173
       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       1174
       +
       							{ status: 400 },

     

       1175
       1175
       +
       						);

     

       1176
       1176
       +
       					}

     

       1177
       1177
       +
       					// Verify the session belongs to the user

     

       1178
       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       1181
       +
       					}

     

       1182
       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       1184
       +
       				} catch (err) {

     

       1185
       1185
       +
       					return handleError(err);

     

       491
       1186
        
       				}

     

       492
       492
       -
       				deleteSession(targetSessionId);

     

       493
       493
       -
       				return Response.json({ success: true });

     

       494
       1187
        
       			},

     

       495
       1188
        
       		},

     

       496
       1189
        
       		"/api/user": {

     

       497
       1190
        
       			DELETE: async (req) => {

     

       498
       498
       -
       				const sessionId = getSessionFromRequest(req);

     

       499
       499
       -
       				if (!sessionId) {

     

       500
       500
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       501
       501
       -
       				}

     

       502
       502
       -
       				const user = getUserBySession(sessionId);

     

       503
       503
       -
       				if (!user) {

     

       504
       504
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       505
       505
       -
       				}

     

       1191
       1191
       +
       				try {

     

       1192
       1192
       +
       					const user = requireAuth(req);

     

       506
       1193
        
       

     

       507
       507
       -
       				// Rate limiting

     

       508
       508
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       509
       509
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       510
       510
       -
       				});

     

       511
       511
       -
       				if (rateLimitError) return rateLimitError;

     

       1194
       1194
       +
       					// Rate limiting

     

       1195
       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       1197
       +
       					});

     

       1198
       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       512
       1199
        
       

     

       513
       513
       -
       				await deleteUser(user.id);

     

       514
       514
       -
       				return Response.json(

     

       515
       515
       -
       					{ success: true },

     

       516
       516
       -
       					{

     

       1200
       1200
       +
       					await deleteUser(user.id);

     

       1201
       1201
       +
       					return new Response(null, {

     

       1202
       1202
       +
       						status: 204,

     

       517
       1203
        
       						headers: {

     

       518
       1204
        
       							"Set-Cookie":

     

       519
       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       520
       1206
        
       						},

     

       521
       521
       -
       					},

     

       522
       522
       -
       				);

     

       1207
       1207
       +
       					});

     

       1208
       1208
       +
       				} catch (err) {

     

       1209
       1209
       +
       					return handleError(err);

     

       1210
       1210
       +
       				}

     

       523
       1211
        
       			},

     

       524
       1212
        
       		},

     

       525
       1213
        
       		"/api/user/email": {

     

       526
       1214
        
       			PUT: async (req) => {

     

       527
       527
       -
       				const sessionId = getSessionFromRequest(req);

     

       528
       528
       -
       				if (!sessionId) {

     

       529
       529
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       530
       530
       -
       				}

     

       531
       531
       -
       				const user = getUserBySession(sessionId);

     

       532
       532
       -
       				if (!user) {

     

       533
       533
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       534
       534
       -
       				}

     

       1215
       1215
       +
       				try {

     

       1216
       1216
       +
       					const user = requireAuth(req);

     

       1217
       1217
       +
       

     

       1218
       1218
       +
       					// Rate limiting

     

       1219
       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       1221
       +
       					});

     

       1222
       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       535
       1223
        
       

     

       536
       536
       -
       				// Rate limiting

     

       537
       537
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       538
       538
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       539
       539
       -
       				});

     

       540
       540
       -
       				if (rateLimitError) return rateLimitError;

     

       1224
       1224
       +
       					const body = await req.json();

     

       1225
       1225
       +
       					const { email } = body;

     

       1226
       1226
       +
       					if (!email) {

     

       1227
       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       1228
       +
       					}

     

       541
       1229
        
       

     

       542
       542
       -
       				const body = await req.json();

     

       543
       543
       -
       				const { email } = body;

     

       544
       544
       -
       				if (!email) {

     

       545
       545
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1230
       1230
       +
       					// Check if email is already in use

     

       1231
       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       1232
       +
       					if (existingUser) {

     

       1233
       1233
       +
       						return Response.json(

     

       1234
       1234
       +
       							{ error: "Email already in use" },

     

       1235
       1235
       +
       							{ status: 409 },

     

       1236
       1236
       +
       						);

     

       1237
       1237
       +
       					}

     

       1238
       1238
       +
       

     

       1239
       1239
       +
       					try {

     

       1240
       1240
       +
       						// Create email change token

     

       1241
       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1242
       1242
       +
       

     

       1243
       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1246
       1246
       +
       

     

       1247
       1247
       +
       						await sendEmail({

     

       1248
       1248
       +
       							to: user.email,

     

       1249
       1249
       +
       							subject: "Verify your email change",

     

       1250
       1250
       +
       							html: emailChangeTemplate({

     

       1251
       1251
       +
       								name: user.name,

     

       1252
       1252
       +
       								currentEmail: user.email,

     

       1253
       1253
       +
       								newEmail: email,

     

       1254
       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       1255
       +
       							}),

     

       1256
       1256
       +
       						});

     

       1257
       1257
       +
       

     

       1258
       1258
       +
       						return Response.json({

     

       1259
       1259
       +
       							success: true,

     

       1260
       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       1261
       +
       							pendingEmail: email,

     

       1262
       1262
       +
       						});

     

       1263
       1263
       +
       					} catch (error) {

     

       1264
       1264
       +
       						console.error(

     

       1265
       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       1266
       +
       							error,

     

       1267
       1267
       +
       						);

     

       1268
       1268
       +
       						return Response.json(

     

       1269
       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       1270
       +
       							{ status: 500 },

     

       1271
       1271
       +
       						);

     

       1272
       1272
       +
       					}

     

       1273
       1273
       +
       				} catch (err) {

     

       1274
       1274
       +
       					return handleError(err);

     

       546
       1275
        
       				}

     

       1276
       1276
       +
       			},

     

       1277
       1277
       +
       		},

     

       1278
       1278
       +
       		"/api/user/email/verify": {

     

       1279
       1279
       +
       			GET: async (req) => {

     

       547
       1280
        
       				try {

     

       548
       548
       -
       					updateUserEmail(user.id, email);

     

       549
       549
       -
       					return Response.json({ success: true });

     

       550
       550
       -
       				} catch (err: unknown) {

     

       551
       551
       -
       					const error = err as { message?: string };

     

       552
       552
       -
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       553
       553
       -
       						return Response.json(

     

       554
       554
       -
       							{ error: "Email already in use" },

     

       555
       555
       -
       							{ status: 400 },

     

       1281
       1281
       +
       					const url = new URL(req.url);

     

       1282
       1282
       +
       					const token = url.searchParams.get("token");

     

       1283
       1283
       +
       

     

       1284
       1284
       +
       					if (!token) {

     

       1285
       1285
       +
       						return Response.redirect(

     

       1286
       1286
       +
       							"/settings?tab=account&error=invalid-token",

     

       1287
       1287
       +
       							302,

     

       1288
       1288
       +
       						);

     

       1289
       1289
       +
       					}

     

       1290
       1290
       +
       

     

       1291
       1291
       +
       					const result = verifyEmailChangeToken(token);

     

       1292
       1292
       +
       

     

       1293
       1293
       +
       					if (!result) {

     

       1294
       1294
       +
       						return Response.redirect(

     

       1295
       1295
       +
       							"/settings?tab=account&error=expired-token",

     

       1296
       1296
       +
       							302,

     

       556
       1297
        
       						);

     

       557
       1298
        
       					}

     

       558
       558
       -
       					return Response.json(

     

       559
       559
       -
       						{ error: "Failed to update email" },

     

       560
       560
       -
       						{ status: 500 },

     

       1299
       1299
       +
       

     

       1300
       1300
       +
       					// Update the user's email

     

       1301
       1301
       +
       					updateUserEmail(result.userId, result.newEmail);

     

       1302
       1302
       +
       

     

       1303
       1303
       +
       					// Consume the token

     

       1304
       1304
       +
       					consumeEmailChangeToken(token);

     

       1305
       1305
       +
       

     

       1306
       1306
       +
       					// Redirect to settings with success message

     

       1307
       1307
       +
       					return Response.redirect(

     

       1308
       1308
       +
       						"/settings?tab=account&success=email-changed",

     

       1309
       1309
       +
       						302,

     

       1310
       1310
       +
       					);

     

       1311
       1311
       +
       				} catch (error) {

     

       1312
       1312
       +
       					console.error("[Email] Email change verification error:", error);

     

       1313
       1313
       +
       					return Response.redirect(

     

       1314
       1314
       +
       						"/settings?tab=account&error=verification-failed",

     

       1315
       1315
       +
       						302,

     

       561
       1316
        
       					);

     

       562
       1317
        
       				}

     

       563
       1318
        
       			},

     

       564
       1319
        
       		},

     

       565
       1320
        
       		"/api/user/password": {

     

       566
       1321
        
       			PUT: async (req) => {

     

       567
       567
       -
       				const sessionId = getSessionFromRequest(req);

     

       568
       568
       -
       				if (!sessionId) {

     

       569
       569
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       570
       570
       -
       				}

     

       571
       571
       -
       				const user = getUserBySession(sessionId);

     

       572
       572
       -
       				if (!user) {

     

       573
       573
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       574
       574
       -
       				}

     

       1322
       1322
       +
       				try {

     

       1323
       1323
       +
       					const user = requireAuth(req);

     

       575
       1324
        
       

     

       576
       576
       -
       				// Rate limiting

     

       577
       577
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       578
       578
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       579
       579
       -
       				});

     

       580
       580
       -
       				if (rateLimitError) return rateLimitError;

     

       1325
       1325
       +
       					// Rate limiting

     

       1326
       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       1328
       +
       					});

     

       1329
       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       581
       1330
        
       

     

       582
       582
       -
       				const body = await req.json();

     

       583
       583
       -
       				const { password } = body;

     

       584
       584
       -
       				if (!password) {

     

       585
       585
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       586
       586
       -
       				}

     

       587
       587
       -
       				// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       588
       588
       -
       				if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       589
       589
       -
       					return Response.json(

     

       590
       590
       -
       						{ error: "Invalid password format" },

     

       591
       591
       -
       						{ status: 400 },

     

       592
       592
       -
       					);

     

       593
       593
       -
       				}

     

       594
       594
       -
       				try {

     

       595
       595
       -
       					await updateUserPassword(user.id, password);

     

       596
       596
       -
       					return Response.json({ success: true });

     

       597
       597
       -
       				} catch {

     

       598
       598
       -
       					return Response.json(

     

       599
       599
       -
       						{ error: "Failed to update password" },

     

       600
       600
       -
       						{ status: 500 },

     

       601
       601
       -
       					);

     

       1331
       1331
       +
       					const body = await req.json();

     

       1332
       1332
       +
       					const { password } = body;

     

       1333
       1333
       +
       					if (!password) {

     

       1334
       1334
       +
       						return Response.json(

     

       1335
       1335
       +
       							{ error: "Password required" },

     

       1336
       1336
       +
       							{ status: 400 },

     

       1337
       1337
       +
       						);

     

       1338
       1338
       +
       					}

     

       1339
       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       1342
       +
       						return Response.json(

     

       1343
       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       1344
       +
       							{ status: 400 },

     

       1345
       1345
       +
       						);

     

       1346
       1346
       +
       					}

     

       1347
       1347
       +
       					try {

     

       1348
       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       1349
       +
       						return Response.json({ success: true });

     

       1350
       1350
       +
       					} catch {

     

       1351
       1351
       +
       						return Response.json(

     

       1352
       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       1353
       +
       							{ status: 500 },

     

       1354
       1354
       +
       						);

     

       1355
       1355
       +
       					}

     

       1356
       1356
       +
       				} catch (err) {

     

       1357
       1357
       +
       					return handleError(err);

     

       602
       1358
        
       				}

     

       603
       1359
        
       			},

     

       604
       1360
        
       		},

     

       605
       1361
        
       		"/api/user/name": {

     

       606
       1362
        
       			PUT: async (req) => {

     

       607
       607
       -
       				const sessionId = getSessionFromRequest(req);

     

       608
       608
       -
       				if (!sessionId) {

     

       609
       609
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       610
       610
       -
       				}

     

       611
       611
       -
       				const user = getUserBySession(sessionId);

     

       612
       612
       -
       				if (!user) {

     

       613
       613
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       614
       614
       -
       				}

     

       615
       615
       -
       				const body = await req.json();

     

       616
       616
       -
       				const { name } = body;

     

       617
       617
       -
       				if (!name) {

     

       618
       618
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       619
       619
       -
       				}

     

       620
       1363
        
       				try {

     

       621
       621
       -
       					updateUserName(user.id, name);

     

       622
       622
       -
       					return Response.json({ success: true });

     

       623
       623
       -
       				} catch {

     

       624
       624
       -
       					return Response.json(

     

       625
       625
       -
       						{ error: "Failed to update name" },

     

       626
       626
       -
       						{ status: 500 },

     

       627
       627
       -
       					);

     

       1364
       1364
       +
       					const user = requireAuth(req);

     

       1365
       1365
       +
       

     

       1366
       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       1368
       +
       					});

     

       1369
       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1370
       1370
       +
       

     

       1371
       1371
       +
       					const body = await req.json();

     

       1372
       1372
       +
       					const { name } = body;

     

       1373
       1373
       +
       					if (!name) {

     

       1374
       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       1375
       +
       					}

     

       1376
       1376
       +
       					try {

     

       1377
       1377
       +
       						updateUserName(user.id, name);

     

       1378
       1378
       +
       						return Response.json({ success: true });

     

       1379
       1379
       +
       					} catch {

     

       1380
       1380
       +
       						return Response.json(

     

       1381
       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       1382
       +
       							{ status: 500 },

     

       1383
       1383
       +
       						);

     

       1384
       1384
       +
       					}

     

       1385
       1385
       +
       				} catch (err) {

     

       1386
       1386
       +
       					return handleError(err);

     

       628
       1387
        
       				}

     

       629
       1388
        
       			},

     

       630
       1389
        
       		},

     

       631
       1390
        
       		"/api/user/avatar": {

     

       632
       1391
        
       			PUT: async (req) => {

     

       633
       633
       -
       				const sessionId = getSessionFromRequest(req);

     

       634
       634
       -
       				if (!sessionId) {

     

       635
       635
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       636
       636
       -
       				}

     

       637
       637
       -
       				const user = getUserBySession(sessionId);

     

       638
       638
       -
       				if (!user) {

     

       639
       639
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       640
       640
       -
       				}

     

       641
       641
       -
       				const body = await req.json();

     

       642
       642
       -
       				const { avatar } = body;

     

       643
       643
       -
       				if (!avatar) {

     

       644
       644
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       645
       645
       -
       				}

     

       646
       1392
        
       				try {

     

       647
       647
       -
       					updateUserAvatar(user.id, avatar);

     

       648
       648
       -
       					return Response.json({ success: true });

     

       649
       649
       -
       				} catch {

     

       650
       650
       -
       					return Response.json(

     

       651
       651
       -
       						{ error: "Failed to update avatar" },

     

       652
       652
       -
       						{ status: 500 },

     

       653
       653
       -
       					);

     

       1393
       1393
       +
       					const user = requireAuth(req);

     

       1394
       1394
       +
       

     

       1395
       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       1397
       +
       					});

     

       1398
       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1399
       1399
       +
       

     

       1400
       1400
       +
       					const body = await req.json();

     

       1401
       1401
       +
       					const { avatar } = body;

     

       1402
       1402
       +
       					if (!avatar) {

     

       1403
       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       1404
       +
       					}

     

       1405
       1405
       +
       					try {

     

       1406
       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       1407
       +
       						return Response.json({ success: true });

     

       1408
       1408
       +
       					} catch {

     

       1409
       1409
       +
       						return Response.json(

     

       1410
       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       1411
       +
       							{ status: 500 },

     

       1412
       1412
       +
       						);

     

       1413
       1413
       +
       					}

     

       1414
       1414
       +
       				} catch (err) {

     

       1415
       1415
       +
       					return handleError(err);

     

       654
       1416
        
       				}

     

       655
       1417
        
       			},

     

       656
       1418
        
       		},

     

       657
       657
       -
       		"/api/billing/checkout": {

     

       658
       658
       -
       			POST: async (req) => {

     

       659
       659
       -
       				const sessionId = getSessionFromRequest(req);

     

       660
       660
       -
       				if (!sessionId) {

     

       661
       661
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       662
       662
       -
       				}

     

       663
       663
       -
       				const user = getUserBySession(sessionId);

     

       664
       664
       -
       				if (!user) {

     

       665
       665
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       666
       666
       -
       				}

     

       1419
       1419
       +
       		"/api/user/notifications": {

     

       1420
       1420
       +
       			PUT: async (req) => {

     

       1421
       1421
       +
       				try {

     

       1422
       1422
       +
       					const user = requireAuth(req);

     

       667
       1423
        
       

     

       668
       668
       -
       				try {

     

       669
       669
       -
       					const { polar } = await import("./lib/polar");

     

       1424
       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       1426
       +
       					});

     

       1427
       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       670
       1428
        
       

     

       671
       671
       -
       					const productId = process.env.POLAR_PRODUCT_ID;

     

       672
       672
       -
       					if (!productId) {

     

       1429
       1429
       +
       					const body = await req.json();

     

       1430
       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       673
       1432
        
       						return Response.json(

     

       674
       674
       -
       							{ error: "Product not configured" },

     

       675
       675
       -
       							{ status: 500 },

     

       1433
       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       1434
       +
       							{ status: 400 },

     

       676
       1435
        
       						);

     

       677
       1436
        
       					}

     

       678
       678
       -
       

     

       679
       679
       -
       					const successUrl = process.env.POLAR_SUCCESS_URL;

     

       680
       680
       -
       					if (!successUrl) {

     

       1437
       1437
       +
       					try {

     

       1438
       1438
       +
       						db.run(

     

       1439
       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       1441
       +
       						);

     

       1442
       1442
       +
       						return Response.json({ success: true });

     

       1443
       1443
       +
       					} catch {

     

       681
       1444
        
       						return Response.json(

     

       682
       682
       -
       							{ error: "Success URL not configured" },

     

       1445
       1445
       +
       							{ error: "Failed to update notification settings" },

     

       683
       1446
        
       							{ status: 500 },

     

       684
       1447
        
       						);

     

       685
       1448
        
       					}

     

       1449
       1449
       +
       				} catch (err) {

     

       1450
       1450
       +
       					return handleError(err);

     

       1451
       1451
       +
       				}

     

       1452
       1452
       +
       			},

     

       1453
       1453
       +
       		},

     

       1454
       1454
       +
       		"/api/billing/checkout": {

     

       1455
       1455
       +
       			POST: async (req) => {

     

       1456
       1456
       +
       				try {

     

       1457
       1457
       +
       					const user = requireAuth(req);

     

       1458
       1458
       +
       

     

       1459
       1459
       +
       					const { polar } = await import("./lib/polar");

     

       1460
       1460
       +
       

     

       1461
       1461
       +
       					// Validated at startup

     

       1462
       1462
       +
       					const productId = process.env.POLAR_PRODUCT_ID as string;

     

       1463
       1463
       +
       					const successUrl =

     

       1464
       1464
       +
       						process.env.POLAR_SUCCESS_URL || "http://localhost:3000";

     

       686
       1465
        
       

     

       687
       1466
        
       					const checkout = await polar.checkouts.create({

     

       688
       1467
        
       						products: [productId],

     
···

       695
       1474
        
       					});

     

       696
       1475
        
       

     

       697
       1476
        
       					return Response.json({ url: checkout.url });

     

       698
       698
       -
       				} catch (error) {

     

       699
       699
       -
       					console.error("Failed to create checkout:", error);

     

       700
       700
       -
       					return Response.json(

     

       701
       701
       -
       						{ error: "Failed to create checkout session" },

     

       702
       702
       -
       						{ status: 500 },

     

       703
       703
       -
       					);

     

       1477
       1477
       +
       				} catch (err) {

     

       1478
       1478
       +
       					return handleError(err);

     

       704
       1479
        
       				}

     

       705
       1480
        
       			},

     

       706
       1481
        
       		},

     

       707
       1482
        
       		"/api/billing/subscription": {

     

       708
       1483
        
       			GET: async (req) => {

     

       709
       709
       -
       				const sessionId = getSessionFromRequest(req);

     

       710
       710
       -
       				if (!sessionId) {

     

       711
       711
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       712
       712
       -
       				}

     

       713
       713
       -
       				const user = getUserBySession(sessionId);

     

       714
       714
       -
       				if (!user) {

     

       715
       715
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       716
       716
       -
       				}

     

       1484
       1484
       +
       				try {

     

       1485
       1485
       +
       					const user = requireAuth(req);

     

       717
       1486
        
       

     

       718
       718
       -
       				try {

     

       719
       1487
        
       					// Get subscription from database

     

       720
       1488
        
       					const subscription = db

     

       721
       1489
        
       						.query<

     
···

       738
       1506
        
       					}

     

       739
       1507
        
       

     

       740
       1508
        
       					return Response.json({ subscription });

     

       741
       741
       -
       				} catch (error) {

     

       742
       742
       -
       					console.error("Failed to fetch subscription:", error);

     

       743
       743
       -
       					return Response.json(

     

       744
       744
       -
       						{ error: "Failed to fetch subscription" },

     

       745
       745
       -
       						{ status: 500 },

     

       746
       746
       -
       					);

     

       1509
       1509
       +
       				} catch (err) {

     

       1510
       1510
       +
       					return handleError(err);

     

       747
       1511
        
       				}

     

       748
       1512
        
       			},

     

       749
       1513
        
       		},

     

       750
       1514
        
       		"/api/billing/portal": {

     

       751
       1515
        
       			POST: async (req) => {

     

       752
       752
       -
       				const sessionId = getSessionFromRequest(req);

     

       753
       753
       -
       				if (!sessionId) {

     

       754
       754
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       755
       755
       -
       				}

     

       756
       756
       -
       				const user = getUserBySession(sessionId);

     

       757
       757
       -
       				if (!user) {

     

       758
       758
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       759
       759
       -
       				}

     

       1516
       1516
       +
       				try {

     

       1517
       1517
       +
       					const user = requireAuth(req);

     

       760
       1518
        
       

     

       761
       761
       -
       				try {

     

       762
       1519
        
       					const { polar } = await import("./lib/polar");

     

       763
       1520
        
       

     

       764
       1521
        
       					// Get subscription to find customer ID

     
···

       786
       1543
        
       					});

     

       787
       1544
        
       

     

       788
       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       789
       789
       -
       				} catch (error) {

     

       790
       790
       -
       					console.error("Failed to create portal session:", error);

     

       791
       791
       -
       					return Response.json(

     

       792
       792
       -
       						{ error: "Failed to create portal session" },

     

       793
       793
       -
       						{ status: 500 },

     

       794
       794
       -
       					);

     

       1546
       1546
       +
       				} catch (err) {

     

       1547
       1547
       +
       					return handleError(err);

     

       795
       1548
        
       				}

     

       796
       1549
        
       			},

     

       797
       1550
        
       		},

     

       798
       1551
        
       		"/api/webhooks/polar": {

     

       799
       1552
        
       			POST: async (req) => {

     

       800
       800
       -
       				try {

     

       801
       801
       -
       					const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1553
       1553
       +
       				const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       802
       1554
        
       

     

       803
       803
       -
       					// Get raw body as string

     

       804
       804
       -
       					const rawBody = await req.text();

     

       805
       805
       -
       					const headers = Object.fromEntries(req.headers.entries());

     

       1555
       1555
       +
       				// Get raw body as string

     

       1556
       1556
       +
       				const rawBody = await req.text();

     

       1557
       1557
       +
       				const headers = Object.fromEntries(req.headers.entries());

     

       806
       1558
        
       

     

       807
       807
       -
       					// Validate webhook signature

     

       808
       808
       -
       					const webhookSecret = process.env.POLAR_WEBHOOK_SECRET;

     

       809
       809
       -
       					if (!webhookSecret) {

     

       810
       810
       -
       						console.error("[Webhook] POLAR_WEBHOOK_SECRET not configured");

     

       811
       811
       -
       						return Response.json(

     

       812
       812
       -
       							{ error: "Webhook secret not configured" },

     

       813
       813
       -
       							{ status: 500 },

     

       814
       814
       -
       						);

     

       815
       815
       -
       					}

     

       1559
       1559
       +
       				// Validate webhook signature (validated at startup)

     

       1560
       1560
       +
       				const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1561
       1561
       +
       				let event: ReturnType<typeof validateEvent>;

     

       1562
       1562
       +
       				try {

     

       1563
       1563
       +
       					event = validateEvent(rawBody, headers, webhookSecret);

     

       1564
       1564
       +
       				} catch (error) {

     

       1565
       1565
       +
       					// Validation failed - log but return generic response

     

       1566
       1566
       +
       					console.error("[Webhook] Signature validation failed:", error);

     

       1567
       1567
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1568
       1568
       +
       				}

     

       816
       1569
        
       

     

       817
       817
       -
       					const event = validateEvent(rawBody, headers, webhookSecret);

     

       818
       818
       -
       

     

       819
       819
       -
       					console.log(`[Webhook] Received event: ${event.type}`);

     

       1570
       1570
       +
       				console.log(`[Webhook] Received event: ${event.type}`);

     

       820
       1571
        
       

     

       821
       821
       -
       					// Handle different event types

     

       1572
       1572
       +
       				// Handle different event types

     

       1573
       1573
       +
       				try {

     

       822
       1574
        
       					switch (event.type) {

     

       823
       1575
        
       						case "subscription.updated": {

     

       824
       1576
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       879
       1631
        
       

     

       880
       1632
        
       					return Response.json({ received: true });

     

       881
       1633
        
       				} catch (error) {

     

       882
       882
       -
       					console.error("[Webhook] Error processing webhook:", error);

     

       883
       883
       -
       					return Response.json(

     

       884
       884
       -
       						{ error: "Webhook processing failed" },

     

       885
       885
       -
       						{ status: 400 },

     

       886
       886
       -
       					);

     

       1634
       1634
       +
       					// Processing failed - log with detail but return generic response

     

       1635
       1635
       +
       					console.error("[Webhook] Event processing failed:", error);

     

       1636
       1636
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       887
       1637
        
       				}

     

       888
       1638
        
       			},

     

       889
       1639
        
       		},

     

       890
       1640
        
       		"/api/transcriptions/:id/stream": {

     

       891
       1641
        
       			GET: async (req) => {

     

       892
       1642
        
       				try {

     

       893
       893
       -
       					const user = requireSubscription(req);

     

       1643
       1643
       +
       					const user = requireAuth(req);

     

       894
       1644
        
       					const transcriptionId = req.params.id;

     

       895
       1645
        
       					// Verify ownership

     

       896
       1646
        
       					const transcription = db

     

       897
       897
       -
       						.query<{ id: string; user_id: number; status: string }, [string]>(

     

       898
       898
       -
       							"SELECT id, user_id, status FROM transcriptions WHERE id = ?",

     

       1647
       1647
       +
       						.query<

     

       1648
       1648
       +
       							{

     

       1649
       1649
       +
       								id: string;

     

       1650
       1650
       +
       								user_id: number;

     

       1651
       1651
       +
       								class_id: string | null;

     

       1652
       1652
       +
       								status: string;

     

       1653
       1653
       +
       							},

     

       1654
       1654
       +
       							[string]

     

       1655
       1655
       +
       						>(

     

       1656
       1656
       +
       							"SELECT id, user_id, class_id, status FROM transcriptions WHERE id = ?",

     

       899
       1657
        
       						)

     

       900
       1658
        
       						.get(transcriptionId);

     

       901
       901
       -
       					if (!transcription || transcription.user_id !== user.id) {

     

       1659
       1659
       +
       

     

       1660
       1660
       +
       					if (!transcription) {

     

       902
       1661
        
       						return Response.json(

     

       903
       1662
        
       							{ error: "Transcription not found" },

     

       904
       1663
        
       							{ status: 404 },

     

       905
       1664
        
       						);

     

       906
       1665
        
       					}

     

       1666
       1666
       +
       

     

       1667
       1667
       +
       					// Check access permissions

     

       1668
       1668
       +
       					const isOwner = transcription.user_id === user.id;

     

       1669
       1669
       +
       					const isAdmin = user.role === "admin";

     

       1670
       1670
       +
       					let isClassMember = false;

     

       1671
       1671
       +
       

     

       1672
       1672
       +
       					// If transcription belongs to a class, check enrollment

     

       1673
       1673
       +
       					if (transcription.class_id) {

     

       1674
       1674
       +
       						isClassMember = isUserEnrolledInClass(

     

       1675
       1675
       +
       							user.id,

     

       1676
       1676
       +
       							transcription.class_id,

     

       1677
       1677
       +
       						);

     

       1678
       1678
       +
       					}

     

       1679
       1679
       +
       

     

       1680
       1680
       +
       					// Allow access if: owner, admin, or enrolled in the class

     

       1681
       1681
       +
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1682
       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1683
       1683
       +
       					}

     

       1684
       1684
       +
       

     

       1685
       1685
       +
       					// Require subscription only if accessing own transcription (not class)

     

       1686
       1686
       +
       					if (

     

       1687
       1687
       +
       						isOwner &&

     

       1688
       1688
       +
       						!transcription.class_id &&

     

       1689
       1689
       +
       						!isAdmin &&

     

       1690
       1690
       +
       						!hasActiveSubscription(user.id)

     

       1691
       1691
       +
       					) {

     

       1692
       1692
       +
       						throw AuthErrors.subscriptionRequired();

     

       1693
       1693
       +
       					}

     

       907
       1694
        
       					// Event-driven SSE stream with reconnection support

     

       908
       1695
        
       					const stream = new ReadableStream({

     

       909
       1696
        
       						async start(controller) {

     

       1697
       1697
       +
       							// Track this stream for graceful shutdown

     

       1698
       1698
       +
       							activeSSEStreams.add(controller);

     

       1699
       1699
       +
       

     

       910
       1700
        
       							const encoder = new TextEncoder();

     

       911
       1701
        
       							let isClosed = false;

     

       912
       1702
        
       							let lastEventId = Math.floor(Date.now() / 1000);

     
···

       957
       1747
        
       								current?.status === "failed"

     

       958
       1748
        
       							) {

     

       959
       1749
        
       								isClosed = true;

     

       1750
       1750
       +
       								activeSSEStreams.delete(controller);

     

       960
       1751
        
       								controller.close();

     

       961
       1752
        
       								return;

     

       962
       1753
        
       							}

     
···

       987
       1778
        
       									isClosed = true;

     

       988
       1779
        
       									clearInterval(heartbeatInterval);

     

       989
       1780
        
       									transcriptionEvents.off(transcriptionId, updateHandler);

     

       1781
       1781
       +
       									activeSSEStreams.delete(controller);

     

       990
       1782
        
       									controller.close();

     

       991
       1783
        
       								}

     

       992
       1784
        
       							};

     
···

       996
       1788
        
       								isClosed = true;

     

       997
       1789
        
       								clearInterval(heartbeatInterval);

     

       998
       1790
        
       								transcriptionEvents.off(transcriptionId, updateHandler);

     

       1791
       1791
       +
       								activeSSEStreams.delete(controller);

     

       999
       1792
        
       							};

     

       1000
       1793
        
       						},

     

       1001
       1794
        
       					});

     
···

       1011
       1804
        
       				}

     

       1012
       1805
        
       			},

     

       1013
       1806
        
       		},

     

       1014
       1014
       -
       		"/api/transcriptions/health": {

     

       1807
       1807
       +
       		"/api/health": {

     

       1015
       1808
        
       			GET: async () => {

     

       1016
       1016
       -
       				const isHealthy = await whisperService.checkHealth();

     

       1017
       1017
       -
       				return Response.json({ available: isHealthy });

     

       1809
       1809
       +
       				const health = {

     

       1810
       1810
       +
       					status: "healthy",

     

       1811
       1811
       +
       					timestamp: new Date().toISOString(),

     

       1812
       1812
       +
       					services: {

     

       1813
       1813
       +
       						database: false,

     

       1814
       1814
       +
       						whisper: false,

     

       1815
       1815
       +
       						storage: false,

     

       1816
       1816
       +
       					},

     

       1817
       1817
       +
       					details: {} as Record<string, unknown>,

     

       1818
       1818
       +
       				};

     

       1819
       1819
       +
       

     

       1820
       1820
       +
       				// Check database

     

       1821
       1821
       +
       				try {

     

       1822
       1822
       +
       					db.query("SELECT 1").get();

     

       1823
       1823
       +
       					health.services.database = true;

     

       1824
       1824
       +
       				} catch (error) {

     

       1825
       1825
       +
       					health.status = "unhealthy";

     

       1826
       1826
       +
       					health.details.databaseError =

     

       1827
       1827
       +
       						error instanceof Error ? error.message : String(error);

     

       1828
       1828
       +
       				}

     

       1829
       1829
       +
       

     

       1830
       1830
       +
       				// Check Whisper service

     

       1831
       1831
       +
       				try {

     

       1832
       1832
       +
       					const whisperHealthy = await whisperService.checkHealth();

     

       1833
       1833
       +
       					health.services.whisper = whisperHealthy;

     

       1834
       1834
       +
       					if (!whisperHealthy) {

     

       1835
       1835
       +
       						health.status = "degraded";

     

       1836
       1836
       +
       						health.details.whisperNote = "Whisper service unavailable";

     

       1837
       1837
       +
       					}

     

       1838
       1838
       +
       				} catch (error) {

     

       1839
       1839
       +
       					health.status = "degraded";

     

       1840
       1840
       +
       					health.details.whisperError =

     

       1841
       1841
       +
       						error instanceof Error ? error.message : String(error);

     

       1842
       1842
       +
       				}

     

       1843
       1843
       +
       

     

       1844
       1844
       +
       				// Check storage (uploads and transcripts directories)

     

       1845
       1845
       +
       				try {

     

       1846
       1846
       +
       					const fs = await import("node:fs/promises");

     

       1847
       1847
       +
       					const uploadsExists = await fs

     

       1848
       1848
       +
       						.access("./uploads")

     

       1849
       1849
       +
       						.then(() => true)

     

       1850
       1850
       +
       						.catch(() => false);

     

       1851
       1851
       +
       					const transcriptsExists = await fs

     

       1852
       1852
       +
       						.access("./transcripts")

     

       1853
       1853
       +
       						.then(() => true)

     

       1854
       1854
       +
       						.catch(() => false);

     

       1855
       1855
       +
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1856
       1856
       +
       					if (!health.services.storage) {

     

       1857
       1857
       +
       						health.status = "unhealthy";

     

       1858
       1858
       +
       						health.details.storageNote = `Missing directories: ${[

     

       1859
       1859
       +
       							!uploadsExists && "uploads",

     

       1860
       1860
       +
       							!transcriptsExists && "transcripts",

     

       1861
       1861
       +
       						]

     

       1862
       1862
       +
       							.filter(Boolean)

     

       1863
       1863
       +
       							.join(", ")}`;

     

       1864
       1864
       +
       					}

     

       1865
       1865
       +
       				} catch (error) {

     

       1866
       1866
       +
       					health.status = "unhealthy";

     

       1867
       1867
       +
       					health.details.storageError =

     

       1868
       1868
       +
       						error instanceof Error ? error.message : String(error);

     

       1869
       1869
       +
       				}

     

       1870
       1870
       +
       

     

       1871
       1871
       +
       				const statusCode = health.status === "healthy" ? 200 : 503;

     

       1872
       1872
       +
       				return Response.json(health, { status: statusCode });

     

       1018
       1873
        
       			},

     

       1019
       1874
        
       		},

     

       1020
       1875
        
       		"/api/transcriptions/:id": {

     

       1021
       1876
        
       			GET: async (req) => {

     

       1022
       1877
        
       				try {

     

       1023
       1023
       -
       					const user = requireSubscription(req);

     

       1878
       1878
       +
       					const user = requireAuth(req);

     

       1024
       1879
        
       					const transcriptionId = req.params.id;

     

       1025
       1880
        
       

     

       1026
       1881
        
       					// Verify ownership or admin

     
···

       1029
       1884
        
       							{

     

       1030
       1885
        
       								id: string;

     

       1031
       1886
        
       								user_id: number;

     

       1887
       1887
       +
       								class_id: string | null;

     

       1032
       1888
        
       								filename: string;

     

       1033
       1889
        
       								original_filename: string;

     

       1034
       1890
        
       								status: string;

     
···

       1037
       1893
        
       							},

     

       1038
       1894
        
       							[string]

     

       1039
       1895
        
       						>(

     

       1040
       1040
       -
       							"SELECT id, user_id, filename, original_filename, status, progress, created_at FROM transcriptions WHERE id = ?",

     

       1896
       1896
       +
       							"SELECT id, user_id, class_id, filename, original_filename, status, progress, created_at FROM transcriptions WHERE id = ?",

     

       1041
       1897
        
       						)

     

       1042
       1898
        
       						.get(transcriptionId);

     

       1043
       1899
        
       

     
···

       1048
       1904
        
       						);

     

       1049
       1905
        
       					}

     

       1050
       1906
        
       

     

       1051
       1051
       -
       					// Allow access if user owns it or is admin

     

       1052
       1052
       -
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       1053
       1053
       -
       						return Response.json(

     

       1054
       1054
       -
       							{ error: "Transcription not found" },

     

       1055
       1055
       -
       							{ status: 404 },

     

       1907
       1907
       +
       					// Check access permissions

     

       1908
       1908
       +
       					const isOwner = transcription.user_id === user.id;

     

       1909
       1909
       +
       					const isAdmin = user.role === "admin";

     

       1910
       1910
       +
       					let isClassMember = false;

     

       1911
       1911
       +
       

     

       1912
       1912
       +
       					// If transcription belongs to a class, check enrollment

     

       1913
       1913
       +
       					if (transcription.class_id) {

     

       1914
       1914
       +
       						isClassMember = isUserEnrolledInClass(

     

       1915
       1915
       +
       							user.id,

     

       1916
       1916
       +
       							transcription.class_id,

     

       1056
       1917
        
       						);

     

       1057
       1918
        
       					}

     

       1058
       1919
        
       

     

       1920
       1920
       +
       					// Allow access if: owner, admin, or enrolled in the class

     

       1921
       1921
       +
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1922
       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1923
       1923
       +
       					}

     

       1924
       1924
       +
       

     

       1925
       1925
       +
       					// Require subscription only if accessing own transcription (not class)

     

       1926
       1926
       +
       					if (

     

       1927
       1927
       +
       						isOwner &&

     

       1928
       1928
       +
       						!transcription.class_id &&

     

       1929
       1929
       +
       						!isAdmin &&

     

       1930
       1930
       +
       						!hasActiveSubscription(user.id)

     

       1931
       1931
       +
       					) {

     

       1932
       1932
       +
       						throw AuthErrors.subscriptionRequired();

     

       1933
       1933
       +
       					}

     

       1934
       1934
       +
       

     

       1059
       1935
        
       					if (transcription.status !== "completed") {

     

       1060
       1936
        
       						return Response.json(

     

       1061
       1937
        
       							{ error: "Transcription not completed yet" },

     

       1062
       1062
       -
       							{ status: 400 },

     

       1938
       1938
       +
       							{ status: 409 },

     

       1063
       1939
        
       						);

     

       1064
       1940
        
       					}

     

       1065
       1941
        
       

     
···

       1107
       1983
        
       		"/api/transcriptions/:id/audio": {

     

       1108
       1984
        
       			GET: async (req) => {

     

       1109
       1985
        
       				try {

     

       1110
       1110
       -
       					const user = requireSubscription(req);

     

       1986
       1986
       +
       					const user = requireAuth(req);

     

       1111
       1987
        
       					const transcriptionId = req.params.id;

     

       1112
       1988
        
       

     

       1113
       1989
        
       					// Verify ownership or admin

     
···

       1116
       1992
        
       							{

     

       1117
       1993
        
       								id: string;

     

       1118
       1994
        
       								user_id: number;

     

       1995
       1995
       +
       								class_id: string | null;

     

       1119
       1996
        
       								filename: string;

     

       1120
       1997
        
       								status: string;

     

       1121
       1998
        
       							},

     

       1122
       1999
        
       							[string]

     

       1123
       2000
        
       						>(

     

       1124
       1124
       -
       							"SELECT id, user_id, filename, status FROM transcriptions WHERE id = ?",

     

       2001
       2001
       +
       							"SELECT id, user_id, class_id, filename, status FROM transcriptions WHERE id = ?",

     

       1125
       2002
        
       						)

     

       1126
       2003
        
       						.get(transcriptionId);

     

       1127
       2004
        
       

     
···

       1132
       2009
        
       						);

     

       1133
       2010
        
       					}

     

       1134
       2011
        
       

     

       1135
       1135
       -
       					// Allow access if user owns it or is admin

     

       1136
       1136
       -
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       1137
       1137
       -
       						return Response.json(

     

       1138
       1138
       -
       							{ error: "Transcription not found" },

     

       1139
       1139
       -
       							{ status: 404 },

     

       2012
       2012
       +
       					// Check access permissions

     

       2013
       2013
       +
       					const isOwner = transcription.user_id === user.id;

     

       2014
       2014
       +
       					const isAdmin = user.role === "admin";

     

       2015
       2015
       +
       					let isClassMember = false;

     

       2016
       2016
       +
       

     

       2017
       2017
       +
       					// If transcription belongs to a class, check enrollment

     

       2018
       2018
       +
       					if (transcription.class_id) {

     

       2019
       2019
       +
       						isClassMember = isUserEnrolledInClass(

     

       2020
       2020
       +
       							user.id,

     

       2021
       2021
       +
       							transcription.class_id,

     

       1140
       2022
        
       						);

     

       1141
       2023
        
       					}

     

       1142
       2024
        
       

     

       2025
       2025
       +
       					// Allow access if: owner, admin, or enrolled in the class

     

       2026
       2026
       +
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       2027
       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2028
       2028
       +
       					}

     

       2029
       2029
       +
       

     

       2030
       2030
       +
       					// Require subscription only if accessing own transcription (not class)

     

       2031
       2031
       +
       					if (

     

       2032
       2032
       +
       						isOwner &&

     

       2033
       2033
       +
       						!transcription.class_id &&

     

       2034
       2034
       +
       						!isAdmin &&

     

       2035
       2035
       +
       						!hasActiveSubscription(user.id)

     

       2036
       2036
       +
       					) {

     

       2037
       2037
       +
       						throw AuthErrors.subscriptionRequired();

     

       2038
       2038
       +
       					}

     

       2039
       2039
       +
       

     

       1143
       2040
        
       					// For pending recordings, audio file exists even though transcription isn't complete

     

       1144
       2041
        
       					// Allow audio access for pending and completed statuses

     

       1145
       2042
        
       					if (

     
···

       1199
       2096
        
       				}

     

       1200
       2097
        
       			},

     

       1201
       2098
        
       		},

     

       1202
       1202
       -
       		"/api/transcriptions": {

     

       2099
       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       2100
       +
       			POST: async (req) => {

     

       2101
       2101
       +
       				try {

     

       2102
       2102
       +
       					const user = requireAuth(req);

     

       2103
       2103
       +
       

     

       2104
       2104
       +
       					const formData = await req.formData();

     

       2105
       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       2108
       +
       						| string

     

       2109
       2109
       +
       						| null;

     

       2110
       2110
       +
       

     

       2111
       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       2113
       +
       

     

       2114
       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       2117
       +
       						return Response.json(

     

       2118
       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       2119
       +
       							{ status: 403 },

     

       2120
       2120
       +
       						);

     

       2121
       2121
       +
       					}

     

       2122
       2122
       +
       

     

       2123
       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       2124
       +
       

     

       2125
       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       2126
       +
       					if (fileTimestampStr) {

     

       2127
       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       2130
       +
       							console.log(

     

       2131
       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       2132
       +
       							);

     

       2133
       2133
       +
       						}

     

       2134
       2134
       +
       					}

     

       2135
       2135
       +
       

     

       2136
       2136
       +
       					if (!creationDate) {

     

       2137
       2137
       +
       						return Response.json({

     

       2138
       2138
       +
       							detected: false,

     

       2139
       2139
       +
       							meeting_time_id: null,

     

       2140
       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       2141
       +
       						});

     

       2142
       2142
       +
       					}

     

       2143
       2143
       +
       

     

       2144
       2144
       +
       					// Get meeting times for this class

     

       2145
       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       2146
       +
       

     

       2147
       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       2148
       +
       						return Response.json({

     

       2149
       2149
       +
       							detected: false,

     

       2150
       2150
       +
       							meeting_time_id: null,

     

       2151
       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       2152
       +
       						});

     

       2153
       2153
       +
       					}

     

       2154
       2154
       +
       

     

       2155
       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       2157
       +
       						creationDate,

     

       2158
       2158
       +
       						meetingTimes,

     

       2159
       2159
       +
       					);

     

       2160
       2160
       +
       

     

       2161
       2161
       +
       					if (matchedId) {

     

       2162
       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       2163
       +
       						return Response.json({

     

       2164
       2164
       +
       							detected: true,

     

       2165
       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       2166
       +
       							day: dayName,

     

       2167
       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       2168
       +
       						});

     

       2169
       2169
       +
       					}

     

       2170
       2170
       +
       

     

       2171
       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       2172
       +
       					return Response.json({

     

       2173
       2173
       +
       						detected: false,

     

       2174
       2174
       +
       						meeting_time_id: null,

     

       2175
       2175
       +
       						day: dayName,

     

       2176
       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       2178
       +
       					});

     

       2179
       2179
       +
       				} catch (error) {

     

       2180
       2180
       +
       					return handleError(error);

     

       2181
       2181
       +
       				}

     

       2182
       2182
       +
       			},

     

       2183
       2183
       +
       		},

     

       2184
       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       2185
       +
       			PATCH: async (req) => {

     

       2186
       2186
       +
       				try {

     

       2187
       2187
       +
       					const user = requireAuth(req);

     

       2188
       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       2189
       +
       

     

       2190
       2190
       +
       					const body = await req.json();

     

       2191
       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       2192
       +
       					const sectionId = body.section_id;

     

       2193
       2193
       +
       

     

       2194
       2194
       +
       					if (!meetingTimeId) {

     

       2195
       2195
       +
       						return Response.json(

     

       2196
       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       2197
       +
       							{ status: 400 },

     

       2198
       2198
       +
       						);

     

       2199
       2199
       +
       					}

     

       2200
       2200
       +
       

     

       2201
       2201
       +
       					// Verify transcription ownership

     

       2202
       2202
       +
       					const transcription = db

     

       2203
       2203
       +
       						.query<

     

       2204
       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       2205
       +
       							[string]

     

       2206
       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       2207
       +
       						.get(transcriptionId);

     

       2208
       2208
       +
       

     

       2209
       2209
       +
       					if (!transcription) {

     

       2210
       2210
       +
       						return Response.json(

     

       2211
       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       2212
       +
       							{ status: 404 },

     

       2213
       2213
       +
       						);

     

       2214
       2214
       +
       					}

     

       2215
       2215
       +
       

     

       2216
       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       2218
       +
       					}

     

       2219
       2219
       +
       

     

       2220
       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       2221
       +
       					if (transcription.class_id) {

     

       2222
       2222
       +
       						const meetingTime = db

     

       2223
       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       2225
       +
       							)

     

       2226
       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       2227
       +
       

     

       2228
       2228
       +
       						if (!meetingTime) {

     

       2229
       2229
       +
       							return Response.json(

     

       2230
       2230
       +
       								{

     

       2231
       2231
       +
       									error:

     

       2232
       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       2233
       +
       								},

     

       2234
       2234
       +
       								{ status: 400 },

     

       2235
       2235
       +
       							);

     

       2236
       2236
       +
       						}

     

       2237
       2237
       +
       					}

     

       2238
       2238
       +
       

     

       2239
       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       2241
       +
       						db.run(

     

       2242
       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       2244
       +
       						);

     

       2245
       2245
       +
       					} else {

     

       2246
       2246
       +
       						db.run(

     

       2247
       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       2249
       +
       						);

     

       2250
       2250
       +
       					}

     

       2251
       2251
       +
       

     

       2252
       2252
       +
       					return Response.json({

     

       2253
       2253
       +
       						success: true,

     

       2254
       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       2255
       +
       					});

     

       2256
       2256
       +
       				} catch (error) {

     

       2257
       2257
       +
       					return handleError(error);

     

       2258
       2258
       +
       				}

     

       2259
       2259
       +
       			},

     

       2260
       2260
       +
       		},

     

       2261
       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       1203
       2262
        
       			GET: async (req) => {

     

       1204
       2263
        
       				try {

     

       1205
       1205
       -
       					const user = requireSubscription(req);

     

       2264
       2264
       +
       					const user = requireAuth(req);

     

       2265
       2265
       +
       					const classId = req.params.classId;

     

       2266
       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       2267
       2267
       +
       

     

       2268
       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       2271
       +
       						return Response.json(

     

       2272
       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       2273
       +
       							{ status: 403 },

     

       2274
       2274
       +
       						);

     

       2275
       2275
       +
       					}

     

       1206
       2276
        
       

     

       1207
       1207
       -
       					const transcriptions = db

     

       2277
       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       2278
       +
       					const url = new URL(req.url);

     

       2279
       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       2280
       +
       					const sectionFilter =

     

       2281
       2281
       +
       						sectionParam !== null

     

       2282
       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       2283
       +
       							: user.role === "admin"

     

       2284
       2284
       +
       								? null

     

       2285
       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
       2286
       +
       

     

       2287
       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       2288
       +
       						classId,

     

       2289
       2289
       +
       						meetingTimeId,

     

       2290
       2290
       +
       						sectionFilter,

     

       2291
       2291
       +
       					);

     

       2292
       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       2294
       +
       						user.id,

     

       2295
       2295
       +
       						classId,

     

       2296
       2296
       +
       						meetingTimeId,

     

       2297
       2297
       +
       					);

     

       2298
       2298
       +
       

     

       2299
       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       2301
       +
       						classId,

     

       2302
       2302
       +
       						meetingTimeId,

     

       2303
       2303
       +
       						sectionFilter,

     

       2304
       2304
       +
       					);

     

       2305
       2305
       +
       

     

       2306
       2306
       +
       					return Response.json({

     

       2307
       2307
       +
       						recordings,

     

       2308
       2308
       +
       						total_users: totalUsers,

     

       2309
       2309
       +
       						user_vote: userVote,

     

       2310
       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       2311
       +
       						winning_recording_id: winningId,

     

       2312
       2312
       +
       					});

     

       2313
       2313
       +
       				} catch (error) {

     

       2314
       2314
       +
       					return handleError(error);

     

       2315
       2315
       +
       				}

     

       2316
       2316
       +
       			},

     

       2317
       2317
       +
       		},

     

       2318
       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       2319
       +
       			POST: async (req) => {

     

       2320
       2320
       +
       				try {

     

       2321
       2321
       +
       					const user = requireAuth(req);

     

       2322
       2322
       +
       					const recordingId = req.params.id;

     

       2323
       2323
       +
       

     

       2324
       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       2325
       +
       					const recording = db

     

       1208
       2326
        
       						.query<

     

       1209
       1209
       -
       							{

     

       1210
       1210
       -
       								id: string;

     

       1211
       1211
       -
       								filename: string;

     

       1212
       1212
       -
       								original_filename: string;

     

       1213
       1213
       -
       								class_id: string | null;

     

       1214
       1214
       -
       								status: string;

     

       1215
       1215
       -
       								progress: number;

     

       1216
       1216
       -
       								created_at: number;

     

       1217
       1217
       -
       							},

     

       1218
       1218
       -
       							[number]

     

       2327
       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       2328
       +
       							[string]

     

       1219
       2329
        
       						>(

     

       1220
       1220
       -
       							"SELECT id, filename, original_filename, class_id, status, progress, created_at FROM transcriptions WHERE user_id = ? ORDER BY created_at DESC",

     

       2330
       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       1221
       2331
        
       						)

     

       1222
       1222
       -
       						.all(user.id);

     

       2332
       2332
       +
       						.get(recordingId);

     

       2333
       2333
       +
       

     

       2334
       2334
       +
       					if (!recording) {

     

       2335
       2335
       +
       						return Response.json(

     

       2336
       2336
       +
       							{ error: "Recording not found" },

     

       2337
       2337
       +
       							{ status: 404 },

     

       2338
       2338
       +
       						);

     

       2339
       2339
       +
       					}

     

       2340
       2340
       +
       

     

       2341
       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       2342
       +
       						return Response.json(

     

       2343
       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       2344
       +
       							{ status: 400 },

     

       2345
       2345
       +
       						);

     

       2346
       2346
       +
       					}

     

       2347
       2347
       +
       

     

       2348
       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       2350
       +
       						return Response.json(

     

       2351
       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       2352
       +
       							{ status: 403 },

     

       2353
       2353
       +
       						);

     

       2354
       2354
       +
       					}

     

       2355
       2355
       +
       

     

       2356
       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       2358
       +
       						user.id,

     

       2359
       2359
       +
       						recording.class_id,

     

       2360
       2360
       +
       						recording.meeting_time_id,

     

       2361
       2361
       +
       					);

     

       2362
       2362
       +
       					if (existingVote) {

     

       2363
       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       2364
       +
       					}

     

       2365
       2365
       +
       

     

       2366
       2366
       +
       					// Add new vote

     

       2367
       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       2368
       +
       

     

       2369
       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       2370
       +
       					const userSection =

     

       2371
       2371
       +
       						user.role === "admin"

     

       2372
       2372
       +
       							? null

     

       2373
       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       2374
       +
       

     

       2375
       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       2377
       +
       						recording.class_id,

     

       2378
       2378
       +
       						recording.meeting_time_id,

     

       2379
       2379
       +
       						userSection,

     

       2380
       2380
       +
       					);

     

       2381
       2381
       +
       					if (winningId) {

     

       2382
       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       2383
       +
       						// Start transcription

     

       2384
       2384
       +
       						const winningRecording = db

     

       2385
       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       2387
       +
       							)

     

       2388
       2388
       +
       							.get(winningId);

     

       2389
       2389
       +
       						if (winningRecording) {

     

       2390
       2390
       +
       							whisperService.startTranscription(

     

       2391
       2391
       +
       								winningId,

     

       2392
       2392
       +
       								winningRecording.filename,

     

       2393
       2393
       +
       							);

     

       2394
       2394
       +
       						}

     

       2395
       2395
       +
       					}

     

       2396
       2396
       +
       

     

       2397
       2397
       +
       					return Response.json({

     

       2398
       2398
       +
       						success,

     

       2399
       2399
       +
       						winning_recording_id: winningId,

     

       2400
       2400
       +
       					});

     

       2401
       2401
       +
       				} catch (error) {

     

       2402
       2402
       +
       					return handleError(error);

     

       2403
       2403
       +
       				}

     

       2404
       2404
       +
       			},

     

       2405
       2405
       +
       		},

     

       2406
       2406
       +
       		"/api/recordings/:id": {

     

       2407
       2407
       +
       			DELETE: async (req) => {

     

       2408
       2408
       +
       				try {

     

       2409
       2409
       +
       					const user = requireAuth(req);

     

       2410
       2410
       +
       					const recordingId = req.params.id;

     

       2411
       2411
       +
       

     

       2412
       2412
       +
       					const success = deletePendingRecording(

     

       2413
       2413
       +
       						recordingId,

     

       2414
       2414
       +
       						user.id,

     

       2415
       2415
       +
       						user.role === "admin",

     

       2416
       2416
       +
       					);

     

       2417
       2417
       +
       

     

       2418
       2418
       +
       					if (!success) {

     

       2419
       2419
       +
       						return Response.json(

     

       2420
       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       2421
       +
       							{ status: 403 },

     

       2422
       2422
       +
       						);

     

       2423
       2423
       +
       					}

     

       2424
       2424
       +
       

     

       2425
       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       2426
       +
       				} catch (error) {

     

       2427
       2427
       +
       					return handleError(error);

     

       2428
       2428
       +
       				}

     

       2429
       2429
       +
       			},

     

       2430
       2430
       +
       		},

     

       2431
       2431
       +
       		"/api/transcriptions": {

     

       2432
       2432
       +
       			GET: async (req) => {

     

       2433
       2433
       +
       				try {

     

       2434
       2434
       +
       					const user = requireSubscription(req);

     

       2435
       2435
       +
       					const url = new URL(req.url);

     

       2436
       2436
       +
       

     

       2437
       2437
       +
       					// Parse pagination params

     

       2438
       2438
       +
       					const limit = Math.min(

     

       2439
       2439
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2440
       2440
       +
       						100,

     

       2441
       2441
       +
       					);

     

       2442
       2442
       +
       					const cursorParam = url.searchParams.get("cursor");

     

       2443
       2443
       +
       

     

       2444
       2444
       +
       					let transcriptions: Array<{

     

       2445
       2445
       +
       						id: string;

     

       2446
       2446
       +
       						filename: string;

     

       2447
       2447
       +
       						original_filename: string;

     

       2448
       2448
       +
       						class_id: string | null;

     

       2449
       2449
       +
       						status: string;

     

       2450
       2450
       +
       						progress: number;

     

       2451
       2451
       +
       						created_at: number;

     

       2452
       2452
       +
       					}>;

     

       2453
       2453
       +
       

     

       2454
       2454
       +
       					if (cursorParam) {

     

       2455
       2455
       +
       						// Decode cursor

     

       2456
       2456
       +
       						const { decodeCursor } = await import("./lib/cursor");

     

       2457
       2457
       +
       						const parts = decodeCursor(cursorParam);

     

       2458
       2458
       +
       

     

       2459
       2459
       +
       						if (parts.length !== 2) {

     

       2460
       2460
       +
       							return Response.json(

     

       2461
       2461
       +
       								{ error: "Invalid cursor format" },

     

       2462
       2462
       +
       								{ status: 400 },

     

       2463
       2463
       +
       							);

     

       2464
       2464
       +
       						}

     

       2465
       2465
       +
       

     

       2466
       2466
       +
       						const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       2467
       2467
       +
       						const id = parts[1] || "";

     

       2468
       2468
       +
       

     

       2469
       2469
       +
       						if (Number.isNaN(cursorTime) || !id) {

     

       2470
       2470
       +
       							return Response.json(

     

       2471
       2471
       +
       								{ error: "Invalid cursor format" },

     

       2472
       2472
       +
       								{ status: 400 },

     

       2473
       2473
       +
       							);

     

       2474
       2474
       +
       						}

     

       2475
       2475
       +
       

     

       2476
       2476
       +
       						transcriptions = db

     

       2477
       2477
       +
       							.query<

     

       2478
       2478
       +
       								{

     

       2479
       2479
       +
       									id: string;

     

       2480
       2480
       +
       									filename: string;

     

       2481
       2481
       +
       									original_filename: string;

     

       2482
       2482
       +
       									class_id: string | null;

     

       2483
       2483
       +
       									status: string;

     

       2484
       2484
       +
       									progress: number;

     

       2485
       2485
       +
       									created_at: number;

     

       2486
       2486
       +
       								},

     

       2487
       2487
       +
       								[number, number, string, number]

     

       2488
       2488
       +
       							>(

     

       2489
       2489
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2490
       2490
       +
       								FROM transcriptions 

     

       2491
       2491
       +
       								WHERE user_id = ? AND (created_at < ? OR (created_at = ? AND id < ?))

     

       2492
       2492
       +
       								ORDER BY created_at DESC, id DESC 

     

       2493
       2493
       +
       								LIMIT ?`,

     

       2494
       2494
       +
       							)

     

       2495
       2495
       +
       							.all(user.id, cursorTime, cursorTime, id, limit + 1);

     

       2496
       2496
       +
       					} else {

     

       2497
       2497
       +
       						transcriptions = db

     

       2498
       2498
       +
       							.query<

     

       2499
       2499
       +
       								{

     

       2500
       2500
       +
       									id: string;

     

       2501
       2501
       +
       									filename: string;

     

       2502
       2502
       +
       									original_filename: string;

     

       2503
       2503
       +
       									class_id: string | null;

     

       2504
       2504
       +
       									status: string;

     

       2505
       2505
       +
       									progress: number;

     

       2506
       2506
       +
       									created_at: number;

     

       2507
       2507
       +
       								},

     

       2508
       2508
       +
       								[number, number]

     

       2509
       2509
       +
       							>(

     

       2510
       2510
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2511
       2511
       +
       								FROM transcriptions 

     

       2512
       2512
       +
       								WHERE user_id = ? 

     

       2513
       2513
       +
       								ORDER BY created_at DESC, id DESC 

     

       2514
       2514
       +
       								LIMIT ?`,

     

       2515
       2515
       +
       							)

     

       2516
       2516
       +
       							.all(user.id, limit + 1);

     

       2517
       2517
       +
       					}

     

       2518
       2518
       +
       

     

       2519
       2519
       +
       					// Check if there are more results

     

       2520
       2520
       +
       					const hasMore = transcriptions.length > limit;

     

       2521
       2521
       +
       					if (hasMore) {

     

       2522
       2522
       +
       						transcriptions.pop(); // Remove extra item

     

       2523
       2523
       +
       					}

     

       2524
       2524
       +
       

     

       2525
       2525
       +
       					// Build next cursor

     

       2526
       2526
       +
       					let nextCursor: string | null = null;

     

       2527
       2527
       +
       					if (hasMore && transcriptions.length > 0) {

     

       2528
       2528
       +
       						const { encodeCursor } = await import("./lib/cursor");

     

       2529
       2529
       +
       						const last = transcriptions[transcriptions.length - 1];

     

       2530
       2530
       +
       						if (last) {

     

       2531
       2531
       +
       							nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       2532
       2532
       +
       						}

     

       2533
       2533
       +
       					}

     

       1223
       2534
        
       

     

       1224
       2535
        
       					// Load transcripts from files for completed jobs

     

       1225
       2536
        
       					const jobs = await Promise.all(

     
···

       1235
       2546
        
       						}),

     

       1236
       2547
        
       					);

     

       1237
       2548
        
       

     

       1238
       1238
       -
       					return Response.json({ jobs });

     

       2549
       2549
       +
       					return Response.json({

     

       2550
       2550
       +
       						jobs,

     

       2551
       2551
       +
       						pagination: {

     

       2552
       2552
       +
       							limit,

     

       2553
       2553
       +
       							hasMore,

     

       2554
       2554
       +
       							nextCursor,

     

       2555
       2555
       +
       						},

     

       2556
       2556
       +
       					});

     

       1239
       2557
        
       				} catch (error) {

     

       1240
       2558
        
       					return handleError(error);

     

       1241
       2559
        
       				}

     
···

       1244
       2562
        
       				try {

     

       1245
       2563
        
       					const user = requireSubscription(req);

     

       1246
       2564
        
       

     

       2565
       2565
       +
       					const rateLimitError = enforceRateLimit(req, "upload-transcription", {

     

       2566
       2566
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       2567
       2567
       +
       					});

     

       2568
       2568
       +
       					if (rateLimitError) return rateLimitError;

     

       2569
       2569
       +
       

     

       1247
       2570
        
       					const formData = await req.formData();

     

       1248
       2571
        
       					const file = formData.get("audio") as File;

     

       1249
       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       1250
       1250
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       2573
       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       1251
       2575
        
       						| string

     

       1252
       2576
        
       						| null;

     

       1253
       2577
        
       

     
···

       1316
       2640
        
       					const uploadDir = "./uploads";

     

       1317
       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       1318
       2642
        
       

     

       1319
       1319
       -
       					// Create database record

     

       2643
       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       2647
       +
       

     

       2648
       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       1320
       2649
        
       					db.run(

     

       1321
       1321
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       2650
       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       1322
       2651
        
       						[

     

       1323
       2652
        
       							transcriptionId,

     

       1324
       2653
        
       							user.id,

     

       1325
       2654
        
       							classId,

     

       1326
       1326
       -
       							meetingTimeId,

     

       2655
       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       2656
       +
       							sectionId,

     

       1327
       2657
        
       							filename,

     

       1328
       2658
        
       							file.name,

     

       1329
       2659
        
       							"pending",

     

       2660
       2660
       +
       							recordingDate,

     

       1330
       2661
        
       						],

     

       1331
       2662
        
       					);

     

       1332
       2663
        
       

     

       1333
       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       1334
       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       1335
       2666
        
       

     

       1336
       1336
       -
       					return Response.json({

     

       1337
       1337
       -
       						id: transcriptionId,

     

       1338
       1338
       -
       						message: "Upload successful",

     

       1339
       1339
       -
       					});

     

       2667
       2667
       +
       					return Response.json(

     

       2668
       2668
       +
       						{

     

       2669
       2669
       +
       							id: transcriptionId,

     

       2670
       2670
       +
       							message: "Upload successful",

     

       2671
       2671
       +
       						},

     

       2672
       2672
       +
       						{ status: 201 },

     

       2673
       2673
       +
       					);

     

       1340
       2674
        
       				} catch (error) {

     

       1341
       2675
        
       					return handleError(error);

     

       1342
       2676
        
       				}

     
···

       1346
       2680
        
       			GET: async (req) => {

     

       1347
       2681
        
       				try {

     

       1348
       2682
        
       					requireAdmin(req);

     

       1349
       1349
       -
       					const transcriptions = getAllTranscriptions();

     

       1350
       1350
       -
       					return Response.json(transcriptions);

     

       2683
       2683
       +
       					const url = new URL(req.url);

     

       2684
       2684
       +
       

     

       2685
       2685
       +
       					const limit = Math.min(

     

       2686
       2686
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2687
       2687
       +
       						100,

     

       2688
       2688
       +
       					);

     

       2689
       2689
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2690
       2690
       +
       

     

       2691
       2691
       +
       					const result = getAllTranscriptions(limit, cursor);

     

       2692
       2692
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       1351
       2693
        
       				} catch (error) {

     

       1352
       2694
        
       					return handleError(error);

     

       1353
       2695
        
       				}

     
···

       1357
       2699
        
       			GET: async (req) => {

     

       1358
       2700
        
       				try {

     

       1359
       2701
        
       					requireAdmin(req);

     

       1360
       1360
       -
       					const users = getAllUsersWithStats();

     

       1361
       1361
       -
       					return Response.json(users);

     

       2702
       2702
       +
       					const url = new URL(req.url);

     

       2703
       2703
       +
       

     

       2704
       2704
       +
       					const limit = Math.min(

     

       2705
       2705
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2706
       2706
       +
       						100,

     

       2707
       2707
       +
       					);

     

       2708
       2708
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2709
       2709
       +
       

     

       2710
       2710
       +
       					const result = getAllUsersWithStats(limit, cursor);

     

       2711
       2711
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       1362
       2712
        
       				} catch (error) {

     

       1363
       2713
        
       					return handleError(error);

     

       1364
       2714
        
       				}

     
···

       1392
       2742
        
       					requireAdmin(req);

     

       1393
       2743
        
       					const id = req.params.id;

     

       1394
       2744
        
       					deleteWaitlistEntry(id);

     

       1395
       1395
       -
       					return Response.json({ success: true });

     

       2745
       2745
       +
       					return new Response(null, { status: 204 });

     

       1396
       2746
        
       				} catch (error) {

     

       1397
       2747
        
       					return handleError(error);

     

       1398
       2748
        
       				}

     
···

       1404
       2754
        
       					requireAdmin(req);

     

       1405
       2755
        
       					const transcriptionId = req.params.id;

     

       1406
       2756
        
       					deleteTranscription(transcriptionId);

     

       1407
       1407
       -
       					return Response.json({ success: true });

     

       2757
       2757
       +
       					return new Response(null, { status: 204 });

     

       1408
       2758
        
       				} catch (error) {

     

       1409
       2759
        
       					return handleError(error);

     

       1410
       2760
        
       				}

     
···

       1419
       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1420
       2770
        
       					}

     

       1421
       2771
        
       					await deleteUser(userId);

     

       1422
       1422
       -
       					return Response.json({ success: true });

     

       2772
       2772
       +
       					return new Response(null, { status: 204 });

     

       1423
       2773
        
       				} catch (error) {

     

       1424
       2774
        
       					return handleError(error);

     

       1425
       2775
        
       				}

     
···

       1504
       2854
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1505
       2855
        
       					}

     

       1506
       2856
        
       

     

       1507
       1507
       -
       					try {

     

       1508
       1508
       -
       						const { polar } = await import("./lib/polar");

     

       2857
       2857
       +
       					// Get user email

     

       2858
       2858
       +
       					const user = db

     

       2859
       2859
       +
       						.query<{ email: string }, [number]>(

     

       2860
       2860
       +
       							"SELECT email FROM users WHERE id = ?",

     

       2861
       2861
       +
       						)

     

       2862
       2862
       +
       						.get(userId);

     

       1509
       2863
        
       

     

       1510
       1510
       -
       						// Get user email

     

       1511
       1511
       -
       						const user = db

     

       1512
       1512
       -
       							.query<{ email: string }, [number]>(

     

       1513
       1513
       -
       								"SELECT email FROM users WHERE id = ?",

     

       1514
       1514
       -
       							)

     

       1515
       1515
       -
       							.get(userId);

     

       1516
       1516
       -
       

     

       1517
       1517
       -
       						if (!user) {

     

       1518
       1518
       -
       							return Response.json(

     

       1519
       1519
       -
       								{ error: "User not found" },

     

       1520
       1520
       -
       								{ status: 404 },

     

       1521
       1521
       -
       							);

     

       1522
       1522
       -
       						}

     

       1523
       1523
       -
       

     

       1524
       1524
       -
       						console.log(`[Admin] Looking for Polar customer with email: ${user.email}`);

     

       1525
       1525
       -
       

     

       1526
       1526
       -
       						// Search for customer by email

     

       1527
       1527
       -
       						const customers = await polar.customers.list({

     

       1528
       1528
       -
       							organizationId: process.env.POLAR_ORGANIZATION_ID,

     

       1529
       1529
       -
       							query: user.email,

     

       1530
       1530
       -
       						});

     

       1531
       1531
       -
       

     

       1532
       1532
       -
       						console.log(

     

       1533
       1533
       -
       							`[Admin] Found ${customers.result.items?.length || 0} customer(s) matching email`,

     

       1534
       1534
       -
       						);

     

       1535
       1535
       -
       

     

       1536
       1536
       -
       						if (!customers.result.items || customers.result.items.length === 0) {

     

       1537
       1537
       -
       							return Response.json(

     

       1538
       1538
       -
       								{ error: "No Polar customer found with this email" },

     

       1539
       1539
       -
       								{ status: 404 },

     

       1540
       1540
       -
       							);

     

       1541
       1541
       -
       						}

     

       1542
       1542
       -
       

     

       1543
       1543
       -
       						const customer = customers.result.items[0];

     

       1544
       1544
       -
       						console.log(`[Admin] Customer ID: ${customer.id}`);

     

       1545
       1545
       -
       

     

       1546
       1546
       -
       						// Get all subscriptions for this customer

     

       1547
       1547
       -
       						const subscriptions = await polar.subscriptions.list({

     

       1548
       1548
       -
       							customerId: customer.id,

     

       1549
       1549
       -
       						});

     

       1550
       1550
       -
       

     

       1551
       1551
       -
       						console.log(

     

       1552
       1552
       -
       							`[Admin] Found ${subscriptions.result.items?.length || 0} subscription(s) for customer`,

     

       1553
       1553
       -
       						);

     

       2864
       2864
       +
       					if (!user) {

     

       2865
       2865
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       2866
       2866
       +
       					}

     

       1554
       2867
        
       

     

       1555
       1555
       -
       						if (!subscriptions.result.items || subscriptions.result.items.length === 0) {

     

       1556
       1556
       -
       							return Response.json(

     

       1557
       1557
       -
       								{ error: "No subscriptions found for this customer" },

     

       1558
       1558
       -
       								{ status: 404 },

     

       1559
       1559
       -
       							);

     

       1560
       1560
       -
       						}

     

       1561
       1561
       -
       

     

       1562
       1562
       -
       						// Update each subscription in the database

     

       1563
       1563
       -
       						for (const subscription of subscriptions.result.items) {

     

       1564
       1564
       -
       							db.run(

     

       1565
       1565
       -
       								`INSERT INTO subscriptions (id, user_id, customer_id, status, current_period_start, current_period_end, cancel_at_period_end, canceled_at, updated_at)

     

       1566
       1566
       -
       								 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

     

       1567
       1567
       -
       								 ON CONFLICT(id) DO UPDATE SET

     

       1568
       1568
       -
       								   user_id = excluded.user_id,

     

       1569
       1569
       -
       								   status = excluded.status,

     

       1570
       1570
       -
       								   current_period_start = excluded.current_period_start,

     

       1571
       1571
       -
       								   current_period_end = excluded.current_period_end,

     

       1572
       1572
       -
       								   cancel_at_period_end = excluded.cancel_at_period_end,

     

       1573
       1573
       -
       								   canceled_at = excluded.canceled_at,

     

       1574
       1574
       -
       								   updated_at = excluded.updated_at`,

     

       1575
       1575
       -
       								[

     

       1576
       1576
       -
       									subscription.id,

     

       1577
       1577
       -
       									userId,

     

       1578
       1578
       -
       									subscription.customerId,

     

       1579
       1579
       -
       									subscription.status,

     

       1580
       1580
       -
       									subscription.currentPeriodStart

     

       1581
       1581
       -
       										? Math.floor(

     

       1582
       1582
       -
       												new Date(subscription.currentPeriodStart).getTime() /

     

       1583
       1583
       -
       													1000,

     

       1584
       1584
       -
       											)

     

       1585
       1585
       -
       										: null,

     

       1586
       1586
       -
       									subscription.currentPeriodEnd

     

       1587
       1587
       -
       										? Math.floor(

     

       1588
       1588
       -
       												new Date(subscription.currentPeriodEnd).getTime() /

     

       1589
       1589
       -
       													1000,

     

       1590
       1590
       -
       											)

     

       1591
       1591
       -
       										: null,

     

       1592
       1592
       -
       									subscription.cancelAtPeriodEnd ? 1 : 0,

     

       1593
       1593
       -
       									subscription.canceledAt

     

       1594
       1594
       -
       										? Math.floor(

     

       1595
       1595
       -
       												new Date(subscription.canceledAt).getTime() / 1000,

     

       1596
       1596
       -
       											)

     

       1597
       1597
       -
       										: null,

     

       1598
       1598
       -
       									Math.floor(Date.now() / 1000),

     

       1599
       1599
       -
       								],

     

       1600
       1600
       -
       							);

     

       1601
       1601
       -
       						}

     

       1602
       1602
       -
       

     

       1603
       1603
       -
       						console.log(

     

       1604
       1604
       -
       							`[Admin] Synced ${subscriptions.result.items.length} subscription(s) for user ${userId} (${user.email})`,

     

       1605
       1605
       -
       						);

     

       2868
       2868
       +
       					try {

     

       2869
       2869
       +
       						await syncUserSubscriptionsFromPolar(userId, user.email);

     

       1606
       2870
        
       						return Response.json({

     

       1607
       2871
        
       							success: true,

     

       1608
       2872
        
       							message: "Subscription synced successfully",

     
···

       1698
       2962
        
       				}

     

       1699
       2963
        
       			},

     

       1700
       2964
        
       		},

     

       1701
       1701
       -
       		"/api/admin/users/:id/password": {

     

       1702
       1702
       -
       			PUT: async (req) => {

     

       2965
       2965
       +
       		"/api/admin/users/:id/password-reset": {

     

       2966
       2966
       +
       			POST: async (req) => {

     

       1703
       2967
        
       				try {

     

       1704
       2968
        
       					requireAdmin(req);

     

       1705
       2969
        
       					const userId = Number.parseInt(req.params.id, 10);

     
···

       1707
       2971
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1708
       2972
        
       					}

     

       1709
       2973
        
       

     

       1710
       1710
       -
       					const body = await req.json();

     

       1711
       1711
       -
       					const { password } = body as { password: string };

     

       2974
       2974
       +
       					// Get user details

     

       2975
       2975
       +
       					const user = db

     

       2976
       2976
       +
       						.query<

     

       2977
       2977
       +
       							{ id: number; email: string; name: string | null },

     

       2978
       2978
       +
       							[number]

     

       2979
       2979
       +
       						>("SELECT id, email, name FROM users WHERE id = ?")

     

       2980
       2980
       +
       						.get(userId);

     

       1712
       2981
        
       

     

       1713
       1713
       -
       					if (!password || password.length < 8) {

     

       1714
       1714
       -
       						return Response.json(

     

       1715
       1715
       -
       							{ error: "Password must be at least 8 characters" },

     

       1716
       1716
       -
       							{ status: 400 },

     

       1717
       1717
       -
       						);

     

       2982
       2982
       +
       					if (!user) {

     

       2983
       2983
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       1718
       2984
        
       					}

     

       1719
       2985
        
       

     

       1720
       1720
       -
       					await updateUserPassword(userId, password);

     

       1721
       1721
       -
       					return Response.json({ success: true });

     

       2986
       2986
       +
       					// Create password reset token

     

       2987
       2987
       +
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       2988
       2988
       +
       					const resetToken = createPasswordResetToken(user.id);

     

       2989
       2989
       +
       					const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       2990
       2990
       +
       

     

       2991
       2991
       +
       					// Send password reset email

     

       2992
       2992
       +
       					await sendEmail({

     

       2993
       2993
       +
       						to: user.email,

     

       2994
       2994
       +
       						subject: "Reset your password - Thistle",

     

       2995
       2995
       +
       						html: passwordResetTemplate({

     

       2996
       2996
       +
       							name: user.name,

     

       2997
       2997
       +
       							resetLink,

     

       2998
       2998
       +
       						}),

     

       2999
       2999
       +
       					});

     

       3000
       3000
       +
       

     

       3001
       3001
       +
       					return Response.json({

     

       3002
       3002
       +
       						success: true,

     

       3003
       3003
       +
       						message: "Password reset email sent",

     

       3004
       3004
       +
       					});

     

       1722
       3005
        
       				} catch (error) {

     

       3006
       3006
       +
       					console.error("[Admin] Password reset error:", error);

     

       1723
       3007
        
       					return handleError(error);

     

       1724
       3008
        
       				}

     

       1725
       3009
        
       			},

     
···

       1735
       3019
        
       

     

       1736
       3020
        
       					const { passkeyId } = req.params;

     

       1737
       3021
        
       					deletePasskey(passkeyId, userId);

     

       1738
       1738
       -
       					return Response.json({ success: true });

     

       3022
       3022
       +
       					return new Response(null, { status: 204 });

     

       1739
       3023
        
       				} catch (error) {

     

       1740
       3024
        
       					return handleError(error);

     

       1741
       3025
        
       				}

     
···

       1753
       3037
        
       					const body = await req.json();

     

       1754
       3038
        
       					const { name } = body as { name: string };

     

       1755
       3039
        
       

     

       1756
       1756
       -
       					if (!name || name.trim().length === 0) {

     

       3040
       3040
       +
       					const nameValidation = validateName(name);

     

       3041
       3041
       +
       					if (!nameValidation.valid) {

     

       1757
       3042
        
       						return Response.json(

     

       1758
       1758
       -
       							{ error: "Name cannot be empty" },

     

       3043
       3043
       +
       							{ error: nameValidation.error },

     

       1759
       3044
        
       							{ status: 400 },

     

       1760
       3045
        
       						);

     

       1761
       3046
        
       					}

     
···

       1777
       3062
        
       					}

     

       1778
       3063
        
       

     

       1779
       3064
        
       					const body = await req.json();

     

       1780
       1780
       -
       					const { email } = body as { email: string };

     

       3065
       3065
       +
       					const { email, skipVerification } = body as {

     

       3066
       3066
       +
       						email: string;

     

       3067
       3067
       +
       						skipVerification?: boolean;

     

       3068
       3068
       +
       					};

     

       1781
       3069
        
       

     

       1782
       1782
       -
       					if (!email || !email.includes("@")) {

     

       3070
       3070
       +
       					const emailValidation = validateEmail(email);

     

       3071
       3071
       +
       					if (!emailValidation.valid) {

     

       1783
       3072
        
       						return Response.json(

     

       1784
       1784
       -
       							{ error: "Invalid email address" },

     

       3073
       3073
       +
       							{ error: emailValidation.error },

     

       1785
       3074
        
       							{ status: 400 },

     

       1786
       3075
        
       						);

     

       1787
       3076
        
       					}

     
···

       1796
       3085
        
       					if (existing) {

     

       1797
       3086
        
       						return Response.json(

     

       1798
       3087
        
       							{ error: "Email already in use" },

     

       1799
       1799
       -
       							{ status: 400 },

     

       3088
       3088
       +
       							{ status: 409 },

     

       1800
       3089
        
       						);

     

       1801
       3090
        
       					}

     

       1802
       3091
        
       

     

       1803
       1803
       -
       					updateUserEmailAddress(userId, email);

     

       1804
       1804
       -
       					return Response.json({ success: true });

     

       3092
       3092
       +
       					if (skipVerification) {

     

       3093
       3093
       +
       						// Admin override: change email immediately without verification

     

       3094
       3094
       +
       						updateUserEmailAddress(userId, email);

     

       3095
       3095
       +
       						return Response.json({

     

       3096
       3096
       +
       							success: true,

     

       3097
       3097
       +
       							message: "Email updated immediately (verification skipped)",

     

       3098
       3098
       +
       						});

     

       3099
       3099
       +
       					}

     

       3100
       3100
       +
       

     

       3101
       3101
       +
       					// Get user's current email

     

       3102
       3102
       +
       					const user = db

     

       3103
       3103
       +
       						.query<{ email: string; name: string | null }, [number]>(

     

       3104
       3104
       +
       							"SELECT email, name FROM users WHERE id = ?",

     

       3105
       3105
       +
       						)

     

       3106
       3106
       +
       						.get(userId);

     

       3107
       3107
       +
       

     

       3108
       3108
       +
       					if (!user) {

     

       3109
       3109
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3110
       3110
       +
       					}

     

       3111
       3111
       +
       

     

       3112
       3112
       +
       					// Send verification email to user's current email

     

       3113
       3113
       +
       					try {

     

       3114
       3114
       +
       						const token = createEmailChangeToken(userId, email);

     

       3115
       3115
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       3116
       3116
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       3117
       3117
       +
       

     

       3118
       3118
       +
       						await sendEmail({

     

       3119
       3119
       +
       							to: user.email,

     

       3120
       3120
       +
       							subject: "Verify your email change",

     

       3121
       3121
       +
       							html: emailChangeTemplate({

     

       3122
       3122
       +
       								name: user.name,

     

       3123
       3123
       +
       								currentEmail: user.email,

     

       3124
       3124
       +
       								newEmail: email,

     

       3125
       3125
       +
       								verifyLink: verifyUrl,

     

       3126
       3126
       +
       							}),

     

       3127
       3127
       +
       						});

     

       3128
       3128
       +
       

     

       3129
       3129
       +
       						return Response.json({

     

       3130
       3130
       +
       							success: true,

     

       3131
       3131
       +
       							message: `Verification email sent to ${user.email}`,

     

       3132
       3132
       +
       							pendingEmail: email,

     

       3133
       3133
       +
       						});

     

       3134
       3134
       +
       					} catch (emailError) {

     

       3135
       3135
       +
       						console.error(

     

       3136
       3136
       +
       							"[Admin] Failed to send email change verification:",

     

       3137
       3137
       +
       							emailError,

     

       3138
       3138
       +
       						);

     

       3139
       3139
       +
       						return Response.json(

     

       3140
       3140
       +
       							{ error: "Failed to send verification email" },

     

       3141
       3141
       +
       							{ status: 500 },

     

       3142
       3142
       +
       						);

     

       3143
       3143
       +
       					}

     

       1805
       3144
        
       				} catch (error) {

     

       1806
       3145
        
       					return handleError(error);

     

       1807
       3146
        
       				}

     
···

       1831
       3170
        
       					}

     

       1832
       3171
        
       

     

       1833
       3172
        
       					deleteAllUserSessions(userId);

     

       1834
       1834
       -
       					return Response.json({ success: true });

     

       3173
       3173
       +
       					return new Response(null, { status: 204 });

     

       1835
       3174
        
       				} catch (error) {

     

       1836
       3175
        
       					return handleError(error);

     

       1837
       3176
        
       				}

     
···

       1856
       3195
        
       						);

     

       1857
       3196
        
       					}

     

       1858
       3197
        
       

     

       1859
       1859
       -
       					return Response.json({ success: true });

     

       3198
       3198
       +
       					return new Response(null, { status: 204 });

     

       1860
       3199
        
       				} catch (error) {

     

       1861
       3200
        
       					return handleError(error);

     

       1862
       3201
        
       				}

     
···

       1918
       3257
        
       			GET: async (req) => {

     

       1919
       3258
        
       				try {

     

       1920
       3259
        
       					const user = requireAuth(req);

     

       1921
       1921
       -
       					const classes = getClassesForUser(user.id, user.role === "admin");

     

       3260
       3260
       +
       					const url = new URL(req.url);

     

       3261
       3261
       +
       

     

       3262
       3262
       +
       					const limit = Math.min(

     

       3263
       3263
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       3264
       3264
       +
       						100,

     

       3265
       3265
       +
       					);

     

       3266
       3266
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       3267
       3267
       +
       

     

       3268
       3268
       +
       					const result = getClassesForUser(

     

       3269
       3269
       +
       						user.id,

     

       3270
       3270
       +
       						user.role === "admin",

     

       3271
       3271
       +
       						limit,

     

       3272
       3272
       +
       						cursor,

     

       3273
       3273
       +
       					);

     

       1922
       3274
        
       

     

       1923
       1923
       -
       					// Group by semester/year

     

       3275
       3275
       +
       					// Group by semester/year for all users

     

       1924
       3276
        
       					const grouped: Record<

     

       1925
       3277
        
       						string,

     

       1926
       3278
        
       						Array<{

     
···

       1934
       3286
        
       						}>

     

       1935
       3287
        
       					> = {};

     

       1936
       3288
        
       

     

       1937
       1937
       -
       					for (const cls of classes) {

     

       3289
       3289
       +
       					for (const cls of result.data) {

     

       1938
       3290
        
       						const key = `${cls.semester} ${cls.year}`;

     

       1939
       3291
        
       						if (!grouped[key]) {

     

       1940
       3292
        
       							grouped[key] = [];

     
···

       1950
       3302
        
       						});

     

       1951
       3303
        
       					}

     

       1952
       3304
        
       

     

       1953
       1953
       -
       					return Response.json({ classes: grouped });

     

       3305
       3305
       +
       					return Response.json({

     

       3306
       3306
       +
       						classes: grouped,

     

       3307
       3307
       +
       						pagination: result.pagination,

     

       3308
       3308
       +
       					});

     

       1954
       3309
        
       				} catch (error) {

     

       1955
       3310
        
       					return handleError(error);

     

       1956
       3311
        
       				}

     
···

       1968
       3323
        
       						meeting_times,

     

       1969
       3324
        
       					} = body;

     

       1970
       3325
        
       

     

       1971
       1971
       -
       					if (!course_code || !name || !professor || !semester || !year) {

     

       3326
       3326
       +
       					// Validate all required fields

     

       3327
       3327
       +
       					const courseCodeValidation = validateCourseCode(course_code);

     

       3328
       3328
       +
       					if (!courseCodeValidation.valid) {

     

       3329
       3329
       +
       						return Response.json(

     

       3330
       3330
       +
       							{ error: courseCodeValidation.error },

     

       3331
       3331
       +
       							{ status: 400 },

     

       3332
       3332
       +
       						);

     

       3333
       3333
       +
       					}

     

       3334
       3334
       +
       

     

       3335
       3335
       +
       					const nameValidation = validateCourseName(name);

     

       3336
       3336
       +
       					if (!nameValidation.valid) {

     

       3337
       3337
       +
       						return Response.json(

     

       3338
       3338
       +
       							{ error: nameValidation.error },

     

       3339
       3339
       +
       							{ status: 400 },

     

       3340
       3340
       +
       						);

     

       3341
       3341
       +
       					}

     

       3342
       3342
       +
       

     

       3343
       3343
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3344
       3344
       +
       					if (!professorValidation.valid) {

     

       3345
       3345
       +
       						return Response.json(

     

       3346
       3346
       +
       							{ error: professorValidation.error },

     

       3347
       3347
       +
       							{ status: 400 },

     

       3348
       3348
       +
       						);

     

       3349
       3349
       +
       					}

     

       3350
       3350
       +
       

     

       3351
       3351
       +
       					const semesterValidation = validateSemester(semester);

     

       3352
       3352
       +
       					if (!semesterValidation.valid) {

     

       1972
       3353
        
       						return Response.json(

     

       1973
       1973
       -
       							{ error: "Missing required fields" },

     

       3354
       3354
       +
       							{ error: semesterValidation.error },

     

       3355
       3355
       +
       							{ status: 400 },

     

       3356
       3356
       +
       						);

     

       3357
       3357
       +
       					}

     

       3358
       3358
       +
       

     

       3359
       3359
       +
       					const yearValidation = validateYear(year);

     

       3360
       3360
       +
       					if (!yearValidation.valid) {

     

       3361
       3361
       +
       						return Response.json(

     

       3362
       3362
       +
       							{ error: yearValidation.error },

     

       1974
       3363
        
       							{ status: 400 },

     

       1975
       3364
        
       						);

     

       1976
       3365
        
       					}

     
···

       1982
       3371
        
       						semester,

     

       1983
       3372
        
       						year,

     

       1984
       3373
        
       						meeting_times,

     

       3374
       3374
       +
       						sections: body.sections,

     

       1985
       3375
        
       					});

     

       1986
       3376
        
       

     

       1987
       1987
       -
       					return Response.json(newClass);

     

       3377
       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       1988
       3378
        
       				} catch (error) {

     

       1989
       3379
        
       					return handleError(error);

     

       1990
       3380
        
       				}

     
···

       2011
       3401
        
       						.all(user.id)

     

       2012
       3402
        
       						.map((row) => row.class_id);

     

       2013
       3403
        
       

     

       2014
       2014
       -
       					// Add is_enrolled flag to each class

     

       3404
       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       2015
       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       2016
       3406
        
       						...cls,

     

       2017
       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       3408
       +
       						sections: getClassSections(cls.id),

     

       2018
       3409
        
       					}));

     

       2019
       3410
        
       

     

       2020
       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       2029
       3420
        
       					const user = requireAuth(req);

     

       2030
       3421
        
       					const body = await req.json();

     

       2031
       3422
        
       					const classId = body.class_id;

     

       3423
       3423
       +
       					const sectionId = body.section_id || null;

     

       2032
       3424
        
       

     

       2033
       2033
       -
       					if (!classId || typeof classId !== "string") {

     

       3425
       3425
       +
       					const classIdValidation = validateClassId(classId);

     

       3426
       3426
       +
       					if (!classIdValidation.valid) {

     

       2034
       3427
        
       						return Response.json(

     

       2035
       2035
       -
       							{ error: "Class ID required" },

     

       3428
       3428
       +
       							{ error: classIdValidation.error },

     

       2036
       3429
        
       							{ status: 400 },

     

       2037
       3430
        
       						);

     

       2038
       3431
        
       					}

     

       2039
       3432
        
       

     

       2040
       2040
       -
       					const result = joinClass(classId, user.id);

     

       3433
       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       2041
       3434
        
       

     

       2042
       3435
        
       					if (!result.success) {

     

       2043
       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       2044
       3437
        
       					}

     

       2045
       3438
        
       

     

       2046
       2046
       -
       					return Response.json({ success: true });

     

       3439
       3439
       +
       					return new Response(null, { status: 204 });

     

       2047
       3440
        
       				} catch (error) {

     

       2048
       3441
        
       					return handleError(error);

     

       2049
       3442
        
       				}

     
···

       2065
       3458
        
       						meetingTimes,

     

       2066
       3459
        
       					} = body;

     

       2067
       3460
        
       

     

       2068
       2068
       -
       					if (!courseCode || !courseName || !professor || !semester || !year) {

     

       3461
       3461
       +
       					// Validate all required fields

     

       3462
       3462
       +
       					const courseCodeValidation = validateCourseCode(courseCode);

     

       3463
       3463
       +
       					if (!courseCodeValidation.valid) {

     

       3464
       3464
       +
       						return Response.json(

     

       3465
       3465
       +
       							{ error: courseCodeValidation.error },

     

       3466
       3466
       +
       							{ status: 400 },

     

       3467
       3467
       +
       						);

     

       3468
       3468
       +
       					}

     

       3469
       3469
       +
       

     

       3470
       3470
       +
       					const nameValidation = validateCourseName(courseName);

     

       3471
       3471
       +
       					if (!nameValidation.valid) {

     

       3472
       3472
       +
       						return Response.json(

     

       3473
       3473
       +
       							{ error: nameValidation.error },

     

       3474
       3474
       +
       							{ status: 400 },

     

       3475
       3475
       +
       						);

     

       3476
       3476
       +
       					}

     

       3477
       3477
       +
       

     

       3478
       3478
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3479
       3479
       +
       					if (!professorValidation.valid) {

     

       2069
       3480
        
       						return Response.json(

     

       2070
       2070
       -
       							{ error: "Missing required fields" },

     

       3481
       3481
       +
       							{ error: professorValidation.error },

     

       3482
       3482
       +
       							{ status: 400 },

     

       3483
       3483
       +
       						);

     

       3484
       3484
       +
       					}

     

       3485
       3485
       +
       

     

       3486
       3486
       +
       					const semesterValidation = validateSemester(semester);

     

       3487
       3487
       +
       					if (!semesterValidation.valid) {

     

       3488
       3488
       +
       						return Response.json(

     

       3489
       3489
       +
       							{ error: semesterValidation.error },

     

       3490
       3490
       +
       							{ status: 400 },

     

       3491
       3491
       +
       						);

     

       3492
       3492
       +
       					}

     

       3493
       3493
       +
       

     

       3494
       3494
       +
       					const yearValidation = validateYear(

     

       3495
       3495
       +
       						typeof year === "string" ? Number.parseInt(year, 10) : year,

     

       3496
       3496
       +
       					);

     

       3497
       3497
       +
       					if (!yearValidation.valid) {

     

       3498
       3498
       +
       						return Response.json(

     

       3499
       3499
       +
       							{ error: yearValidation.error },

     

       2071
       3500
        
       							{ status: 400 },

     

       2072
       3501
        
       						);

     

       2073
       3502
        
       					}

     
···

       2083
       3512
        
       						meetingTimes || null,

     

       2084
       3513
        
       					);

     

       2085
       3514
        
       

     

       2086
       2086
       -
       					return Response.json({ success: true, id });

     

       3515
       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       2087
       3516
        
       				} catch (error) {

     

       2088
       3517
        
       					return handleError(error);

     

       2089
       3518
        
       				}

     
···

       2110
       3539
        
       					}

     

       2111
       3540
        
       

     

       2112
       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       3542
       +
       					const sections = getClassSections(classId);

     

       2113
       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       2114
       3545
        
       

     

       2115
       3546
        
       					return Response.json({

     

       2116
       3547
        
       						class: classInfo,

     

       2117
       3548
        
       						meetingTimes,

     

       3549
       3549
       +
       						sections,

     

       3550
       3550
       +
       						userSection,

     

       2118
       3551
        
       						transcriptions,

     

       2119
       3552
        
       					});

     

       2120
       3553
        
       				} catch (error) {

     
···

       2126
       3559
        
       					requireAdmin(req);

     

       2127
       3560
        
       					const classId = req.params.id;

     

       2128
       3561
        
       

     

       3562
       3562
       +
       					// Verify class exists

     

       3563
       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       3564
       +
       					if (!existingClass) {

     

       3565
       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       3566
       +
       					}

     

       3567
       3567
       +
       

     

       2129
       3568
        
       					deleteClass(classId);

     

       2130
       2130
       -
       					return Response.json({ success: true });

     

       3569
       3569
       +
       					return new Response(null, { status: 204 });

     

       2131
       3570
        
       				} catch (error) {

     

       2132
       3571
        
       					return handleError(error);

     

       2133
       3572
        
       				}

     
···

       2148
       3587
        
       						);

     

       2149
       3588
        
       					}

     

       2150
       3589
        
       

     

       3590
       3590
       +
       					// Verify class exists

     

       3591
       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       3592
       +
       					if (!existingClass) {

     

       3593
       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
       3594
       +
       					}

     

       3595
       3595
       +
       

     

       2151
       3596
        
       					toggleClassArchive(classId, archived);

     

       2152
       2152
       -
       					return Response.json({ success: true });

     

       3597
       3597
       +
       					return new Response(null, { status: 204 });

     

       2153
       3598
        
       				} catch (error) {

     

       2154
       3599
        
       					return handleError(error);

     

       2155
       3600
        
       				}

     
···

       2178
       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       2179
       3624
        
       					}

     

       2180
       3625
        
       

     

       3626
       3626
       +
       					// Verify class exists

     

       3627
       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       3628
       +
       					if (!existingClass) {

     

       3629
       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       3630
       +
       					}

     

       3631
       3631
       +
       

     

       2181
       3632
        
       					const user = getUserByEmail(email);

     

       2182
       3633
        
       					if (!user) {

     

       2183
       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       2184
       3635
        
       					}

     

       2185
       3636
        
       

     

       2186
       3637
        
       					enrollUserInClass(user.id, classId);

     

       2187
       2187
       -
       					return Response.json({ success: true });

     

       3638
       3638
       +
       					return new Response(null, { status: 201 });

     

       2188
       3639
        
       				} catch (error) {

     

       2189
       3640
        
       					return handleError(error);

     

       2190
       3641
        
       				}

     
···

       2201
       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2202
       3653
        
       					}

     

       2203
       3654
        
       

     

       3655
       3655
       +
       					// Verify class exists

     

       3656
       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       3657
       +
       					if (!existingClass) {

     

       3658
       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       3659
       +
       					}

     

       3660
       3660
       +
       

     

       2204
       3661
        
       					removeUserFromClass(userId, classId);

     

       2205
       2205
       -
       					return Response.json({ success: true });

     

       3662
       3662
       +
       					return new Response(null, { status: 204 });

     

       2206
       3663
        
       				} catch (error) {

     

       2207
       3664
        
       					return handleError(error);

     

       2208
       3665
        
       				}

     
···

       2240
       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2241
       3698
        
       					}

     

       2242
       3699
        
       

     

       3700
       3700
       +
       					// Verify class exists

     

       3701
       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       3702
       +
       					if (!existingClass) {

     

       3703
       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       3704
       +
       					}

     

       3705
       3705
       +
       

     

       2243
       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       2244
       2244
       -
       					return Response.json(meetingTime);

     

       3707
       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       3708
       +
       				} catch (error) {

     

       3709
       3709
       +
       					return handleError(error);

     

       3710
       3710
       +
       				}

     

       3711
       3711
       +
       			},

     

       3712
       3712
       +
       		},

     

       3713
       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       3714
       +
       			POST: async (req) => {

     

       3715
       3715
       +
       				try {

     

       3716
       3716
       +
       					requireAdmin(req);

     

       3717
       3717
       +
       					const classId = req.params.id;

     

       3718
       3718
       +
       					const body = await req.json();

     

       3719
       3719
       +
       					const { section_number } = body;

     

       3720
       3720
       +
       

     

       3721
       3721
       +
       					if (!section_number) {

     

       3722
       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       3723
       +
       					}

     

       3724
       3724
       +
       

     

       3725
       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       3726
       +
       					return Response.json(section);

     

       3727
       3727
       +
       				} catch (error) {

     

       3728
       3728
       +
       					return handleError(error);

     

       3729
       3729
       +
       				}

     

       3730
       3730
       +
       			},

     

       3731
       3731
       +
       		},

     

       3732
       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       3733
       +
       			DELETE: async (req) => {

     

       3734
       3734
       +
       				try {

     

       3735
       3735
       +
       					requireAdmin(req);

     

       3736
       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       3737
       +
       

     

       3738
       3738
       +
       					// Check if any students are in this section

     

       3739
       3739
       +
       					const studentsInSection = db

     

       3740
       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       3742
       +
       						)

     

       3743
       3743
       +
       						.get(sectionId);

     

       3744
       3744
       +
       

     

       3745
       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       3746
       +
       						return Response.json(

     

       3747
       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       3748
       +
       							{ status: 400 },

     

       3749
       3749
       +
       						);

     

       3750
       3750
       +
       					}

     

       3751
       3751
       +
       

     

       3752
       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       3753
       +
       					return new Response(null, { status: 204 });

     

       2245
       3754
        
       				} catch (error) {

     

       2246
       3755
        
       					return handleError(error);

     

       2247
       3756
        
       				}

     
···

       2259
       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2260
       3769
        
       					}

     

       2261
       3770
        
       

     

       3771
       3771
       +
       					// Verify meeting exists

     

       3772
       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       3773
       +
       					if (!existingMeeting) {

     

       3774
       3774
       +
       						return Response.json(

     

       3775
       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       3776
       +
       							{ status: 404 },

     

       3777
       3777
       +
       						);

     

       3778
       3778
       +
       					}

     

       3779
       3779
       +
       

     

       2262
       3780
        
       					updateMeetingTime(meetingId, label);

     

       2263
       2263
       -
       					return Response.json({ success: true });

     

       3781
       3781
       +
       					return new Response(null, { status: 204 });

     

       2264
       3782
        
       				} catch (error) {

     

       2265
       3783
        
       					return handleError(error);

     

       2266
       3784
        
       				}

     
···

       2270
       3788
        
       					requireAdmin(req);

     

       2271
       3789
        
       					const meetingId = req.params.id;

     

       2272
       3790
        
       

     

       3791
       3791
       +
       					// Verify meeting exists

     

       3792
       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       3793
       +
       					if (!existingMeeting) {

     

       3794
       3794
       +
       						return Response.json(

     

       3795
       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       3796
       +
       							{ status: 404 },

     

       3797
       3797
       +
       						);

     

       3798
       3798
       +
       					}

     

       3799
       3799
       +
       

     

       2273
       3800
        
       					deleteMeetingTime(meetingId);

     

       2274
       2274
       -
       					return Response.json({ success: true });

     

       3801
       3801
       +
       					return new Response(null, { status: 204 });

     

       2275
       3802
        
       				} catch (error) {

     

       2276
       3803
        
       					return handleError(error);

     

       2277
       3804
        
       				}

     
···

       2283
       3810
        
       					requireAdmin(req);

     

       2284
       3811
        
       					const transcriptId = req.params.id;

     

       2285
       3812
        
       

     

       2286
       2286
       -
       					// Update status to 'selected' and start transcription

     

       2287
       2287
       -
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     

       2288
       2288
       -
       						"selected",

     

       2289
       2289
       -
       						transcriptId,

     

       2290
       2290
       -
       					]);

     

       2291
       2291
       -
       

     

       2292
       2292
       -
       					// Get filename to start transcription

     

       3813
       3813
       +
       					// Check if transcription exists and get its current status

     

       2293
       3814
        
       					const transcription = db

     

       2294
       2294
       -
       						.query<{ filename: string }, [string]>(

     

       2295
       2295
       -
       							"SELECT filename FROM transcriptions WHERE id = ?",

     

       3815
       3815
       +
       						.query<{ filename: string; status: string }, [string]>(

     

       3816
       3816
       +
       							"SELECT filename, status FROM transcriptions WHERE id = ?",

     

       2296
       3817
        
       						)

     

       2297
       3818
        
       						.get(transcriptId);

     

       2298
       3819
        
       

     

       2299
       2299
       -
       					if (transcription) {

     

       2300
       2300
       -
       						whisperService.startTranscription(

     

       2301
       2301
       -
       							transcriptId,

     

       2302
       2302
       -
       							transcription.filename,

     

       3820
       3820
       +
       					if (!transcription) {

     

       3821
       3821
       +
       						return Response.json(

     

       3822
       3822
       +
       							{ error: "Transcription not found" },

     

       3823
       3823
       +
       							{ status: 404 },

     

       3824
       3824
       +
       						);

     

       3825
       3825
       +
       					}

     

       3826
       3826
       +
       

     

       3827
       3827
       +
       					// Validate that status is appropriate for selection (e.g., 'uploading' or 'pending')

     

       3828
       3828
       +
       					const validStatuses = ["uploading", "pending", "failed"];

     

       3829
       3829
       +
       					if (!validStatuses.includes(transcription.status)) {

     

       3830
       3830
       +
       						return Response.json(

     

       3831
       3831
       +
       							{

     

       3832
       3832
       +
       								error: `Cannot select transcription with status: ${transcription.status}`,

     

       3833
       3833
       +
       							},

     

       3834
       3834
       +
       							{ status: 400 },

     

       2303
       3835
        
       						);

     

       2304
       3836
        
       					}

     

       2305
       3837
        
       

     

       2306
       2306
       -
       					return Response.json({ success: true });

     

       3838
       3838
       +
       					// Update status to 'selected' and start transcription

     

       3839
       3839
       +
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     

       3840
       3840
       +
       						"selected",

     

       3841
       3841
       +
       						transcriptId,

     

       3842
       3842
       +
       					]);

     

       3843
       3843
       +
       

     

       3844
       3844
       +
       					whisperService.startTranscription(

     

       3845
       3845
       +
       						transcriptId,

     

       3846
       3846
       +
       						transcription.filename,

     

       3847
       3847
       +
       					);

     

       3848
       3848
       +
       

     

       3849
       3849
       +
       					return new Response(null, { status: 204 });

     

       2307
       3850
        
       				} catch (error) {

     

       2308
       3851
        
       					return handleError(error);

     

       2309
       3852
        
       				}

     

       2310
       3853
        
       			},

     

       2311
       3854
        
       		},

     

       2312
       3855
        
       	},

     

       2313
       2313
       -
       	development: {

     

       2314
       2314
       -
       		hmr: true,

     

       2315
       2315
       -
       		console: true,

     

       3856
       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       3857
       +
       	fetch(req, server) {

     

       3858
       3858
       +
       		const response = server.fetch(req);

     

       3859
       3859
       +
       

     

       3860
       3860
       +
       		// Add security headers to all responses

     

       3861
       3861
       +
       		if (response instanceof Response) {

     

       3862
       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       3867
       +
       

     

       3868
       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       3870
       +
       			headers.set(

     

       3871
       3871
       +
       				"Content-Security-Policy",

     

       3872
       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       3873
       +
       			);

     

       3874
       3874
       +
       

     

       3875
       3875
       +
       			return new Response(response.body, {

     

       3876
       3876
       +
       				status: response.status,

     

       3877
       3877
       +
       				statusText: response.statusText,

     

       3878
       3878
       +
       				headers,

     

       3879
       3879
       +
       			});

     

       3880
       3880
       +
       		}

     

       3881
       3881
       +
       

     

       3882
       3882
       +
       		return response;

     

       2316
       3883
        
       	},

     

       2317
       3884
        
       });

     

       2318
       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     

       3886
       3886
       +
       

     

       3887
       3887
       +
       // Track active SSE streams for graceful shutdown

     

       3888
       3888
       +
       const activeSSEStreams = new Set<ReadableStreamDefaultController>();

     

       3889
       3889
       +
       

     

       3890
       3890
       +
       // Graceful shutdown handler

     

       3891
       3891
       +
       let isShuttingDown = false;

     

       3892
       3892
       +
       

     

       3893
       3893
       +
       async function shutdown(signal: string) {

     

       3894
       3894
       +
       	if (isShuttingDown) return;

     

       3895
       3895
       +
       	isShuttingDown = true;

     

       3896
       3896
       +
       

     

       3897
       3897
       +
       	console.log(`\n${signal} received, starting graceful shutdown...`);

     

       3898
       3898
       +
       

     

       3899
       3899
       +
       	// 1. Stop accepting new requests

     

       3900
       3900
       +
       	console.log("[Shutdown] Closing server...");

     

       3901
       3901
       +
       	server.stop();

     

       3902
       3902
       +
       

     

       3903
       3903
       +
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3904
       3904
       +
       	console.log(

     

       3905
       3905
       +
       		`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`,

     

       3906
       3906
       +
       	);

     

       3907
       3907
       +
       	for (const controller of activeSSEStreams) {

     

       3908
       3908
       +
       		try {

     

       3909
       3909
       +
       			controller.close();

     

       3910
       3910
       +
       		} catch {

     

       3911
       3911
       +
       			// Already closed

     

       3912
       3912
       +
       		}

     

       3913
       3913
       +
       	}

     

       3914
       3914
       +
       	activeSSEStreams.clear();

     

       3915
       3915
       +
       

     

       3916
       3916
       +
       	// 3. Stop transcription service (closes streams to Murmur)

     

       3917
       3917
       +
       	whisperService.stop();

     

       3918
       3918
       +
       

     

       3919
       3919
       +
       	// 4. Stop cleanup intervals

     

       3920
       3920
       +
       	console.log("[Shutdown] Stopping cleanup intervals...");

     

       3921
       3921
       +
       	clearInterval(sessionCleanupInterval);

     

       3922
       3922
       +
       	clearInterval(syncInterval);

     

       3923
       3923
       +
       	clearInterval(fileCleanupInterval);

     

       3924
       3924
       +
       

     

       3925
       3925
       +
       	// 5. Close database connections

     

       3926
       3926
       +
       	console.log("[Shutdown] Closing database...");

     

       3927
       3927
       +
       	db.close();

     

       3928
       3928
       +
       

     

       3929
       3929
       +
       	console.log("[Shutdown] Complete");

     

       3930
       3930
       +
       	process.exit(0);

     

       3931
       3931
       +
       }

     

       3932
       3932
       +
       

     

       3933
       3933
       +
       // Register shutdown handlers

     

       3934
       3934
       +
       process.on("SIGTERM", () => shutdown("SIGTERM"));

     

       3935
       3935
       +
       process.on("SIGINT", () => shutdown("SIGINT"));

+136

src/lib/api-response-format.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * API Response Format Standards

     

       5
       5
       +
        *

     

       6
       6
       +
        * This test documents the standardized response formats across the API.

     

       7
       7
       +
        * All endpoints should follow these patterns for consistency.

     

       8
       8
       +
        */

     

       9
       9
       +
       

     

       10
       10
       +
       describe("API Response Format Standards", () => {

     

       11
       11
       +
       	test("success responses should include success: true", () => {

     

       12
       12
       +
       		// Success-only responses (no data returned)

     

       13
       13
       +
       		const successOnly = { success: true };

     

       14
       14
       +
       		expect(successOnly).toHaveProperty("success", true);

     

       15
       15
       +
       

     

       16
       16
       +
       		// Success with message

     

       17
       17
       +
       		const successWithMessage = {

     

       18
       18
       +
       			success: true,

     

       19
       19
       +
       			message: "Operation completed successfully",

     

       20
       20
       +
       		};

     

       21
       21
       +
       		expect(successWithMessage).toHaveProperty("success", true);

     

       22
       22
       +
       		expect(successWithMessage).toHaveProperty("message");

     

       23
       23
       +
       

     

       24
       24
       +
       		// Success with data

     

       25
       25
       +
       		const successWithData = {

     

       26
       26
       +
       			success: true,

     

       27
       27
       +
       			data: { id: 1, name: "Test" },

     

       28
       28
       +
       		};

     

       29
       29
       +
       		expect(successWithData).toHaveProperty("success", true);

     

       30
       30
       +
       		expect(successWithData).toHaveProperty("data");

     

       31
       31
       +
       	});

     

       32
       32
       +
       

     

       33
       33
       +
       	test("error responses should use error field", () => {

     

       34
       34
       +
       		const errorResponse = { error: "Something went wrong" };

     

       35
       35
       +
       		expect(errorResponse).toHaveProperty("error");

     

       36
       36
       +
       		expect(typeof errorResponse.error).toBe("string");

     

       37
       37
       +
       	});

     

       38
       38
       +
       

     

       39
       39
       +
       	test("data responses can return data directly", () => {

     

       40
       40
       +
       		// Direct data return (common pattern for GET endpoints)

     

       41
       41
       +
       		const userData = {

     

       42
       42
       +
       			user: { id: 1, email: "test@example.com" },

     

       43
       43
       +
       			has_subscription: true,

     

       44
       44
       +
       		};

     

       45
       45
       +
       		expect(userData).toHaveProperty("user");

     

       46
       46
       +
       

     

       47
       47
       +
       		// List responses

     

       48
       48
       +
       		const listData = {

     

       49
       49
       +
       			jobs: [{ id: "1" }, { id: "2" }],

     

       50
       50
       +
       			pagination: { limit: 50, hasMore: false, nextCursor: null },

     

       51
       51
       +
       		};

     

       52
       52
       +
       		expect(listData).toHaveProperty("jobs");

     

       53
       53
       +
       		expect(listData).toHaveProperty("pagination");

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("message-only responses are converted to success+message", () => {

     

       57
       57
       +
       		// OLD (deprecated): { message: "..." }

     

       58
       58
       +
       		// NEW (standard): { success: true, message: "..." }

     

       59
       59
       +
       

     

       60
       60
       +
       		const newFormat = {

     

       61
       61
       +
       			success: true,

     

       62
       62
       +
       			message: "Verification email sent",

     

       63
       63
       +
       		};

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(newFormat).toHaveProperty("success", true);

     

       66
       66
       +
       		expect(newFormat).toHaveProperty("message");

     

       67
       67
       +
       	});

     

       68
       68
       +
       });

     

       69
       69
       +
       

     

       70
       70
       +
       describe("API Response Patterns", () => {

     

       71
       71
       +
       	test("authentication responses", () => {

     

       72
       72
       +
       		// Login success

     

       73
       73
       +
       		const login = {

     

       74
       74
       +
       			user: { id: 1, email: "test@example.com" },

     

       75
       75
       +
       			email_verification_required: false,

     

       76
       76
       +
       		};

     

       77
       77
       +
       		expect(login).toHaveProperty("user");

     

       78
       78
       +
       

     

       79
       79
       +
       		// Logout success

     

       80
       80
       +
       		const logout = { success: true };

     

       81
       81
       +
       		expect(logout.success).toBe(true);

     

       82
       82
       +
       

     

       83
       83
       +
       		// Email verified

     

       84
       84
       +
       		const verified = {

     

       85
       85
       +
       			success: true,

     

       86
       86
       +
       			message: "Email verified successfully",

     

       87
       87
       +
       			email_verified: true,

     

       88
       88
       +
       			user: { id: 1, email: "test@example.com" },

     

       89
       89
       +
       		};

     

       90
       90
       +
       		expect(verified.success).toBe(true);

     

       91
       91
       +
       		expect(verified).toHaveProperty("message");

     

       92
       92
       +
       	});

     

       93
       93
       +
       

     

       94
       94
       +
       	test("CRUD operation responses", () => {

     

       95
       95
       +
       		// Create (returns created object)

     

       96
       96
       +
       		const created = {

     

       97
       97
       +
       			id: "123",

     

       98
       98
       +
       			name: "New Item",

     

       99
       99
       +
       			created_at: Date.now(),

     

       100
       100
       +
       		};

     

       101
       101
       +
       		expect(created).toHaveProperty("id");

     

       102
       102
       +
       

     

       103
       103
       +
       		// Update (returns success)

     

       104
       104
       +
       		const updated = { success: true };

     

       105
       105
       +
       		expect(updated.success).toBe(true);

     

       106
       106
       +
       

     

       107
       107
       +
       		// Delete (returns success)

     

       108
       108
       +
       		const deleted = { success: true };

     

       109
       109
       +
       		expect(deleted.success).toBe(true);

     

       110
       110
       +
       

     

       111
       111
       +
       		// Get (returns data directly)

     

       112
       112
       +
       		const fetched = {

     

       113
       113
       +
       			id: "123",

     

       114
       114
       +
       			name: "Item",

     

       115
       115
       +
       		};

     

       116
       116
       +
       		expect(fetched).toHaveProperty("id");

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("paginated list responses", () => {

     

       120
       120
       +
       		const paginatedList = {

     

       121
       121
       +
       			data: [{ id: "1" }, { id: "2" }],

     

       122
       122
       +
       			pagination: {

     

       123
       123
       +
       				limit: 50,

     

       124
       124
       +
       				hasMore: true,

     

       125
       125
       +
       				nextCursor: "MTczMjM5NjgwMHx0cmFucy0xMjM",

     

       126
       126
       +
       			},

     

       127
       127
       +
       		};

     

       128
       128
       +
       

     

       129
       129
       +
       		expect(paginatedList).toHaveProperty("data");

     

       130
       130
       +
       		expect(Array.isArray(paginatedList.data)).toBe(true);

     

       131
       131
       +
       		expect(paginatedList).toHaveProperty("pagination");

     

       132
       132
       +
       		expect(paginatedList.pagination).toHaveProperty("limit");

     

       133
       133
       +
       		expect(paginatedList.pagination).toHaveProperty("hasMore");

     

       134
       134
       +
       		expect(paginatedList.pagination).toHaveProperty("nextCursor");

     

       135
       135
       +
       	});

     

       136
       136
       +
       });

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       3
       +
       

     

       4
       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       6
       +
       

     

       7
       7
       +
       	// Clean up test file after tests

     

       8
       8
       +
       	afterAll(async () => {

     

       9
       9
       +
       		try {

     

       10
       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       11
       +
       				if (exists) {

     

       12
       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       13
       +
       				}

     

       14
       14
       +
       			});

     

       15
       15
       +
       		} catch {

     

       16
       16
       +
       			// Ignore cleanup errors

     

       17
       17
       +
       		}

     

       18
       18
       +
       	});

     

       19
       19
       +
       

     

       20
       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       24
       +
       

     

       25
       25
       +
       		// Create the file with metadata

     

       26
       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       27
       +
       

     

       28
       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       29
       +
       

     

       30
       30
       +
       		expect(date).not.toBeNull();

     

       31
       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       34
       +
       	});

     

       35
       35
       +
       

     

       36
       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       37
       +
       		// Create audio file without metadata

     

       38
       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       39
       +
       

     

       40
       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       41
       +
       

     

       42
       42
       +
       		// Should use file modification time as fallback

     

       43
       43
       +
       		expect(date).not.toBeNull();

     

       44
       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       45
       +
       		// Should be very recent (within last minute)

     

       46
       46
       +
       		const now = new Date();

     

       47
       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       49
       +
       	});

     

       50
       50
       +
       

     

       51
       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       53
       +
       		expect(date).toBeNull();

     

       54
       54
       +
       	});

     

       55
       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	findMatchingMeetingTime,

     

       4
       4
       +
       	getDayName,

     

       5
       5
       +
       	getDayOfWeek,

     

       6
       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       7
       +
       } from "./audio-metadata";

     

       8
       8
       +
       

     

       9
       9
       +
       describe("getDayOfWeek", () => {

     

       10
       10
       +
       	test("returns correct day number", () => {

     

       11
       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       14
       +
       

     

       15
       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       18
       +
       

     

       19
       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       22
       +
       	});

     

       23
       23
       +
       });

     

       24
       24
       +
       

     

       25
       25
       +
       describe("getDayName", () => {

     

       26
       26
       +
       	test("returns correct day name", () => {

     

       27
       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       34
       +
       	});

     

       35
       35
       +
       });

     

       36
       36
       +
       

     

       37
       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       38
       +
       	test("matches full day names", () => {

     

       39
       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       42
       +
       			true,

     

       43
       43
       +
       		);

     

       44
       44
       +
       	});

     

       45
       45
       +
       

     

       46
       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       50
       +
       			true,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       56
       +
       	});

     

       57
       57
       +
       

     

       58
       58
       +
       	test("is case insensitive", () => {

     

       59
       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       62
       +
       	});

     

       63
       63
       +
       

     

       64
       64
       +
       	test("does not match wrong days", () => {

     

       65
       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       68
       +
       	});

     

       69
       69
       +
       

     

       70
       70
       +
       	test("handles labels without day names", () => {

     

       71
       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       74
       +
       	});

     

       75
       75
       +
       });

     

       76
       76
       +
       

     

       77
       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       78
       +
       	const meetingTimes = [

     

       79
       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       82
       +
       	];

     

       83
       83
       +
       

     

       84
       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       87
       +
       

     

       88
       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       90
       +
       

     

       91
       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       93
       +
       	});

     

       94
       94
       +
       

     

       95
       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       96
       +
       		const abbrevMeetingTimes = [

     

       97
       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       100
       +
       		];

     

       101
       101
       +
       

     

       102
       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("returns null when no match found", () => {

     

       107
       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       109
       +
       

     

       110
       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       112
       +
       	});

     

       113
       113
       +
       

     

       114
       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       120
       +
       		const duplicateMeetingTimes = [

     

       121
       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       123
       +
       		];

     

       124
       124
       +
       

     

       125
       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       127
       +
       	});

     

       128
       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       1
       +
       import { $ } from "bun";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       6
       +
        * @param filePath Path to audio file

     

       7
       7
       +
        * @returns Date object or null if not found

     

       8
       8
       +
        */

     

       9
       9
       +
       export async function extractAudioCreationDate(

     

       10
       10
       +
       	filePath: string,

     

       11
       11
       +
       ): Promise<Date | null> {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       14
       +
       		// -v quiet: suppress verbose output

     

       15
       15
       +
       		// -print_format json: output as JSON

     

       16
       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       17
       +
       		const result =

     

       18
       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       19
       +
       

     

       20
       20
       +
       		const metadata = JSON.parse(result);

     

       21
       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       22
       +
       

     

       23
       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       24
       +
       		const dateFields = [

     

       25
       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       26
       +
       			tags.date, // Common date field

     

       27
       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       28
       +
       			tags.year, // Year field

     

       29
       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       33
       +
       		];

     

       34
       34
       +
       

     

       35
       35
       +
       		for (const dateField of dateFields) {

     

       36
       36
       +
       			if (dateField) {

     

       37
       37
       +
       				const date = new Date(dateField);

     

       38
       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       39
       +
       					console.log(

     

       40
       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       41
       +
       					);

     

       42
       42
       +
       					return date;

     

       43
       43
       +
       				}

     

       44
       44
       +
       			}

     

       45
       45
       +
       		}

     

       46
       46
       +
       

     

       47
       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       49
       +
       		console.log(

     

       50
       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		const file = Bun.file(filePath);

     

       53
       53
       +
       		const stat = await file.stat();

     

       54
       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       55
       +
       		console.log(

     

       56
       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       57
       +
       		);

     

       58
       58
       +
       		return date;

     

       59
       59
       +
       	} catch (error) {

     

       60
       60
       +
       		console.error(

     

       61
       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       63
       +
       		);

     

       64
       64
       +
       		return null;

     

       65
       65
       +
       	}

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       72
       +
       	return date.getDay();

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       /**

     

       76
       76
       +
        * Gets day name from a date

     

       77
       77
       +
        */

     

       78
       78
       +
       export function getDayName(date: Date): string {

     

       79
       79
       +
       	const days = [

     

       80
       80
       +
       		"Sunday",

     

       81
       81
       +
       		"Monday",

     

       82
       82
       +
       		"Tuesday",

     

       83
       83
       +
       		"Wednesday",

     

       84
       84
       +
       		"Thursday",

     

       85
       85
       +
       		"Friday",

     

       86
       86
       +
       		"Saturday",

     

       87
       87
       +
       	];

     

       88
       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       89
       +
       }

     

       90
       90
       +
       

     

       91
       91
       +
       /**

     

       92
       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       94
       +
        */

     

       95
       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       96
       +
       	label: string,

     

       97
       97
       +
       	dayName: string,

     

       98
       98
       +
       ): boolean {

     

       99
       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       101
       +
       

     

       102
       102
       +
       	// Check for full day name

     

       103
       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       104
       +
       		return true;

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	// Check for 3-letter abbreviations

     

       108
       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       110
       +
       		return true;

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	return false;

     

       114
       114
       +
       }

     

       115
       115
       +
       

     

       116
       116
       +
       /**

     

       117
       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       118
       +
        * @param date Date from audio metadata

     

       119
       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       121
       +
        */

     

       122
       122
       +
       export function findMatchingMeetingTime(

     

       123
       123
       +
       	date: Date,

     

       124
       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       125
       +
       ): string | null {

     

       126
       126
       +
       	const dayName = getDayName(date);

     

       127
       127
       +
       

     

       128
       128
       +
       	// Find meeting time that matches the day

     

       129
       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       131
       +
       	);

     

       132
       132
       +
       

     

       133
       133
       +
       	if (match) {

     

       134
       134
       +
       		console.log(

     

       135
       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       136
       +
       		);

     

       137
       137
       +
       		return match.id;

     

       138
       138
       +
       	}

     

       139
       139
       +
       

     

       140
       140
       +
       	console.log(

     

       141
       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       142
       +
       	);

     

       143
       143
       +
       	return null;

     

       144
       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
       130
        
       	};

     

       131
       131
        
       	expect(typeof result.count).toBe("number");

     

       132
       132
        
       });

     

       133
       133
       +
       

     

       134
       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       135
       +
       	const userId = 999;

     

       136
       136
       +
       

     

       137
       137
       +
       	// Clean up any existing sessions for this user

     

       138
       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       139
       +
       

     

       140
       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       141
       +
       	const sessionIds: string[] = [];

     

       142
       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       144
       +
       		sessionIds.push(sessionId);

     

       145
       145
       +
       	}

     

       146
       146
       +
       

     

       147
       147
       +
       	// Count total sessions for user

     

       148
       148
       +
       	const sessionCount = db

     

       149
       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       151
       +
       		)

     

       152
       152
       +
       		.get(userId);

     

       153
       153
       +
       

     

       154
       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       155
       +
       

     

       156
       156
       +
       	// First session should be deleted (oldest)

     

       157
       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       158
       +
       	expect(firstSession).toBeNull();

     

       159
       159
       +
       

     

       160
       160
       +
       	// Last session should exist (newest)

     

       161
       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       163
       +
       

     

       164
       164
       +
       	// Cleanup

     

       165
       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       166
       +
       });

+448 -67

src/lib/auth.ts

···

       1
       1
        
       import db from "../db/schema";

     

       2
       2
        
       

     

       3
       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       4
       5
        
       

     

       5
       6
        
       export type UserRole = "user" | "admin";

     

       6
       7
        
       

     
···

       30
       31
        
       ): string {

     

       31
       32
        
       	const sessionId = crypto.randomUUID();

     

       32
       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       34
       +
       

     

       35
       35
       +
       	// Check current session count for user

     

       36
       36
       +
       	const sessionCount = db

     

       37
       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       39
       +
       		)

     

       40
       40
       +
       		.get(userId);

     

       41
       41
       +
       

     

       42
       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       45
       +
       		db.run(

     

       46
       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       47
       +
       				SELECT id FROM sessions 

     

       48
       48
       +
       				WHERE user_id = ? 

     

       49
       49
       +
       				ORDER BY created_at ASC 

     

       50
       50
       +
       				LIMIT ?

     

       51
       51
       +
       			)`,

     

       52
       52
       +
       			[userId, sessionsToDelete],

     

       53
       53
       +
       		);

     

       54
       54
       +
       	}

     

       33
       55
        
       

     

       34
       56
        
       	db.run(

     

       35
       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       183
       205
        
       }

     

       184
       206
        
       

     

       185
       207
        
       export async function deleteUser(userId: number): Promise<void> {

     

       208
       208
       +
       	// Prevent deleting the ghost user

     

       209
       209
       +
       	if (userId === 0) {

     

       210
       210
       +
       		throw new Error("Cannot delete ghost user account");

     

       211
       211
       +
       	}

     

       212
       212
       +
       

     

       186
       213
        
       	// Get user's subscription if they have one

     

       187
       214
        
       	const subscription = db

     

       188
       188
       -
       		.query<{ id: string }, [number]>(

     

       189
       189
       -
       			"SELECT id FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       215
       215
       +
       		.query<

     

       216
       216
       +
       			{ id: string; status: string; cancel_at_period_end: number },

     

       217
       217
       +
       			[number]

     

       218
       218
       +
       		>(

     

       219
       219
       +
       			"SELECT id, status, cancel_at_period_end FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       190
       220
        
       		)

     

       191
       221
        
       		.get(userId);

     

       192
       222
        
       

     

       193
       193
       -
       	// Revoke subscription if it exists

     

       194
       194
       -
       	if (subscription) {

     

       223
       223
       +
       	// Cancel subscription if it exists and is not already canceled or scheduled to cancel

     

       224
       224
       +
       	if (

     

       225
       225
       +
       		subscription &&

     

       226
       226
       +
       		subscription.status !== "canceled" &&

     

       227
       227
       +
       		subscription.status !== "expired" &&

     

       228
       228
       +
       		!subscription.cancel_at_period_end

     

       229
       229
       +
       	) {

     

       195
       230
        
       		try {

     

       196
       231
        
       			const { polar } = await import("./polar");

     

       197
       197
       -
       			await polar.subscriptions.revoke({ id: subscription.id });

     

       232
       232
       +
       			await polar.subscriptions.update({

     

       233
       233
       +
       				id: subscription.id,

     

       234
       234
       +
       				subscriptionUpdate: { cancelAtPeriodEnd: true },

     

       235
       235
       +
       			});

     

       198
       236
        
       			console.log(

     

       199
       199
       -
       				`[User Delete] Revoked subscription ${subscription.id} for user ${userId}`,

     

       237
       237
       +
       				`[User Delete] Canceled subscription ${subscription.id} for user ${userId}`,

     

       200
       238
        
       			);

     

       201
       239
        
       		} catch (error) {

     

       202
       240
        
       			console.error(

     

       203
       203
       -
       				`[User Delete] Failed to revoke subscription ${subscription.id}:`,

     

       241
       241
       +
       				`[User Delete] Failed to cancel subscription ${subscription.id}:`,

     

       204
       242
        
       				error,

     

       205
       243
        
       			);

     

       206
       206
       -
       			// Continue with user deletion even if subscription revocation fails

     

       244
       244
       +
       			// Continue with user deletion even if subscription cancellation fails

     

       207
       245
        
       		}

     

       246
       246
       +
       	} else if (subscription) {

     

       247
       247
       +
       		console.log(

     

       248
       248
       +
       			`[User Delete] Skipping cancellation for subscription ${subscription.id} (status: ${subscription.status}, cancel_at_period_end: ${subscription.cancel_at_period_end})`,

     

       249
       249
       +
       		);

     

       208
       250
        
       	}

     

       209
       251
        
       

     

       252
       252
       +
       	// Reassign class transcriptions to ghost user (id=0)

     

       253
       253
       +
       	// Delete personal transcriptions (no class_id)

     

       254
       254
       +
       	db.run(

     

       255
       255
       +
       		"UPDATE transcriptions SET user_id = 0 WHERE user_id = ? AND class_id IS NOT NULL",

     

       256
       256
       +
       		[userId],

     

       257
       257
       +
       	);

     

       258
       258
       +
       	db.run("DELETE FROM transcriptions WHERE user_id = ? AND class_id IS NULL", [

     

       259
       259
       +
       		userId,

     

       260
       260
       +
       	]);

     

       261
       261
       +
       

     

       262
       262
       +
       	// Delete user (CASCADE will handle sessions, passkeys, subscriptions, class_members)

     

       210
       263
        
       	db.run("DELETE FROM users WHERE id = ?", [userId]);

     

       211
       264
        
       }

     

       212
       265
        
       

     
···

       233
       286
        
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       234
       287
        
       }

     

       235
       288
        
       

     

       289
       289
       +
       /**

     

       290
       290
       +
        * Email verification functions

     

       291
       291
       +
        */

     

       292
       292
       +
       

     

       293
       293
       +
       export function createEmailVerificationToken(userId: number): {

     

       294
       294
       +
       	code: string;

     

       295
       295
       +
       	token: string;

     

       296
       296
       +
       	sentAt: number;

     

       297
       297
       +
       } {

     

       298
       298
       +
       	// Generate a 6-digit code for user to enter

     

       299
       299
       +
       	const code = Math.floor(100000 + Math.random() * 900000).toString();

     

       300
       300
       +
       	const id = crypto.randomUUID();

     

       301
       301
       +
       	const token = crypto.randomUUID(); // Separate token for URL

     

       302
       302
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 24 * 60 * 60; // 24 hours

     

       303
       303
       +
       	const sentAt = Math.floor(Date.now() / 1000); // Timestamp when code is created

     

       304
       304
       +
       

     

       305
       305
       +
       	// Delete any existing tokens for this user

     

       306
       306
       +
       	db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       307
       307
       +
       

     

       308
       308
       +
       	// Store the code as the token field (for manual entry)

     

       309
       309
       +
       	db.run(

     

       310
       310
       +
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       311
       311
       +
       		[id, userId, code, expiresAt],

     

       312
       312
       +
       	);

     

       313
       313
       +
       

     

       314
       314
       +
       	// Store the URL token as a separate entry

     

       315
       315
       +
       	db.run(

     

       316
       316
       +
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       317
       317
       +
       		[crypto.randomUUID(), userId, token, expiresAt],

     

       318
       318
       +
       	);

     

       319
       319
       +
       

     

       320
       320
       +
       	return { code, token, sentAt };

     

       321
       321
       +
       }

     

       322
       322
       +
       

     

       323
       323
       +
       export function verifyEmailToken(

     

       324
       324
       +
       	token: string,

     

       325
       325
       +
       ): { userId: number; email: string } | null {

     

       326
       326
       +
       	const now = Math.floor(Date.now() / 1000);

     

       327
       327
       +
       

     

       328
       328
       +
       	const result = db

     

       329
       329
       +
       		.query<{ user_id: number; email: string }, [string, number]>(

     

       330
       330
       +
       			`SELECT evt.user_id, u.email 

     

       331
       331
       +
              FROM email_verification_tokens evt

     

       332
       332
       +
              JOIN users u ON evt.user_id = u.id

     

       333
       333
       +
              WHERE evt.token = ? AND evt.expires_at > ?`,

     

       334
       334
       +
       		)

     

       335
       335
       +
       		.get(token, now);

     

       336
       336
       +
       

     

       337
       337
       +
       	if (!result) return null;

     

       338
       338
       +
       

     

       339
       339
       +
       	// Mark email as verified

     

       340
       340
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [result.user_id]);

     

       341
       341
       +
       

     

       342
       342
       +
       	// Delete the token (one-time use)

     

       343
       343
       +
       	db.run("DELETE FROM email_verification_tokens WHERE token = ?", [token]);

     

       344
       344
       +
       

     

       345
       345
       +
       	return { userId: result.user_id, email: result.email };

     

       346
       346
       +
       }

     

       347
       347
       +
       

     

       348
       348
       +
       export function verifyEmailCode(userId: number, code: string): boolean {

     

       349
       349
       +
       	const now = Math.floor(Date.now() / 1000);

     

       350
       350
       +
       

     

       351
       351
       +
       	const result = db

     

       352
       352
       +
       		.query<{ user_id: number }, [number, string, number]>(

     

       353
       353
       +
       			`SELECT user_id 

     

       354
       354
       +
              FROM email_verification_tokens

     

       355
       355
       +
              WHERE user_id = ? AND token = ? AND expires_at > ?`,

     

       356
       356
       +
       		)

     

       357
       357
       +
       		.get(userId, code, now);

     

       358
       358
       +
       

     

       359
       359
       +
       	if (!result) return false;

     

       360
       360
       +
       

     

       361
       361
       +
       	// Mark email as verified

     

       362
       362
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       363
       363
       +
       

     

       364
       364
       +
       	// Delete the token (one-time use)

     

       365
       365
       +
       	db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       366
       366
       +
       

     

       367
       367
       +
       	return true;

     

       368
       368
       +
       }

     

       369
       369
       +
       

     

       370
       370
       +
       export function isEmailVerified(userId: number): boolean {

     

       371
       371
       +
       	const result = db

     

       372
       372
       +
       		.query<{ email_verified: number }, [number]>(

     

       373
       373
       +
       			"SELECT email_verified FROM users WHERE id = ?",

     

       374
       374
       +
       		)

     

       375
       375
       +
       		.get(userId);

     

       376
       376
       +
       

     

       377
       377
       +
       	return result?.email_verified === 1;

     

       378
       378
       +
       }

     

       379
       379
       +
       

     

       380
       380
       +
       export function getVerificationCodeSentAt(userId: number): number | null {

     

       381
       381
       +
       	const result = db

     

       382
       382
       +
       		.query<{ created_at: number }, [number]>(

     

       383
       383
       +
       			"SELECT MAX(created_at) as created_at FROM email_verification_tokens WHERE user_id = ?",

     

       384
       384
       +
       		)

     

       385
       385
       +
       		.get(userId);

     

       386
       386
       +
       

     

       387
       387
       +
       	return result?.created_at ?? null;

     

       388
       388
       +
       }

     

       389
       389
       +
       

     

       390
       390
       +
       /**

     

       391
       391
       +
        * Password reset functions

     

       392
       392
       +
        */

     

       393
       393
       +
       

     

       394
       394
       +
       export function createPasswordResetToken(userId: number): string {

     

       395
       395
       +
       	const token = crypto.randomUUID();

     

       396
       396
       +
       	const id = crypto.randomUUID();

     

       397
       397
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 60 * 60; // 1 hour

     

       398
       398
       +
       

     

       399
       399
       +
       	// Delete any existing tokens for this user

     

       400
       400
       +
       	db.run("DELETE FROM password_reset_tokens WHERE user_id = ?", [userId]);

     

       401
       401
       +
       

     

       402
       402
       +
       	db.run(

     

       403
       403
       +
       		"INSERT INTO password_reset_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       404
       404
       +
       		[id, userId, token, expiresAt],

     

       405
       405
       +
       	);

     

       406
       406
       +
       

     

       407
       407
       +
       	return token;

     

       408
       408
       +
       }

     

       409
       409
       +
       

     

       410
       410
       +
       export function verifyPasswordResetToken(token: string): number | null {

     

       411
       411
       +
       	const now = Math.floor(Date.now() / 1000);

     

       412
       412
       +
       

     

       413
       413
       +
       	const result = db

     

       414
       414
       +
       		.query<{ user_id: number }, [string, number]>(

     

       415
       415
       +
       			"SELECT user_id FROM password_reset_tokens WHERE token = ? AND expires_at > ?",

     

       416
       416
       +
       		)

     

       417
       417
       +
       		.get(token, now);

     

       418
       418
       +
       

     

       419
       419
       +
       	return result?.user_id ?? null;

     

       420
       420
       +
       }

     

       421
       421
       +
       

     

       422
       422
       +
       export function consumePasswordResetToken(token: string): void {

     

       423
       423
       +
       	db.run("DELETE FROM password_reset_tokens WHERE token = ?", [token]);

     

       424
       424
       +
       }

     

       425
       425
       +
       

     

       426
       426
       +
       /**

     

       427
       427
       +
        * Email change functions

     

       428
       428
       +
        */

     

       429
       429
       +
       

     

       430
       430
       +
       export function createEmailChangeToken(

     

       431
       431
       +
       	userId: number,

     

       432
       432
       +
       	newEmail: string,

     

       433
       433
       +
       ): string {

     

       434
       434
       +
       	const token = crypto.randomUUID();

     

       435
       435
       +
       	const id = crypto.randomUUID();

     

       436
       436
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 24 * 60 * 60; // 24 hours

     

       437
       437
       +
       

     

       438
       438
       +
       	// Delete any existing email change tokens for this user

     

       439
       439
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [userId]);

     

       440
       440
       +
       

     

       441
       441
       +
       	db.run(

     

       442
       442
       +
       		"INSERT INTO email_change_tokens (id, user_id, new_email, token, expires_at) VALUES (?, ?, ?, ?, ?)",

     

       443
       443
       +
       		[id, userId, newEmail, token, expiresAt],

     

       444
       444
       +
       	);

     

       445
       445
       +
       

     

       446
       446
       +
       	return token;

     

       447
       447
       +
       }

     

       448
       448
       +
       

     

       449
       449
       +
       export function verifyEmailChangeToken(

     

       450
       450
       +
       	token: string,

     

       451
       451
       +
       ): { userId: number; newEmail: string } | null {

     

       452
       452
       +
       	const now = Math.floor(Date.now() / 1000);

     

       453
       453
       +
       

     

       454
       454
       +
       	const result = db

     

       455
       455
       +
       		.query<{ user_id: number; new_email: string }, [string, number]>(

     

       456
       456
       +
       			"SELECT user_id, new_email FROM email_change_tokens WHERE token = ? AND expires_at > ?",

     

       457
       457
       +
       		)

     

       458
       458
       +
       		.get(token, now);

     

       459
       459
       +
       

     

       460
       460
       +
       	if (!result) return null;

     

       461
       461
       +
       

     

       462
       462
       +
       	return { userId: result.user_id, newEmail: result.new_email };

     

       463
       463
       +
       }

     

       464
       464
       +
       

     

       465
       465
       +
       export function consumeEmailChangeToken(token: string): void {

     

       466
       466
       +
       	db.run("DELETE FROM email_change_tokens WHERE token = ?", [token]);

     

       467
       467
       +
       }

     

       468
       468
       +
       

     

       236
       469
        
       export function isUserAdmin(userId: number): boolean {

     

       237
       470
        
       	const result = db

     

       238
       471
        
       		.query<{ role: UserRole }, [number]>("SELECT role FROM users WHERE id = ?")

     
···

       271
       504
        
       		.all();

     

       272
       505
        
       }

     

       273
       506
        
       

     

       274
       274
       -
       export function getAllTranscriptions(): Array<{

     

       275
       275
       -
       	id: string;

     

       276
       276
       -
       	user_id: number;

     

       277
       277
       -
       	user_email: string;

     

       278
       278
       -
       	user_name: string | null;

     

       279
       279
       -
       	original_filename: string;

     

       280
       280
       -
       	status: string;

     

       281
       281
       -
       	created_at: number;

     

       282
       282
       -
       	error_message: string | null;

     

       283
       283
       -
       }> {

     

       284
       284
       -
       	return db

     

       285
       285
       -
       		.query<

     

       286
       286
       -
       			{

     

       287
       287
       -
       				id: string;

     

       288
       288
       -
       				user_id: number;

     

       289
       289
       -
       				user_email: string;

     

       290
       290
       -
       				user_name: string | null;

     

       291
       291
       -
       				original_filename: string;

     

       292
       292
       -
       				status: string;

     

       293
       293
       -
       				created_at: number;

     

       294
       294
       -
       				error_message: string | null;

     

       295
       295
       -
       			},

     

       296
       296
       -
       			[]

     

       297
       297
       -
       		>(

     

       298
       298
       -
       			`SELECT 

     

       299
       299
       -
               t.id, 

     

       300
       300
       -
               t.user_id, 

     

       301
       301
       -
               u.email as user_email, 

     

       302
       302
       -
               u.name as user_name, 

     

       303
       303
       -
               t.original_filename, 

     

       304
       304
       -
               t.status, 

     

       305
       305
       -
               t.created_at,

     

       306
       306
       -
               t.error_message

     

       307
       307
       -
             FROM transcriptions t

     

       308
       308
       -
             LEFT JOIN users u ON t.user_id = u.id

     

       309
       309
       -
             ORDER BY t.created_at DESC`,

     

       310
       310
       -
       		)

     

       311
       311
       -
       		.all();

     

       507
       507
       +
       export function getAllTranscriptions(

     

       508
       508
       +
       	limit = 50,

     

       509
       509
       +
       	cursor?: string,

     

       510
       510
       +
       ): {

     

       511
       511
       +
       	data: Array<{

     

       512
       512
       +
       		id: string;

     

       513
       513
       +
       		user_id: number;

     

       514
       514
       +
       		user_email: string;

     

       515
       515
       +
       		user_name: string | null;

     

       516
       516
       +
       		original_filename: string;

     

       517
       517
       +
       		status: string;

     

       518
       518
       +
       		created_at: number;

     

       519
       519
       +
       		error_message: string | null;

     

       520
       520
       +
       	}>;

     

       521
       521
       +
       	pagination: {

     

       522
       522
       +
       		limit: number;

     

       523
       523
       +
       		hasMore: boolean;

     

       524
       524
       +
       		nextCursor: string | null;

     

       525
       525
       +
       	};

     

       526
       526
       +
       } {

     

       527
       527
       +
       	type TranscriptionRow = {

     

       528
       528
       +
       		id: string;

     

       529
       529
       +
       		user_id: number;

     

       530
       530
       +
       		user_email: string;

     

       531
       531
       +
       		user_name: string | null;

     

       532
       532
       +
       		original_filename: string;

     

       533
       533
       +
       		status: string;

     

       534
       534
       +
       		created_at: number;

     

       535
       535
       +
       		error_message: string | null;

     

       536
       536
       +
       	};

     

       537
       537
       +
       

     

       538
       538
       +
       	let transcriptions: TranscriptionRow[];

     

       539
       539
       +
       

     

       540
       540
       +
       	if (cursor) {

     

       541
       541
       +
       		const { decodeCursor } = require("./cursor");

     

       542
       542
       +
       		const parts = decodeCursor(cursor);

     

       543
       543
       +
       

     

       544
       544
       +
       		if (parts.length !== 2) {

     

       545
       545
       +
       			throw new Error("Invalid cursor format");

     

       546
       546
       +
       		}

     

       547
       547
       +
       

     

       548
       548
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       549
       549
       +
       		const id = parts[1] || "";

     

       550
       550
       +
       

     

       551
       551
       +
       		if (Number.isNaN(cursorTime) || !id) {

     

       552
       552
       +
       			throw new Error("Invalid cursor format");

     

       553
       553
       +
       		}

     

       554
       554
       +
       

     

       555
       555
       +
       		transcriptions = db

     

       556
       556
       +
       			.query<TranscriptionRow, [number, number, string, number]>(

     

       557
       557
       +
       				`SELECT 

     

       558
       558
       +
       					t.id, 

     

       559
       559
       +
       					t.user_id, 

     

       560
       560
       +
       					u.email as user_email, 

     

       561
       561
       +
       					u.name as user_name, 

     

       562
       562
       +
       					t.original_filename, 

     

       563
       563
       +
       					t.status, 

     

       564
       564
       +
       					t.created_at,

     

       565
       565
       +
       					t.error_message

     

       566
       566
       +
       				FROM transcriptions t

     

       567
       567
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       568
       568
       +
       				WHERE t.created_at < ? OR (t.created_at = ? AND t.id < ?)

     

       569
       569
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       570
       570
       +
       				LIMIT ?`,

     

       571
       571
       +
       			)

     

       572
       572
       +
       			.all(cursorTime, cursorTime, id, limit + 1);

     

       573
       573
       +
       	} else {

     

       574
       574
       +
       		transcriptions = db

     

       575
       575
       +
       			.query<TranscriptionRow, [number]>(

     

       576
       576
       +
       				`SELECT 

     

       577
       577
       +
       					t.id, 

     

       578
       578
       +
       					t.user_id, 

     

       579
       579
       +
       					u.email as user_email, 

     

       580
       580
       +
       					u.name as user_name, 

     

       581
       581
       +
       					t.original_filename, 

     

       582
       582
       +
       					t.status, 

     

       583
       583
       +
       					t.created_at,

     

       584
       584
       +
       					t.error_message

     

       585
       585
       +
       				FROM transcriptions t

     

       586
       586
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       587
       587
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       588
       588
       +
       				LIMIT ?`,

     

       589
       589
       +
       			)

     

       590
       590
       +
       			.all(limit + 1);

     

       591
       591
       +
       	}

     

       592
       592
       +
       

     

       593
       593
       +
       	const hasMore = transcriptions.length > limit;

     

       594
       594
       +
       	if (hasMore) {

     

       595
       595
       +
       		transcriptions.pop();

     

       596
       596
       +
       	}

     

       597
       597
       +
       

     

       598
       598
       +
       	let nextCursor: string | null = null;

     

       599
       599
       +
       	if (hasMore && transcriptions.length > 0) {

     

       600
       600
       +
       		const { encodeCursor } = require("./cursor");

     

       601
       601
       +
       		const last = transcriptions[transcriptions.length - 1];

     

       602
       602
       +
       		if (last) {

     

       603
       603
       +
       			nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       604
       604
       +
       		}

     

       605
       605
       +
       	}

     

       606
       606
       +
       

     

       607
       607
       +
       	return {

     

       608
       608
       +
       		data: transcriptions,

     

       609
       609
       +
       		pagination: {

     

       610
       610
       +
       			limit,

     

       611
       611
       +
       			hasMore,

     

       612
       612
       +
       			nextCursor,

     

       613
       613
       +
       		},

     

       614
       614
       +
       	};

     

       312
       615
        
       }

     

       313
       616
        
       

     

       314
       617
        
       export function deleteTranscription(transcriptionId: string): void {

     
···

       394
       697
        
       	subscription_id: string | null;

     

       395
       698
        
       }

     

       396
       699
        
       

     

       397
       397
       -
       export function getAllUsersWithStats(): UserWithStats[] {

     

       398
       398
       -
       	return db

     

       399
       399
       -
       		.query<UserWithStats, []>(

     

       400
       400
       -
       			`SELECT 

     

       401
       401
       -
               u.id, 

     

       402
       402
       -
               u.email, 

     

       403
       403
       -
               u.name, 

     

       404
       404
       -
               u.avatar, 

     

       405
       405
       -
               u.created_at, 

     

       406
       406
       -
               u.role,

     

       407
       407
       -
               u.last_login,

     

       408
       408
       -
               COUNT(DISTINCT t.id) as transcription_count,

     

       409
       409
       -
               s.status as subscription_status,

     

       410
       410
       -
               s.id as subscription_id

     

       411
       411
       -
             FROM users u

     

       412
       412
       -
             LEFT JOIN transcriptions t ON u.id = t.user_id

     

       413
       413
       -
             LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       414
       414
       -
             GROUP BY u.id

     

       415
       415
       -
             ORDER BY u.created_at DESC`,

     

       416
       416
       -
       		)

     

       417
       417
       -
       		.all();

     

       700
       700
       +
       export function getAllUsersWithStats(

     

       701
       701
       +
       	limit = 50,

     

       702
       702
       +
       	cursor?: string,

     

       703
       703
       +
       ): {

     

       704
       704
       +
       	data: UserWithStats[];

     

       705
       705
       +
       	pagination: {

     

       706
       706
       +
       		limit: number;

     

       707
       707
       +
       		hasMore: boolean;

     

       708
       708
       +
       		nextCursor: string | null;

     

       709
       709
       +
       	};

     

       710
       710
       +
       } {

     

       711
       711
       +
       	let users: UserWithStats[];

     

       712
       712
       +
       

     

       713
       713
       +
       	if (cursor) {

     

       714
       714
       +
       		const { decodeCursor } = require("./cursor");

     

       715
       715
       +
       		const parts = decodeCursor(cursor);

     

       716
       716
       +
       

     

       717
       717
       +
       		if (parts.length !== 2) {

     

       718
       718
       +
       			throw new Error("Invalid cursor format");

     

       719
       719
       +
       		}

     

       720
       720
       +
       

     

       721
       721
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       722
       722
       +
       		const cursorId = Number.parseInt(parts[1] || "", 10);

     

       723
       723
       +
       

     

       724
       724
       +
       		if (Number.isNaN(cursorTime) || Number.isNaN(cursorId)) {

     

       725
       725
       +
       			throw new Error("Invalid cursor format");

     

       726
       726
       +
       		}

     

       727
       727
       +
       

     

       728
       728
       +
       		users = db

     

       729
       729
       +
       			.query<UserWithStats, [number, number, number, number]>(

     

       730
       730
       +
       				`SELECT 

     

       731
       731
       +
       					u.id, 

     

       732
       732
       +
       					u.email, 

     

       733
       733
       +
       					u.name, 

     

       734
       734
       +
       					u.avatar, 

     

       735
       735
       +
       					u.created_at, 

     

       736
       736
       +
       					u.role,

     

       737
       737
       +
       					u.last_login,

     

       738
       738
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       739
       739
       +
       					s.status as subscription_status,

     

       740
       740
       +
       					s.id as subscription_id

     

       741
       741
       +
       				FROM users u

     

       742
       742
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       743
       743
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       744
       744
       +
       				WHERE u.created_at < ? OR (u.created_at = ? AND u.id < ?)

     

       745
       745
       +
       				GROUP BY u.id

     

       746
       746
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       747
       747
       +
       				LIMIT ?`,

     

       748
       748
       +
       			)

     

       749
       749
       +
       			.all(cursorTime, cursorTime, cursorId, limit + 1);

     

       750
       750
       +
       	} else {

     

       751
       751
       +
       		users = db

     

       752
       752
       +
       			.query<UserWithStats, [number]>(

     

       753
       753
       +
       				`SELECT 

     

       754
       754
       +
       					u.id, 

     

       755
       755
       +
       					u.email, 

     

       756
       756
       +
       					u.name, 

     

       757
       757
       +
       					u.avatar, 

     

       758
       758
       +
       					u.created_at, 

     

       759
       759
       +
       					u.role,

     

       760
       760
       +
       					u.last_login,

     

       761
       761
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       762
       762
       +
       					s.status as subscription_status,

     

       763
       763
       +
       					s.id as subscription_id

     

       764
       764
       +
       				FROM users u

     

       765
       765
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       766
       766
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       767
       767
       +
       				GROUP BY u.id

     

       768
       768
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       769
       769
       +
       				LIMIT ?`,

     

       770
       770
       +
       			)

     

       771
       771
       +
       			.all(limit + 1);

     

       772
       772
       +
       	}

     

       773
       773
       +
       

     

       774
       774
       +
       	const hasMore = users.length > limit;

     

       775
       775
       +
       	if (hasMore) {

     

       776
       776
       +
       		users.pop();

     

       777
       777
       +
       	}

     

       778
       778
       +
       

     

       779
       779
       +
       	let nextCursor: string | null = null;

     

       780
       780
       +
       	if (hasMore && users.length > 0) {

     

       781
       781
       +
       		const { encodeCursor } = require("./cursor");

     

       782
       782
       +
       		const last = users[users.length - 1];

     

       783
       783
       +
       		if (last) {

     

       784
       784
       +
       			nextCursor = encodeCursor([

     

       785
       785
       +
       				last.created_at.toString(),

     

       786
       786
       +
       				last.id.toString(),

     

       787
       787
       +
       			]);

     

       788
       788
       +
       		}

     

       789
       789
       +
       	}

     

       790
       790
       +
       

     

       791
       791
       +
       	return {

     

       792
       792
       +
       		data: users,

     

       793
       793
       +
       		pagination: {

     

       794
       794
       +
       			limit,

     

       795
       795
       +
       			hasMore,

     

       796
       796
       +
       			nextCursor,

     

       797
       797
       +
       		},

     

       798
       798
       +
       	};

     

       418
       799
        
       }

+7 -7

src/lib/classes.test.ts

···

       129
       129
        
       	enrollUserInClass(userId, cls1.id);

     

       130
       130
        
       

     

       131
       131
        
       	// Get classes for user (non-admin)

     

       132
       132
       -
       	const classes = getClassesForUser(userId, false);

     

       133
       133
       -
       	expect(classes.length).toBe(1);

     

       134
       134
       -
       	expect(classes[0]?.id).toBe(cls1.id);

     

       132
       132
       +
       	const classesResult = getClassesForUser(userId, false);

     

       133
       133
       +
       	expect(classesResult.data.length).toBe(1);

     

       134
       134
       +
       	expect(classesResult.data[0]?.id).toBe(cls1.id);

     

       135
       135
        
       

     

       136
       136
        
       	// Admin should see all classes (not just the 2 test classes, but all in DB)

     

       137
       137
       -
       	const allClasses = getClassesForUser(userId, true);

     

       138
       138
       -
       	expect(allClasses.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       -
       	expect(allClasses.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       -
       	expect(allClasses.some((c) => c.id === cls2.id)).toBe(true);

     

       137
       137
       +
       	const allClassesResult = getClassesForUser(userId, true);

     

       138
       138
       +
       	expect(allClassesResult.data.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       +
       	expect(allClassesResult.data.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       +
       	expect(allClassesResult.data.some((c) => c.id === cls2.id)).toBe(true);

     

       141
       141
        
       

     

       142
       142
        
       	// Cleanup enrollment

     

       143
       143
        
       	removeUserFromClass(userId, cls1.id);

+248 -22

src/lib/classes.ts

···

       9
       9
        
       	semester: string;

     

       10
       10
        
       	year: number;

     

       11
       11
        
       	archived: boolean;

     

       12
       12
       +
       	section_number?: string | null;

     

       13
       13
       +
       	created_at: number;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       export interface ClassSection {

     

       17
       17
       +
       	id: string;

     

       18
       18
       +
       	class_id: string;

     

       19
       19
       +
       	section_number: string;

     

       12
       20
        
       	created_at: number;

     

       13
       21
        
       }

     

       14
       22
        
       

     
···

       22
       30
        
       export interface ClassMember {

     

       23
       31
        
       	class_id: string;

     

       24
       32
        
       	user_id: number;

     

       33
       33
       +
       	section_id: string | null;

     

       25
       34
        
       	enrolled_at: number;

     

       26
       35
        
       }

     

       27
       36
        
       

     

       37
       37
       +
       export interface ClassWithStats extends Class {

     

       38
       38
       +
       	student_count?: number;

     

       39
       39
       +
       	transcript_count?: number;

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       28
       42
        
       /**

     

       29
       43
        
        * Get all classes for a user (either enrolled or admin sees all)

     

       30
       44
        
        */

     

       31
       31
       -
       export function getClassesForUser(userId: number, isAdmin: boolean): Class[] {

     

       45
       45
       +
       export function getClassesForUser(

     

       46
       46
       +
       	userId: number,

     

       47
       47
       +
       	isAdmin: boolean,

     

       48
       48
       +
       	limit = 50,

     

       49
       49
       +
       	cursor?: string,

     

       50
       50
       +
       ): {

     

       51
       51
       +
       	data: ClassWithStats[];

     

       52
       52
       +
       	pagination: {

     

       53
       53
       +
       		limit: number;

     

       54
       54
       +
       		hasMore: boolean;

     

       55
       55
       +
       		nextCursor: string | null;

     

       56
       56
       +
       	};

     

       57
       57
       +
       } {

     

       58
       58
       +
       	let classes: ClassWithStats[];

     

       59
       59
       +
       

     

       32
       60
        
       	if (isAdmin) {

     

       33
       33
       -
       		return db

     

       34
       34
       -
       			.query<Class, []>(

     

       35
       35
       -
       				"SELECT * FROM classes ORDER BY year DESC, semester DESC, course_code ASC",

     

       36
       36
       -
       			)

     

       37
       37
       -
       			.all();

     

       61
       61
       +
       		if (cursor) {

     

       62
       62
       +
       			const { decodeClassCursor } = require("./cursor");

     

       63
       63
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       			classes = db

     

       66
       66
       +
       				.query<ClassWithStats, [number, string, string, string, number]>(

     

       67
       67
       +
       					`SELECT 

     

       68
       68
       +
       						c.*,

     

       69
       69
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       70
       70
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       71
       71
       +
       					FROM classes c 

     

       72
       72
       +
       					WHERE (c.year < ? OR 

     

       73
       73
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       74
       74
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       75
       75
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       76
       76
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       77
       77
       +
       					LIMIT ?`,

     

       78
       78
       +
       				)

     

       79
       79
       +
       				.all(

     

       80
       80
       +
       					year,

     

       81
       81
       +
       					year,

     

       82
       82
       +
       					semester,

     

       83
       83
       +
       					year,

     

       84
       84
       +
       					semester,

     

       85
       85
       +
       					courseCode,

     

       86
       86
       +
       					year,

     

       87
       87
       +
       					semester,

     

       88
       88
       +
       					courseCode,

     

       89
       89
       +
       					id,

     

       90
       90
       +
       					limit + 1,

     

       91
       91
       +
       				);

     

       92
       92
       +
       		} else {

     

       93
       93
       +
       			classes = db

     

       94
       94
       +
       				.query<ClassWithStats, [number]>(

     

       95
       95
       +
       					`SELECT 

     

       96
       96
       +
       						c.*,

     

       97
       97
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       98
       98
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       99
       99
       +
       					FROM classes c 

     

       100
       100
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       101
       101
       +
       					LIMIT ?`,

     

       102
       102
       +
       				)

     

       103
       103
       +
       				.all(limit + 1);

     

       104
       104
       +
       		}

     

       105
       105
       +
       	} else {

     

       106
       106
       +
       		if (cursor) {

     

       107
       107
       +
       			const { decodeClassCursor } = require("./cursor");

     

       108
       108
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       109
       109
       +
       

     

       110
       110
       +
       			classes = db

     

       111
       111
       +
       				.query<

     

       112
       112
       +
       					ClassWithStats,

     

       113
       113
       +
       					[number, number, string, string, string, number]

     

       114
       114
       +
       				>(

     

       115
       115
       +
       					`SELECT c.* FROM classes c

     

       116
       116
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       117
       117
       +
       					WHERE cm.user_id = ? AND 

     

       118
       118
       +
       						(c.year < ? OR 

     

       119
       119
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       120
       120
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       121
       121
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       122
       122
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       123
       123
       +
       					LIMIT ?`,

     

       124
       124
       +
       				)

     

       125
       125
       +
       				.all(

     

       126
       126
       +
       					userId,

     

       127
       127
       +
       					year,

     

       128
       128
       +
       					year,

     

       129
       129
       +
       					semester,

     

       130
       130
       +
       					year,

     

       131
       131
       +
       					semester,

     

       132
       132
       +
       					courseCode,

     

       133
       133
       +
       					year,

     

       134
       134
       +
       					semester,

     

       135
       135
       +
       					courseCode,

     

       136
       136
       +
       					id,

     

       137
       137
       +
       					limit + 1,

     

       138
       138
       +
       				);

     

       139
       139
       +
       		} else {

     

       140
       140
       +
       			classes = db

     

       141
       141
       +
       				.query<ClassWithStats, [number, number]>(

     

       142
       142
       +
       					`SELECT c.* FROM classes c

     

       143
       143
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       144
       144
       +
       					WHERE cm.user_id = ?

     

       145
       145
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       146
       146
       +
       					LIMIT ?`,

     

       147
       147
       +
       				)

     

       148
       148
       +
       				.all(userId, limit + 1);

     

       149
       149
       +
       		}

     

       38
       150
        
       	}

     

       39
       151
        
       

     

       40
       40
       -
       	return db

     

       41
       41
       -
       		.query<Class, [number]>(

     

       42
       42
       -
       			`SELECT c.* FROM classes c

     

       43
       43
       -
              INNER JOIN class_members cm ON c.id = cm.class_id

     

       44
       44
       -
              WHERE cm.user_id = ?

     

       45
       45
       -
              ORDER BY c.year DESC, c.semester DESC, c.course_code ASC`,

     

       46
       46
       -
       		)

     

       47
       47
       -
       		.all(userId);

     

       152
       152
       +
       	const hasMore = classes.length > limit;

     

       153
       153
       +
       	if (hasMore) {

     

       154
       154
       +
       		classes.pop();

     

       155
       155
       +
       	}

     

       156
       156
       +
       

     

       157
       157
       +
       	let nextCursor: string | null = null;

     

       158
       158
       +
       	if (hasMore && classes.length > 0) {

     

       159
       159
       +
       		const { encodeClassCursor } = require("./cursor");

     

       160
       160
       +
       		const last = classes[classes.length - 1];

     

       161
       161
       +
       		if (last) {

     

       162
       162
       +
       			nextCursor = encodeClassCursor(

     

       163
       163
       +
       				last.year,

     

       164
       164
       +
       				last.semester,

     

       165
       165
       +
       				last.course_code,

     

       166
       166
       +
       				last.id,

     

       167
       167
       +
       			);

     

       168
       168
       +
       		}

     

       169
       169
       +
       	}

     

       170
       170
       +
       

     

       171
       171
       +
       	return {

     

       172
       172
       +
       		data: classes,

     

       173
       173
       +
       		pagination: {

     

       174
       174
       +
       			limit,

     

       175
       175
       +
       			hasMore,

     

       176
       176
       +
       			nextCursor,

     

       177
       177
       +
       		},

     

       178
       178
       +
       	};

     

       48
       179
        
       }

     

       49
       180
        
       

     

       50
       181
        
       /**

     
···

       82
       213
        
       	semester: string;

     

       83
       214
        
       	year: number;

     

       84
       215
        
       	meeting_times?: string[];

     

       216
       216
       +
       	sections?: string[];

     

       85
       217
        
       }): Class {

     

       86
       218
        
       	const id = nanoid();

     

       87
       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       106
       238
        
       		}

     

       107
       239
        
       	}

     

       108
       240
        
       

     

       241
       241
       +
       	// Create sections if provided

     

       242
       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       244
       +
       			createClassSection(id, sectionNumber);

     

       245
       245
       +
       		}

     

       246
       246
       +
       	}

     

       247
       247
       +
       

     

       109
       248
        
       	return {

     

       110
       249
        
       		id,

     

       111
       250
        
       		course_code: data.course_code,

     
···

       122
       261
        
        * Archive or unarchive a class

     

       123
       262
        
        */

     

       124
       263
        
       export function toggleClassArchive(classId: string, archived: boolean): void {

     

       125
       125
       -
       	db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       264
       264
       +
       	const result = db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       126
       265
        
       		archived ? 1 : 0,

     

       127
       266
        
       		classId,

     

       128
       267
        
       	]);

     

       268
       268
       +
       

     

       269
       269
       +
       	if (result.changes === 0) {

     

       270
       270
       +
       		throw new Error("Class not found");

     

       271
       271
       +
       	}

     

       129
       272
        
       }

     

       130
       273
        
       

     

       131
       274
        
       /**

     
···

       138
       281
        
       /**

     

       139
       282
        
        * Enroll a user in a class

     

       140
       283
        
        */

     

       141
       141
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       284
       284
       +
       export function enrollUserInClass(

     

       285
       285
       +
       	userId: number,

     

       286
       286
       +
       	classId: string,

     

       287
       287
       +
       	sectionId?: string | null,

     

       288
       288
       +
       ): void {

     

       142
       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       143
       290
        
       	db.run(

     

       144
       144
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       145
       145
       -
       		[classId, userId, now],

     

       291
       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       146
       293
        
       	);

     

       147
       294
        
       }

     

       148
       295
        
       

     
···

       212
       359
        
       }

     

       213
       360
        
       

     

       214
       361
        
       /**

     

       362
       362
       +
        * Get a single meeting time by ID

     

       363
       363
       +
        */

     

       364
       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       365
       +
       	const result = db

     

       366
       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       367
       +
       		.get(meetingId);

     

       368
       368
       +
       	return result ?? null;

     

       369
       369
       +
       }

     

       370
       370
       +
       

     

       371
       371
       +
       /**

     

       215
       372
        
        * Update a meeting time label

     

       216
       373
        
        */

     

       217
       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       235
       392
        
       				id: string;

     

       236
       393
        
       				user_id: number;

     

       237
       394
        
       				meeting_time_id: string | null;

     

       395
       395
       +
       				section_id: string | null;

     

       238
       396
        
       				filename: string;

     

       239
       397
        
       				original_filename: string;

     

       240
       398
        
       				status: string;

     
···

       245
       403
        
       			},

     

       246
       404
        
       			[string]

     

       247
       405
        
       		>(

     

       248
       248
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       406
       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       249
       407
        
              FROM transcriptions

     

       250
       408
        
              WHERE class_id = ?

     

       251
       251
       -
              ORDER BY created_at DESC`,

     

       409
       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       252
       410
        
       		)

     

       253
       411
        
       		.all(classId);

     

       254
       412
        
       }

     
···

       273
       431
        
       export function joinClass(

     

       274
       432
        
       	classId: string,

     

       275
       433
        
       	userId: number,

     

       434
       434
       +
       	sectionId?: string | null,

     

       276
       435
        
       ): { success: boolean; error?: string } {

     

       277
       436
        
       	// Find class by ID

     

       278
       437
        
       	const cls = db

     
···

       298
       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       299
       458
        
       	}

     

       300
       459
        
       

     

       460
       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       461
       +
       	const sections = getClassSections(classId);

     

       462
       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       464
       +
       	}

     

       465
       465
       +
       

     

       466
       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       467
       +
       	if (sectionId) {

     

       468
       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       469
       +
       		if (!section) {

     

       470
       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       471
       +
       		}

     

       472
       472
       +
       	}

     

       473
       473
       +
       

     

       301
       474
        
       	// Enroll user

     

       302
       475
        
       	db.query(

     

       303
       303
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       304
       304
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       476
       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       305
       478
        
       

     

       306
       479
        
       	return { success: true };

     

       480
       480
       +
       }

     

       481
       481
       +
       

     

       482
       482
       +
       /**

     

       483
       483
       +
        * Create a section for a class

     

       484
       484
       +
        */

     

       485
       485
       +
       export function createClassSection(

     

       486
       486
       +
       	classId: string,

     

       487
       487
       +
       	sectionNumber: string,

     

       488
       488
       +
       ): ClassSection {

     

       489
       489
       +
       	const id = nanoid();

     

       490
       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       491
       +
       

     

       492
       492
       +
       	db.run(

     

       493
       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       495
       +
       	);

     

       496
       496
       +
       

     

       497
       497
       +
       	return {

     

       498
       498
       +
       		id,

     

       499
       499
       +
       		class_id: classId,

     

       500
       500
       +
       		section_number: sectionNumber,

     

       501
       501
       +
       		created_at: now,

     

       502
       502
       +
       	};

     

       503
       503
       +
       }

     

       504
       504
       +
       

     

       505
       505
       +
       /**

     

       506
       506
       +
        * Get all sections for a class

     

       507
       507
       +
        */

     

       508
       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       509
       +
       	return db

     

       510
       510
       +
       		.query<ClassSection, [string]>(

     

       511
       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       512
       +
       		)

     

       513
       513
       +
       		.all(classId);

     

       514
       514
       +
       }

     

       515
       515
       +
       

     

       516
       516
       +
       /**

     

       517
       517
       +
        * Delete a class section

     

       518
       518
       +
        */

     

       519
       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       521
       +
       }

     

       522
       522
       +
       

     

       523
       523
       +
       /**

     

       524
       524
       +
        * Get user's enrolled section for a class

     

       525
       525
       +
        */

     

       526
       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       527
       +
       	const result = db

     

       528
       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       530
       +
       		)

     

       531
       531
       +
       		.get(classId, userId);

     

       532
       532
       +
       	return result?.section_id ?? null;

     

       307
       533
        
       }

     

       308
       534
        
       

     

       309
       535
        
       /**

-1

src/lib/client-auth.ts

···

       66
       66
        
       	const hashArray = Array.from(hashBuffer);

     

       67
       67
        
       	return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");

     

       68
       68
        
       }

     

       69
       69
       -

+1 -2

src/lib/crypto-fallback.ts

···

       23
       23
        
       

     

       24
       24
        
       	const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n));

     

       25
       25
        
       	const ch = (x: number, y: number, z: number) => (x & y) ^ (~x & z);

     

       26
       26
       -
       	const maj = (x: number, y: number, z: number) =>

     

       27
       27
       -
       		(x & y) ^ (x & z) ^ (y & z);

     

       26
       26
       +
       	const maj = (x: number, y: number, z: number) => (x & y) ^ (x & z) ^ (y & z);

     

       28
       27
        
       	const s0 = (x: number) => rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);

     

       29
       28
        
       	const s1 = (x: number) => rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);

     

       30
       29
        
       	const g0 = (x: number) => rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3);

+117

src/lib/cursor.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	decodeClassCursor,

     

       4
       4
       +
       	decodeCursor,

     

       5
       5
       +
       	decodeSimpleCursor,

     

       6
       6
       +
       	encodeClassCursor,

     

       7
       7
       +
       	encodeCursor,

     

       8
       8
       +
       	encodeSimpleCursor,

     

       9
       9
       +
       } from "./cursor";

     

       10
       10
       +
       

     

       11
       11
       +
       describe("Cursor encoding/decoding", () => {

     

       12
       12
       +
       	test("encodeCursor creates base64url string", () => {

     

       13
       13
       +
       		const cursor = encodeCursor(["1732396800", "trans-123"]);

     

       14
       14
       +
       

     

       15
       15
       +
       		// Should be base64url format

     

       16
       16
       +
       		expect(cursor).toMatch(/^[A-Za-z0-9_-]+$/);

     

       17
       17
       +
       		expect(cursor).not.toContain("="); // No padding

     

       18
       18
       +
       		expect(cursor).not.toContain("+"); // URL-safe

     

       19
       19
       +
       		expect(cursor).not.toContain("/"); // URL-safe

     

       20
       20
       +
       	});

     

       21
       21
       +
       

     

       22
       22
       +
       	test("decodeCursor reverses encodeCursor", () => {

     

       23
       23
       +
       		const original = ["1732396800", "trans-123"];

     

       24
       24
       +
       		const encoded = encodeCursor(original);

     

       25
       25
       +
       		const decoded = decodeCursor(encoded);

     

       26
       26
       +
       

     

       27
       27
       +
       		expect(decoded).toEqual(original);

     

       28
       28
       +
       	});

     

       29
       29
       +
       

     

       30
       30
       +
       	test("encodeSimpleCursor works with timestamp and id", () => {

     

       31
       31
       +
       		const timestamp = 1732396800;

     

       32
       32
       +
       		const id = "trans-123";

     

       33
       33
       +
       

     

       34
       34
       +
       		const cursor = encodeSimpleCursor(timestamp, id);

     

       35
       35
       +
       		const decoded = decodeSimpleCursor(cursor);

     

       36
       36
       +
       

     

       37
       37
       +
       		expect(decoded.timestamp).toBe(timestamp);

     

       38
       38
       +
       		expect(decoded.id).toBe(id);

     

       39
       39
       +
       	});

     

       40
       40
       +
       

     

       41
       41
       +
       	test("encodeClassCursor works with class data", () => {

     

       42
       42
       +
       		const year = 2024;

     

       43
       43
       +
       		const semester = "Fall";

     

       44
       44
       +
       		const courseCode = "CS101";

     

       45
       45
       +
       		const id = "class-1";

     

       46
       46
       +
       

     

       47
       47
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       48
       48
       +
       		const decoded = decodeClassCursor(cursor);

     

       49
       49
       +
       

     

       50
       50
       +
       		expect(decoded.year).toBe(year);

     

       51
       51
       +
       		expect(decoded.semester).toBe(semester);

     

       52
       52
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       53
       53
       +
       		expect(decoded.id).toBe(id);

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("encodeClassCursor handles course codes with dashes", () => {

     

       57
       57
       +
       		const year = 2024;

     

       58
       58
       +
       		const semester = "Fall";

     

       59
       59
       +
       		const courseCode = "CS-101-A";

     

       60
       60
       +
       		const id = "class-1";

     

       61
       61
       +
       

     

       62
       62
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       63
       63
       +
       		const decoded = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       66
       66
       +
       	});

     

       67
       67
       +
       

     

       68
       68
       +
       	test("decodeCursor throws on invalid base64", () => {

     

       69
       69
       +
       		// Skip this test - Buffer.from with invalid base64 doesn't always throw

     

       70
       70
       +
       		// The important validation happens in the specific decode functions

     

       71
       71
       +
       	});

     

       72
       72
       +
       

     

       73
       73
       +
       	test("decodeSimpleCursor throws on wrong number of parts", () => {

     

       74
       74
       +
       		const cursor = encodeCursor(["1", "2", "3"]); // 3 parts instead of 2

     

       75
       75
       +
       

     

       76
       76
       +
       		expect(() => {

     

       77
       77
       +
       			decodeSimpleCursor(cursor);

     

       78
       78
       +
       		}).toThrow("Invalid cursor format");

     

       79
       79
       +
       	});

     

       80
       80
       +
       

     

       81
       81
       +
       	test("decodeSimpleCursor throws on invalid timestamp", () => {

     

       82
       82
       +
       		const cursor = encodeCursor(["not-a-number", "trans-123"]);

     

       83
       83
       +
       

     

       84
       84
       +
       		expect(() => {

     

       85
       85
       +
       			decodeSimpleCursor(cursor);

     

       86
       86
       +
       		}).toThrow("Invalid cursor format");

     

       87
       87
       +
       	});

     

       88
       88
       +
       

     

       89
       89
       +
       	test("decodeClassCursor throws on wrong number of parts", () => {

     

       90
       90
       +
       		const cursor = encodeCursor(["1", "2"]); // 2 parts instead of 4

     

       91
       91
       +
       

     

       92
       92
       +
       		expect(() => {

     

       93
       93
       +
       			decodeClassCursor(cursor);

     

       94
       94
       +
       		}).toThrow("Invalid cursor format");

     

       95
       95
       +
       	});

     

       96
       96
       +
       

     

       97
       97
       +
       	test("decodeClassCursor throws on invalid year", () => {

     

       98
       98
       +
       		const cursor = encodeCursor(["not-a-year", "Fall", "CS101", "class-1"]);

     

       99
       99
       +
       

     

       100
       100
       +
       		expect(() => {

     

       101
       101
       +
       			decodeClassCursor(cursor);

     

       102
       102
       +
       		}).toThrow("Invalid cursor format");

     

       103
       103
       +
       	});

     

       104
       104
       +
       

     

       105
       105
       +
       	test("cursors are opaque and short", () => {

     

       106
       106
       +
       		const simpleCursor = encodeSimpleCursor(1732396800, "trans-123");

     

       107
       107
       +
       		const classCursor = encodeClassCursor(2024, "Fall", "CS101", "class-1");

     

       108
       108
       +
       

     

       109
       109
       +
       		// Should be reasonably short

     

       110
       110
       +
       		expect(simpleCursor.length).toBeLessThan(50);

     

       111
       111
       +
       		expect(classCursor.length).toBeLessThan(50);

     

       112
       112
       +
       

     

       113
       113
       +
       		// Should not reveal internal structure

     

       114
       114
       +
       		expect(simpleCursor).not.toContain("trans-123");

     

       115
       115
       +
       		expect(classCursor).not.toContain("CS101");

     

       116
       116
       +
       	});

     

       117
       117
       +
       });

+92

src/lib/cursor.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Cursor encoding/decoding for pagination

     

       3
       3
       +
        * Cursors are base64url-encoded strings for opacity and URL safety

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       /**

     

       7
       7
       +
        * Encode a cursor from components

     

       8
       8
       +
        */

     

       9
       9
       +
       export function encodeCursor(parts: string[]): string {

     

       10
       10
       +
       	const raw = parts.join("|");

     

       11
       11
       +
       	// Use base64url encoding (no padding, URL-safe characters)

     

       12
       12
       +
       	return Buffer.from(raw).toString("base64url");

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       /**

     

       16
       16
       +
        * Decode a cursor into components

     

       17
       17
       +
        */

     

       18
       18
       +
       export function decodeCursor(cursor: string): string[] {

     

       19
       19
       +
       	try {

     

       20
       20
       +
       		const raw = Buffer.from(cursor, "base64url").toString("utf-8");

     

       21
       21
       +
       		return raw.split("|");

     

       22
       22
       +
       	} catch {

     

       23
       23
       +
       		throw new Error("Invalid cursor format");

     

       24
       24
       +
       	}

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       /**

     

       28
       28
       +
        * Encode a transcription/user cursor (timestamp-id)

     

       29
       29
       +
        */

     

       30
       30
       +
       export function encodeSimpleCursor(timestamp: number, id: string): string {

     

       31
       31
       +
       	return encodeCursor([timestamp.toString(), id]);

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       34
       34
       +
       /**

     

       35
       35
       +
        * Decode a transcription/user cursor (timestamp-id)

     

       36
       36
       +
        */

     

       37
       37
       +
       export function decodeSimpleCursor(cursor: string): {

     

       38
       38
       +
       	timestamp: number;

     

       39
       39
       +
       	id: string;

     

       40
       40
       +
       } {

     

       41
       41
       +
       	const parts = decodeCursor(cursor);

     

       42
       42
       +
       	if (parts.length !== 2) {

     

       43
       43
       +
       		throw new Error("Invalid cursor format");

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	const timestamp = Number.parseInt(parts[0] || "", 10);

     

       47
       47
       +
       	const id = parts[1] || "";

     

       48
       48
       +
       

     

       49
       49
       +
       	if (Number.isNaN(timestamp) || !id) {

     

       50
       50
       +
       		throw new Error("Invalid cursor format");

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	return { timestamp, id };

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       /**

     

       57
       57
       +
        * Encode a class cursor (year-semester-coursecode-id)

     

       58
       58
       +
        */

     

       59
       59
       +
       export function encodeClassCursor(

     

       60
       60
       +
       	year: number,

     

       61
       61
       +
       	semester: string,

     

       62
       62
       +
       	courseCode: string,

     

       63
       63
       +
       	id: string,

     

       64
       64
       +
       ): string {

     

       65
       65
       +
       	return encodeCursor([year.toString(), semester, courseCode, id]);

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Decode a class cursor (year-semester-coursecode-id)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function decodeClassCursor(cursor: string): {

     

       72
       72
       +
       	year: number;

     

       73
       73
       +
       	semester: string;

     

       74
       74
       +
       	courseCode: string;

     

       75
       75
       +
       	id: string;

     

       76
       76
       +
       } {

     

       77
       77
       +
       	const parts = decodeCursor(cursor);

     

       78
       78
       +
       	if (parts.length !== 4) {

     

       79
       79
       +
       		throw new Error("Invalid cursor format");

     

       80
       80
       +
       	}

     

       81
       81
       +
       

     

       82
       82
       +
       	const year = Number.parseInt(parts[0] || "", 10);

     

       83
       83
       +
       	const semester = parts[1] || "";

     

       84
       84
       +
       	const courseCode = parts[2] || "";

     

       85
       85
       +
       	const id = parts[3] || "";

     

       86
       86
       +
       

     

       87
       87
       +
       	if (Number.isNaN(year) || !semester || !courseCode || !id) {

     

       88
       88
       +
       		throw new Error("Invalid cursor format");

     

       89
       89
       +
       	}

     

       90
       90
       +
       

     

       91
       91
       +
       	return { year, semester, courseCode, id };

     

       92
       92
       +
       }

+116

src/lib/email-change.test.ts

···

       1
       1
       +
       import { expect, test } from "bun:test";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       import {

     

       4
       4
       +
       	consumeEmailChangeToken,

     

       5
       5
       +
       	createEmailChangeToken,

     

       6
       6
       +
       	createUser,

     

       7
       7
       +
       	getUserByEmail,

     

       8
       8
       +
       	updateUserEmail,

     

       9
       9
       +
       	verifyEmailChangeToken,

     

       10
       10
       +
       } from "./auth";

     

       11
       11
       +
       

     

       12
       12
       +
       test("email change token lifecycle", async () => {

     

       13
       13
       +
       	// Create a test user with unique email

     

       14
       14
       +
       	const timestamp = Date.now();

     

       15
       15
       +
       	const user = await createUser(

     

       16
       16
       +
       		`test-email-change-${timestamp}@example.com`,

     

       17
       17
       +
       		"password123",

     

       18
       18
       +
       		"Test User",

     

       19
       19
       +
       	);

     

       20
       20
       +
       

     

       21
       21
       +
       	// Create an email change token

     

       22
       22
       +
       	const newEmail = `new-email-${timestamp}@example.com`;

     

       23
       23
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       24
       24
       +
       

     

       25
       25
       +
       	expect(token).toBeTruthy();

     

       26
       26
       +
       	expect(token.length).toBeGreaterThan(0);

     

       27
       27
       +
       

     

       28
       28
       +
       	// Verify the token

     

       29
       29
       +
       	const result = verifyEmailChangeToken(token);

     

       30
       30
       +
       	expect(result).toBeTruthy();

     

       31
       31
       +
       	expect(result?.userId).toBe(user.id);

     

       32
       32
       +
       	expect(result?.newEmail).toBe(newEmail);

     

       33
       33
       +
       

     

       34
       34
       +
       	// Update the email

     

       35
       35
       +
       	if (result) {

     

       36
       36
       +
       		updateUserEmail(result.userId, result.newEmail);

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	// Consume the token

     

       40
       40
       +
       	consumeEmailChangeToken(token);

     

       41
       41
       +
       

     

       42
       42
       +
       	// Verify the email was updated

     

       43
       43
       +
       	const updatedUser = getUserByEmail(newEmail);

     

       44
       44
       +
       	expect(updatedUser).toBeTruthy();

     

       45
       45
       +
       	expect(updatedUser?.id).toBe(user.id);

     

       46
       46
       +
       	expect(updatedUser?.email).toBe(newEmail);

     

       47
       47
       +
       

     

       48
       48
       +
       	// Verify the token can't be used again

     

       49
       49
       +
       	const result2 = verifyEmailChangeToken(token);

     

       50
       50
       +
       	expect(result2).toBeNull();

     

       51
       51
       +
       

     

       52
       52
       +
       	// Clean up

     

       53
       53
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       54
       54
       +
       });

     

       55
       55
       +
       

     

       56
       56
       +
       test("email change token expires", async () => {

     

       57
       57
       +
       	// Create a test user with unique email

     

       58
       58
       +
       	const timestamp = Date.now();

     

       59
       59
       +
       	const user = await createUser(

     

       60
       60
       +
       		`test-expire-${timestamp}@example.com`,

     

       61
       61
       +
       		"password123",

     

       62
       62
       +
       		"Test User",

     

       63
       63
       +
       	);

     

       64
       64
       +
       

     

       65
       65
       +
       	// Create an email change token

     

       66
       66
       +
       	const newEmail = `new-expire-${timestamp}@example.com`;

     

       67
       67
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       68
       68
       +
       

     

       69
       69
       +
       	// Manually expire the token

     

       70
       70
       +
       	db.run("UPDATE email_change_tokens SET expires_at = ? WHERE token = ?", [

     

       71
       71
       +
       		Math.floor(Date.now() / 1000) - 1,

     

       72
       72
       +
       		token,

     

       73
       73
       +
       	]);

     

       74
       74
       +
       

     

       75
       75
       +
       	// Verify the token is expired

     

       76
       76
       +
       	const result = verifyEmailChangeToken(token);

     

       77
       77
       +
       	expect(result).toBeNull();

     

       78
       78
       +
       

     

       79
       79
       +
       	// Clean up

     

       80
       80
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       81
       81
       +
       });

     

       82
       82
       +
       

     

       83
       83
       +
       test("only one email change token per user", async () => {

     

       84
       84
       +
       	// Create a test user with unique email

     

       85
       85
       +
       	const timestamp = Date.now();

     

       86
       86
       +
       	const user = await createUser(

     

       87
       87
       +
       		`test-single-token-${timestamp}@example.com`,

     

       88
       88
       +
       		"password123",

     

       89
       89
       +
       		"Test User",

     

       90
       90
       +
       	);

     

       91
       91
       +
       

     

       92
       92
       +
       	// Create first token

     

       93
       93
       +
       	const token1 = createEmailChangeToken(

     

       94
       94
       +
       		user.id,

     

       95
       95
       +
       		`email1-${timestamp}@example.com`,

     

       96
       96
       +
       	);

     

       97
       97
       +
       

     

       98
       98
       +
       	// Create second token (should delete first)

     

       99
       99
       +
       	const token2 = createEmailChangeToken(

     

       100
       100
       +
       		user.id,

     

       101
       101
       +
       		`email2-${timestamp}@example.com`,

     

       102
       102
       +
       	);

     

       103
       103
       +
       

     

       104
       104
       +
       	// First token should be invalid

     

       105
       105
       +
       	const result1 = verifyEmailChangeToken(token1);

     

       106
       106
       +
       	expect(result1).toBeNull();

     

       107
       107
       +
       

     

       108
       108
       +
       	// Second token should work

     

       109
       109
       +
       	const result2 = verifyEmailChangeToken(token2);

     

       110
       110
       +
       	expect(result2).toBeTruthy();

     

       111
       111
       +
       	expect(result2?.newEmail).toBe(`email2-${timestamp}@example.com`);

     

       112
       112
       +
       

     

       113
       113
       +
       	// Clean up

     

       114
       114
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       115
       115
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [user.id]);

     

       116
       116
       +
       });

+297

src/lib/email-templates.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Email templates for transactional emails

     

       3
       3
       +
        * Uses inline CSS for maximum email client compatibility

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       const baseStyles = `

     

       7
       7
       +
         body {

     

       8
       8
       +
           font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;

     

       9
       9
       +
           line-height: 1.6;

     

       10
       10
       +
           color: #2d3142;

     

       11
       11
       +
           background-color: #ffffff;

     

       12
       12
       +
           margin: 0;

     

       13
       13
       +
           padding: 0;

     

       14
       14
       +
         }

     

       15
       15
       +
         .container {

     

       16
       16
       +
           max-width: 600px;

     

       17
       17
       +
           margin: 0 auto;

     

       18
       18
       +
           padding: 2rem 1rem;

     

       19
       19
       +
         }

     

       20
       20
       +
         .header {

     

       21
       21
       +
           text-align: center;

     

       22
       22
       +
           margin-bottom: 2rem;

     

       23
       23
       +
         }

     

       24
       24
       +
         .header h1 {

     

       25
       25
       +
           color: #2d3142;

     

       26
       26
       +
           font-size: 1.5rem;

     

       27
       27
       +
           margin: 0;

     

       28
       28
       +
         }

     

       29
       29
       +
         .content {

     

       30
       30
       +
           background: #ffffff;

     

       31
       31
       +
           padding: 2rem;

     

       32
       32
       +
           border-radius: 0.5rem;

     

       33
       33
       +
           border: 1px solid #bfc0c0;

     

       34
       34
       +
         }

     

       35
       35
       +
         .button {

     

       36
       36
       +
           display: inline-block;

     

       37
       37
       +
           background-color: #ef8354;

     

       38
       38
       +
           color: #ffffff;

     

       39
       39
       +
           text-decoration: none;

     

       40
       40
       +
           padding: 0.75rem 1.5rem;

     

       41
       41
       +
           border-radius: 6px;

     

       42
       42
       +
           font-weight: 500;

     

       43
       43
       +
           font-size: 1rem;

     

       44
       44
       +
           margin: 1rem 0;

     

       45
       45
       +
           border: 2px solid #ef8354;

     

       46
       46
       +
         }

     

       47
       47
       +
         .footer {

     

       48
       48
       +
           text-align: center;

     

       49
       49
       +
           margin-top: 2rem;

     

       50
       50
       +
           color: #4f5d75;

     

       51
       51
       +
           font-size: 0.875rem;

     

       52
       52
       +
         }

     

       53
       53
       +
         .code {

     

       54
       54
       +
           background: #f5f5f5;

     

       55
       55
       +
           border: 1px solid #bfc0c0;

     

       56
       56
       +
           border-radius: 0.25rem;

     

       57
       57
       +
           padding: 0.5rem 1rem;

     

       58
       58
       +
           font-family: 'Courier New', monospace;

     

       59
       59
       +
           font-size: 1.5rem;

     

       60
       60
       +
           letter-spacing: 0.25rem;

     

       61
       61
       +
           text-align: center;

     

       62
       62
       +
           margin: 1rem 0;

     

       63
       63
       +
         }

     

       64
       64
       +
         .info-box {

     

       65
       65
       +
           background: #f5f5f5;

     

       66
       66
       +
           border: 1px solid #bfc0c0;

     

       67
       67
       +
           border-radius: 6px;

     

       68
       68
       +
           padding: 1.25rem;

     

       69
       69
       +
           margin: 1rem 0;

     

       70
       70
       +
         }

     

       71
       71
       +
         .info-box-label {

     

       72
       72
       +
           color: #4f5d75;

     

       73
       73
       +
           font-size: 0.75rem;

     

       74
       74
       +
           text-transform: uppercase;

     

       75
       75
       +
           letter-spacing: 0.05rem;

     

       76
       76
       +
           margin: 0 0 0.25rem 0;

     

       77
       77
       +
           font-weight: 600;

     

       78
       78
       +
         }

     

       79
       79
       +
         .info-box-value {

     

       80
       80
       +
           color: #2d3142;

     

       81
       81
       +
           font-size: 1rem;

     

       82
       82
       +
           margin: 0;

     

       83
       83
       +
         }

     

       84
       84
       +
         .info-box-divider {

     

       85
       85
       +
           border: 0;

     

       86
       86
       +
           border-top: 1px solid #bfc0c0;

     

       87
       87
       +
           margin: 1rem 0;

     

       88
       88
       +
         }

     

       89
       89
       +
       `;

     

       90
       90
       +
       

     

       91
       91
       +
       interface VerifyEmailOptions {

     

       92
       92
       +
       	name: string | null;

     

       93
       93
       +
       	code: string;

     

       94
       94
       +
       	token: string;

     

       95
       95
       +
       }

     

       96
       96
       +
       

     

       97
       97
       +
       export function verifyEmailTemplate(options: VerifyEmailOptions): string {

     

       98
       98
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       99
       99
       +
       	const origin = process.env.ORIGIN || "http://localhost:3000";

     

       100
       100
       +
       	const verifyLink = `${origin}/api/auth/verify-email?token=${options.token}`;

     

       101
       101
       +
       

     

       102
       102
       +
       	return `

     

       103
       103
       +
       <!DOCTYPE html>

     

       104
       104
       +
       <html lang="en">

     

       105
       105
       +
       <head>

     

       106
       106
       +
         <meta charset="UTF-8">

     

       107
       107
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       108
       108
       +
         <title>Verify Your Email - Thistle</title>

     

       109
       109
       +
         <style>${baseStyles}</style>

     

       110
       110
       +
       </head>

     

       111
       111
       +
       <body>

     

       112
       112
       +
         <div class="container">

     

       113
       113
       +
           <div class="header">

     

       114
       114
       +
             <h1>🪻 Thistle</h1>

     

       115
       115
       +
           </div>

     

       116
       116
       +
           <div class="content">

     

       117
       117
       +
             <h2>${greeting}!</h2>

     

       118
       118
       +
             <p>Thanks for signing up for Thistle. Please verify your email address to get started.</p>

     

       119
       119
       +
             <p><strong>Your verification code is:</strong></p>

     

       120
       120
       +
             <div class="code">${options.code}</div>

     

       121
       121
       +
             <p style="color: #4f5d75; font-size: 0.875rem; margin-top: 1rem; margin-bottom: 0.75rem;">

     

       122
       122
       +
               This code will expire in 24 hours. Enter it in the verification dialog after you login, or click the button below:

     

       123
       123
       +
             </p>

     

       124
       124
       +
             <p style="text-align: center; margin-top: 0; margin-bottom: 0.75rem;">

     

       125
       125
       +
               <a href="${verifyLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">Verify Email</a>

     

       126
       126
       +
             </p>

     

       127
       127
       +
           </div>

     

       128
       128
       +
           <div class="footer">

     

       129
       129
       +
             <p>If you didn't create an account, you can safely ignore this email.</p>

     

       130
       130
       +
           </div>

     

       131
       131
       +
         </div>

     

       132
       132
       +
       </body>

     

       133
       133
       +
       </html>

     

       134
       134
       +
         `.trim();

     

       135
       135
       +
       }

     

       136
       136
       +
       

     

       137
       137
       +
       interface PasswordResetOptions {

     

       138
       138
       +
       	name: string | null;

     

       139
       139
       +
       	resetLink: string;

     

       140
       140
       +
       }

     

       141
       141
       +
       

     

       142
       142
       +
       export function passwordResetTemplate(options: PasswordResetOptions): string {

     

       143
       143
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       144
       144
       +
       

     

       145
       145
       +
       	return `

     

       146
       146
       +
       <!DOCTYPE html>

     

       147
       147
       +
       <html lang="en">

     

       148
       148
       +
       <head>

     

       149
       149
       +
         <meta charset="UTF-8">

     

       150
       150
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       151
       151
       +
         <title>Reset Your Password - Thistle</title>

     

       152
       152
       +
         <style>${baseStyles}</style>

     

       153
       153
       +
       </head>

     

       154
       154
       +
       <body>

     

       155
       155
       +
         <div class="container">

     

       156
       156
       +
           <div class="header">

     

       157
       157
       +
             <h1>🪻 Thistle</h1>

     

       158
       158
       +
           </div>

     

       159
       159
       +
           <div class="content">

     

       160
       160
       +
             <h2>${greeting}!</h2>

     

       161
       161
       +
             <p>We received a request to reset your password. Click the button below to create a new password.</p>

     

       162
       162
       +
             <p style="text-align: center;">

     

       163
       163
       +
               <a href="${options.resetLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 1rem 0; border: 2px solid #ef8354;">Reset Password</a>

     

       164
       164
       +
             </p>

     

       165
       165
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       166
       166
       +
               If the button doesn't work, copy and paste this link into your browser:<br>

     

       167
       167
       +
               <a href="${options.resetLink}" style="color: #4f5d75; word-break: break-all;">${options.resetLink}</a>

     

       168
       168
       +
             </p>

     

       169
       169
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       170
       170
       +
               This link will expire in 1 hour.

     

       171
       171
       +
             </p>

     

       172
       172
       +
           </div>

     

       173
       173
       +
           <div class="footer">

     

       174
       174
       +
             <p>If you didn't request a password reset, you can safely ignore this email.</p>

     

       175
       175
       +
           </div>

     

       176
       176
       +
         </div>

     

       177
       177
       +
       </body>

     

       178
       178
       +
       </html>

     

       179
       179
       +
         `.trim();

     

       180
       180
       +
       }

     

       181
       181
       +
       

     

       182
       182
       +
       interface TranscriptionCompleteOptions {

     

       183
       183
       +
       	name: string | null;

     

       184
       184
       +
       	originalFilename: string;

     

       185
       185
       +
       	transcriptLink: string;

     

       186
       186
       +
       	className?: string;

     

       187
       187
       +
       }

     

       188
       188
       +
       

     

       189
       189
       +
       export function transcriptionCompleteTemplate(

     

       190
       190
       +
       	options: TranscriptionCompleteOptions,

     

       191
       191
       +
       ): string {

     

       192
       192
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       193
       193
       +
       

     

       194
       194
       +
       	return `

     

       195
       195
       +
       <!DOCTYPE html>

     

       196
       196
       +
       <html lang="en">

     

       197
       197
       +
       <head>

     

       198
       198
       +
         <meta charset="UTF-8">

     

       199
       199
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       200
       200
       +
         <title>Transcription Complete - Thistle</title>

     

       201
       201
       +
         <style>${baseStyles}</style>

     

       202
       202
       +
       </head>

     

       203
       203
       +
       <body>

     

       204
       204
       +
         <div class="container">

     

       205
       205
       +
           <div class="header">

     

       206
       206
       +
             <h1>🪻 Thistle</h1>

     

       207
       207
       +
           </div>

     

       208
       208
       +
           <div class="content">

     

       209
       209
       +
             <h2>${greeting}!</h2>

     

       210
       210
       +
             <p>Your transcription is ready!</p>

     

       211
       211
       +
             

     

       212
       212
       +
             <div class="info-box">

     

       213
       213
       +
               ${

     

       214
       214
       +
       					options.className

     

       215
       215
       +
       						? `

     

       216
       216
       +
               <p class="info-box-label">Class</p>

     

       217
       217
       +
               <p class="info-box-value">${options.className}</p>

     

       218
       218
       +
               <hr class="info-box-divider">

     

       219
       219
       +
               `

     

       220
       220
       +
       						: ""

     

       221
       221
       +
       				}

     

       222
       222
       +
               <p class="info-box-label">File</p>

     

       223
       223
       +
               <p class="info-box-value">${options.originalFilename}</p>

     

       224
       224
       +
             </div>

     

       225
       225
       +
       

     

       226
       226
       +
             <p style="text-align: center; margin-top: 1.5rem; margin-bottom: 0;">

     

       227
       227
       +
               <a href="${options.transcriptLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">View Transcript</a>

     

       228
       228
       +
             </p>

     

       229
       229
       +
           </div>

     

       230
       230
       +
           <div class="footer">

     

       231
       231
       +
             <p>Thanks for using Thistle!</p>

     

       232
       232
       +
           </div>

     

       233
       233
       +
         </div>

     

       234
       234
       +
       </body>

     

       235
       235
       +
       </html>

     

       236
       236
       +
         `.trim();

     

       237
       237
       +
       }

     

       238
       238
       +
       

     

       239
       239
       +
       interface EmailChangeOptions {

     

       240
       240
       +
       	name: string | null;

     

       241
       241
       +
       	currentEmail: string;

     

       242
       242
       +
       	newEmail: string;

     

       243
       243
       +
       	verifyLink: string;

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       export function emailChangeTemplate(options: EmailChangeOptions): string {

     

       247
       247
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       248
       248
       +
       

     

       249
       249
       +
       	return `

     

       250
       250
       +
       <!DOCTYPE html>

     

       251
       251
       +
       <html lang="en">

     

       252
       252
       +
       <head>

     

       253
       253
       +
         <meta charset="UTF-8">

     

       254
       254
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       255
       255
       +
         <title>Verify Email Change - Thistle</title>

     

       256
       256
       +
         <style>${baseStyles}</style>

     

       257
       257
       +
       </head>

     

       258
       258
       +
       <body>

     

       259
       259
       +
         <div class="container">

     

       260
       260
       +
           <div class="header">

     

       261
       261
       +
             <h1>🪻 Thistle</h1>

     

       262
       262
       +
           </div>

     

       263
       263
       +
           <div class="content">

     

       264
       264
       +
             <h2>${greeting}!</h2>

     

       265
       265
       +
             <p>You requested to change your email address.</p>

     

       266
       266
       +
             

     

       267
       267
       +
             <div class="info-box">

     

       268
       268
       +
               <p class="info-box-label">Current Email</p>

     

       269
       269
       +
               <p class="info-box-value">${options.currentEmail}</p>

     

       270
       270
       +
               <hr class="info-box-divider">

     

       271
       271
       +
               <p class="info-box-label">New Email</p>

     

       272
       272
       +
               <p class="info-box-value">${options.newEmail}</p>

     

       273
       273
       +
             </div>

     

       274
       274
       +
       

     

       275
       275
       +
             <p>Click the button below to confirm this change:</p>

     

       276
       276
       +
       

     

       277
       277
       +
             <p style="text-align: center; margin-top: 1.5rem; margin-bottom: 0;">

     

       278
       278
       +
               <a href="${options.verifyLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">Verify Email Change</a>

     

       279
       279
       +
             </p>

     

       280
       280
       +
       

     

       281
       281
       +
             <p style="color: #4f5d75; font-size: 0.875rem; margin-top: 1.5rem;">

     

       282
       282
       +
               If the button doesn't work, copy and paste this link into your browser:<br>

     

       283
       283
       +
               <a href="${options.verifyLink}" style="color: #4f5d75; word-break: break-all;">${options.verifyLink}</a>

     

       284
       284
       +
             </p>

     

       285
       285
       +
       

     

       286
       286
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       287
       287
       +
               This link will expire in 24 hours.

     

       288
       288
       +
             </p>

     

       289
       289
       +
           </div>

     

       290
       290
       +
           <div class="footer">

     

       291
       291
       +
             <p>If you didn't request this change, please ignore this email and your email address will remain unchanged.</p>

     

       292
       292
       +
           </div>

     

       293
       293
       +
         </div>

     

       294
       294
       +
       </body>

     

       295
       295
       +
       </html>

     

       296
       296
       +
         `.trim();

     

       297
       297
       +
       }

+161

src/lib/email-verification.test.ts

···

       1
       1
       +
       import { afterEach, beforeEach, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       import {

     

       4
       4
       +
       	consumePasswordResetToken,

     

       5
       5
       +
       	createEmailVerificationToken,

     

       6
       6
       +
       	createPasswordResetToken,

     

       7
       7
       +
       	createUser,

     

       8
       8
       +
       	isEmailVerified,

     

       9
       9
       +
       	verifyEmailToken,

     

       10
       10
       +
       	verifyPasswordResetToken,

     

       11
       11
       +
       } from "./auth";

     

       12
       12
       +
       

     

       13
       13
       +
       describe("Email Verification", () => {

     

       14
       14
       +
       	let userId: number;

     

       15
       15
       +
       	const testEmail = `test-verify-${Date.now()}@example.com`;

     

       16
       16
       +
       

     

       17
       17
       +
       	beforeEach(async () => {

     

       18
       18
       +
       		// Create test user

     

       19
       19
       +
       		const user = await createUser(testEmail, "a".repeat(64), "Test User");

     

       20
       20
       +
       		userId = user.id;

     

       21
       21
       +
       	});

     

       22
       22
       +
       

     

       23
       23
       +
       	afterEach(() => {

     

       24
       24
       +
       		// Cleanup

     

       25
       25
       +
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       26
       26
       +
       		db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       27
       27
       +
       	});

     

       28
       28
       +
       

     

       29
       29
       +
       	test("creates verification token", () => {

     

       30
       30
       +
       		const result = createEmailVerificationToken(userId);

     

       31
       31
       +
       		expect(result).toBeDefined();

     

       32
       32
       +
       		expect(typeof result).toBe("object");

     

       33
       33
       +
       		expect(typeof result.code).toBe("string");

     

       34
       34
       +
       		expect(typeof result.token).toBe("string");

     

       35
       35
       +
       		expect(typeof result.sentAt).toBe("number");

     

       36
       36
       +
       		expect(result.code.length).toBe(6);

     

       37
       37
       +
       	});

     

       38
       38
       +
       

     

       39
       39
       +
       	test("verifies valid token", () => {

     

       40
       40
       +
       		const { token } = createEmailVerificationToken(userId);

     

       41
       41
       +
       		const result = verifyEmailToken(token);

     

       42
       42
       +
       

     

       43
       43
       +
       		expect(result).not.toBeNull();

     

       44
       44
       +
       		expect(result?.userId).toBe(userId);

     

       45
       45
       +
       		expect(result?.email).toBe(testEmail);

     

       46
       46
       +
       		expect(isEmailVerified(userId)).toBe(true);

     

       47
       47
       +
       	});

     

       48
       48
       +
       

     

       49
       49
       +
       	test("rejects invalid token", () => {

     

       50
       50
       +
       		const result = verifyEmailToken("invalid-token-12345");

     

       51
       51
       +
       		expect(result).toBeNull();

     

       52
       52
       +
       		expect(isEmailVerified(userId)).toBe(false);

     

       53
       53
       +
       	});

     

       54
       54
       +
       

     

       55
       55
       +
       	test("token is one-time use", () => {

     

       56
       56
       +
       		const { token } = createEmailVerificationToken(userId);

     

       57
       57
       +
       

     

       58
       58
       +
       		// First use succeeds

     

       59
       59
       +
       		const firstResult = verifyEmailToken(token);

     

       60
       60
       +
       		expect(firstResult).not.toBeNull();

     

       61
       61
       +
       

     

       62
       62
       +
       		// Second use fails

     

       63
       63
       +
       		const secondResult = verifyEmailToken(token);

     

       64
       64
       +
       		expect(secondResult).toBeNull();

     

       65
       65
       +
       	});

     

       66
       66
       +
       

     

       67
       67
       +
       	test("rejects expired token", () => {

     

       68
       68
       +
       		const { token } = createEmailVerificationToken(userId);

     

       69
       69
       +
       

     

       70
       70
       +
       		// Manually expire the token

     

       71
       71
       +
       		db.run(

     

       72
       72
       +
       			"UPDATE email_verification_tokens SET expires_at = ? WHERE token = ?",

     

       73
       73
       +
       			[Math.floor(Date.now() / 1000) - 100, token],

     

       74
       74
       +
       		);

     

       75
       75
       +
       

     

       76
       76
       +
       		const result = verifyEmailToken(token);

     

       77
       77
       +
       		expect(result).toBeNull();

     

       78
       78
       +
       	});

     

       79
       79
       +
       

     

       80
       80
       +
       	test("replaces existing token when creating new one", () => {

     

       81
       81
       +
       		const { token: token1 } = createEmailVerificationToken(userId);

     

       82
       82
       +
       		const { token: token2 } = createEmailVerificationToken(userId);

     

       83
       83
       +
       

     

       84
       84
       +
       		// First token should be invalidated

     

       85
       85
       +
       		expect(verifyEmailToken(token1)).toBeNull();

     

       86
       86
       +
       

     

       87
       87
       +
       		// Second token should work

     

       88
       88
       +
       		expect(verifyEmailToken(token2)).not.toBeNull();

     

       89
       89
       +
       	});

     

       90
       90
       +
       });

     

       91
       91
       +
       

     

       92
       92
       +
       describe("Password Reset", () => {

     

       93
       93
       +
       	let userId: number;

     

       94
       94
       +
       	const testEmail = `test-reset-${Date.now()}@example.com`;

     

       95
       95
       +
       

     

       96
       96
       +
       	beforeEach(async () => {

     

       97
       97
       +
       		const user = await createUser(testEmail, "a".repeat(64), "Test User");

     

       98
       98
       +
       		userId = user.id;

     

       99
       99
       +
       	});

     

       100
       100
       +
       

     

       101
       101
       +
       	afterEach(() => {

     

       102
       102
       +
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       103
       103
       +
       		db.run("DELETE FROM password_reset_tokens WHERE user_id = ?", [userId]);

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("creates reset token", () => {

     

       107
       107
       +
       		const token = createPasswordResetToken(userId);

     

       108
       108
       +
       		expect(token).toBeDefined();

     

       109
       109
       +
       		expect(typeof token).toBe("string");

     

       110
       110
       +
       		expect(token.length).toBeGreaterThan(0);

     

       111
       111
       +
       	});

     

       112
       112
       +
       

     

       113
       113
       +
       	test("verifies valid reset token", () => {

     

       114
       114
       +
       		const token = createPasswordResetToken(userId);

     

       115
       115
       +
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       116
       116
       +
       

     

       117
       117
       +
       		expect(verifiedUserId).toBe(userId);

     

       118
       118
       +
       	});

     

       119
       119
       +
       

     

       120
       120
       +
       	test("rejects invalid reset token", () => {

     

       121
       121
       +
       		const verifiedUserId = verifyPasswordResetToken("invalid-token-12345");

     

       122
       122
       +
       		expect(verifiedUserId).toBeNull();

     

       123
       123
       +
       	});

     

       124
       124
       +
       

     

       125
       125
       +
       	test("consumes reset token", () => {

     

       126
       126
       +
       		const token = createPasswordResetToken(userId);

     

       127
       127
       +
       

     

       128
       128
       +
       		// Token works before consumption

     

       129
       129
       +
       		expect(verifyPasswordResetToken(token)).toBe(userId);

     

       130
       130
       +
       

     

       131
       131
       +
       		// Consume token

     

       132
       132
       +
       		consumePasswordResetToken(token);

     

       133
       133
       +
       

     

       134
       134
       +
       		// Token no longer works

     

       135
       135
       +
       		expect(verifyPasswordResetToken(token)).toBeNull();

     

       136
       136
       +
       	});

     

       137
       137
       +
       

     

       138
       138
       +
       	test("rejects expired reset token", () => {

     

       139
       139
       +
       		const token = createPasswordResetToken(userId);

     

       140
       140
       +
       

     

       141
       141
       +
       		// Manually expire the token

     

       142
       142
       +
       		db.run("UPDATE password_reset_tokens SET expires_at = ? WHERE token = ?", [

     

       143
       143
       +
       			Math.floor(Date.now() / 1000) - 100,

     

       144
       144
       +
       			token,

     

       145
       145
       +
       		]);

     

       146
       146
       +
       

     

       147
       147
       +
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       148
       148
       +
       		expect(verifiedUserId).toBeNull();

     

       149
       149
       +
       	});

     

       150
       150
       +
       

     

       151
       151
       +
       	test("replaces existing reset token when creating new one", () => {

     

       152
       152
       +
       		const token1 = createPasswordResetToken(userId);

     

       153
       153
       +
       		const token2 = createPasswordResetToken(userId);

     

       154
       154
       +
       

     

       155
       155
       +
       		// First token should be invalidated

     

       156
       156
       +
       		expect(verifyPasswordResetToken(token1)).toBeNull();

     

       157
       157
       +
       

     

       158
       158
       +
       		// Second token should work

     

       159
       159
       +
       		expect(verifyPasswordResetToken(token2)).toBe(userId);

     

       160
       160
       +
       	});

     

       161
       161
       +
       });

+97

src/lib/email.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Email service using MailChannels API

     

       3
       3
       +
        * Docs: https://api.mailchannels.net/tx/v1/documentation

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       interface EmailAddress {

     

       7
       7
       +
       	email: string;

     

       8
       8
       +
       	name?: string;

     

       9
       9
       +
       }

     

       10
       10
       +
       

     

       11
       11
       +
       interface EmailContent {

     

       12
       12
       +
       	type: "text/plain" | "text/html";

     

       13
       13
       +
       	value: string;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       interface SendEmailOptions {

     

       17
       17
       +
       	to: string | EmailAddress;

     

       18
       18
       +
       	subject: string;

     

       19
       19
       +
       	html?: string;

     

       20
       20
       +
       	text?: string;

     

       21
       21
       +
       	replyTo?: string;

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       /**

     

       25
       25
       +
        * Send an email via MailChannels

     

       26
       26
       +
        */

     

       27
       27
       +
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       28
       +
       	// Skip sending emails in test mode

     

       29
       29
       +
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       30
       +
       		console.log(

     

       31
       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       32
       +
       		);

     

       33
       33
       +
       		return;

     

       34
       34
       +
       	}

     

       35
       35
       +
       

     

       36
       36
       +
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       37
       37
       +
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       38
       38
       +
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

     

       39
       39
       +
       	// Validated at startup

     

       40
       40
       +
       	const dkimPrivateKey = process.env.DKIM_PRIVATE_KEY as string;

     

       41
       41
       +
       	const mailchannelsApiKey = process.env.MAILCHANNELS_API_KEY as string;

     

       42
       42
       +
       

     

       43
       43
       +
       	// Normalize recipient

     

       44
       44
       +
       	const recipient =

     

       45
       45
       +
       		typeof options.to === "string" ? { email: options.to } : options.to;

     

       46
       46
       +
       

     

       47
       47
       +
       	// Build content array

     

       48
       48
       +
       	const content: EmailContent[] = [];

     

       49
       49
       +
       	if (options.text) {

     

       50
       50
       +
       		content.push({ type: "text/plain", value: options.text });

     

       51
       51
       +
       	}

     

       52
       52
       +
       	if (options.html) {

     

       53
       53
       +
       		content.push({ type: "text/html", value: options.html });

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	if (content.length === 0) {

     

       57
       57
       +
       		throw new Error("At least one of 'text' or 'html' must be provided");

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	const payload = {

     

       61
       61
       +
       		personalizations: [

     

       62
       62
       +
       			{

     

       63
       63
       +
       				to: [recipient],

     

       64
       64
       +
       				...(options.replyTo && {

     

       65
       65
       +
       					reply_to: { email: options.replyTo },

     

       66
       66
       +
       				}),

     

       67
       67
       +
       				dkim_domain: dkimDomain,

     

       68
       68
       +
       				dkim_selector: "mailchannels",

     

       69
       69
       +
       				dkim_private_key: dkimPrivateKey,

     

       70
       70
       +
       			},

     

       71
       71
       +
       		],

     

       72
       72
       +
       		from: {

     

       73
       73
       +
       			email: fromEmail,

     

       74
       74
       +
       			name: fromName,

     

       75
       75
       +
       		},

     

       76
       76
       +
       		subject: options.subject,

     

       77
       77
       +
       		content,

     

       78
       78
       +
       	};

     

       79
       79
       +
       

     

       80
       80
       +
       	const response = await fetch("https://api.mailchannels.net/tx/v1/send", {

     

       81
       81
       +
       		method: "POST",

     

       82
       82
       +
       		headers: {

     

       83
       83
       +
       			"content-type": "application/json",

     

       84
       84
       +
       			"X-Api-Key": mailchannelsApiKey,

     

       85
       85
       +
       		},

     

       86
       86
       +
       		body: JSON.stringify(payload),

     

       87
       87
       +
       	});

     

       88
       88
       +
       

     

       89
       89
       +
       	if (!response.ok) {

     

       90
       90
       +
       		const errorText = await response.text();

     

       91
       91
       +
       		throw new Error(

     

       92
       92
       +
       			`MailChannels API error (${response.status}): ${errorText}`,

     

       93
       93
       +
       		);

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	console.log(`[Email] Sent "${options.subject}" to ${recipient.email}`);

     

       97
       97
       +
       }

+20

src/lib/rate-limit.ts

···

       109
       109
        
       	return null; // Allowed

     

       110
       110
        
       }

     

       111
       111
        
       

     

       112
       112
       +
       export function clearRateLimit(

     

       113
       113
       +
       	endpoint: string,

     

       114
       114
       +
       	email?: string,

     

       115
       115
       +
       	ipAddress?: string,

     

       116
       116
       +
       ): void {

     

       117
       117
       +
       	// Clear account-based rate limits

     

       118
       118
       +
       	if (email) {

     

       119
       119
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       120
       120
       +
       			`${endpoint}:account:${email.toLowerCase()}`,

     

       121
       121
       +
       		]);

     

       122
       122
       +
       	}

     

       123
       123
       +
       

     

       124
       124
       +
       	// Clear IP-based rate limits

     

       125
       125
       +
       	if (ipAddress) {

     

       126
       126
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       127
       127
       +
       			`${endpoint}:ip:${ipAddress}`,

     

       128
       128
       +
       		]);

     

       129
       129
       +
       	}

     

       130
       130
       +
       }

     

       131
       131
       +
       

     

       112
       132
        
       export function cleanupOldAttempts(olderThanSeconds = 86400) {

     

       113
       133
        
       	// Clean up attempts older than specified time (default: 24 hours)

     

       114
       134
        
       	const cutoff = Math.floor(Date.now() / 1000) - olderThanSeconds;

+2 -2

src/lib/subscription-routes.test.ts

···

       29
       29
        
       			headers: { Cookie: sessionCookie },

     

       30
       30
        
       		});

     

       31
       31
        
       

     

       32
       32
       -
       		expect(response.status).toBe(500);

     

       32
       32
       +
       		expect(response.status).toBe(403);

     

       33
       33
        
       		const data = await response.json();

     

       34
       34
        
       		expect(data.error).toContain("subscription");

     

       35
       35
        
       	});

     
···

       74
       74
        
       			body: formData,

     

       75
       75
        
       		});

     

       76
       76
        
       

     

       77
       77
       -
       		expect(response.status).toBe(500);

     

       77
       77
       +
       		expect(response.status).toBe(403);

     

       78
       78
        
       		const data = await response.json();

     

       79
       79
        
       		expect(data.error).toContain("subscription");

     

       80
       80
        
       	});

+44 -4

src/lib/transcription.ts

···

       500
       500
        
       		}

     

       501
       501
        
       	}

     

       502
       502
        
       

     

       503
       503
       +
       	private async deleteWhisperJob(jobId: string) {

     

       504
       504
       +
       		try {

     

       505
       505
       +
       			const response = await fetch(`${this.serviceUrl}/transcribe/${jobId}`, {

     

       506
       506
       +
       				method: "DELETE",

     

       507
       507
       +
       			});

     

       508
       508
       +
       			if (response.ok) {

     

       509
       509
       +
       				console.log(`[Cleanup] Deleted job ${jobId} from Murmur`);

     

       510
       510
       +
       			} else {

     

       511
       511
       +
       				console.warn(

     

       512
       512
       +
       					`[Cleanup] Failed to delete job ${jobId}: ${response.status}`,

     

       513
       513
       +
       				);

     

       514
       514
       +
       			}

     

       515
       515
       +
       		} catch (error) {

     

       516
       516
       +
       			console.error(`[Cleanup] Error deleting job ${jobId}:`, error);

     

       517
       517
       +
       		}

     

       518
       518
       +
       	}

     

       519
       519
       +
       

     

       503
       520
        
       	private async handleOrphanedWhisperJob(jobId: string) {

     

       504
       521
        
       		// Check if this Murmur job_id exists in our DB (either as id or whisper_job_id)

     

       505
       522
        
       		const jobExists = this.db

     
···

       509
       526
        
       			.get(jobId, jobId);

     

       510
       527
        
       

     

       511
       528
        
       		if (!jobExists) {

     

       512
       512
       -
       			// Not our job - Murmur will keep it until explicitly deleted

     

       529
       529
       +
       			// Not our job - delete it from Murmur

     

       513
       530
        
       			console.warn(

     

       514
       514
       -
       				`[Sync] Found orphaned job ${jobId} in Murmur (not in our DB)`,

     

       531
       531
       +
       				`[Sync] Found orphaned job ${jobId} in Murmur (not in our DB) - deleting...`,

     

       515
       532
        
       			);

     

       533
       533
       +
       			await this.deleteWhisperJob(jobId);

     

       516
       534
        
       		}

     

       517
       535
        
       	}

     

       518
       536
        
       

     
···

       564
       582
        
       					status: "completed",

     

       565
       583
        
       					progress: 100,

     

       566
       584
        
       				});

     

       585
       585
       +
       

     

       586
       586
       +
       				// Clean up job from Murmur after successful completion

     

       587
       587
       +
       				await this.deleteWhisperJob(whisperJob.id);

     

       567
       588
        
       			} else if (details.status === "failed") {

     

       568
       589
        
       				const errorMessage = (

     

       569
       590
        
       					details.error_message ?? "Transcription failed"

     
···

       579
       600
        
       					progress: 0,

     

       580
       601
        
       					error_message: errorMessage,

     

       581
       602
        
       				});

     

       603
       603
       +
       

     

       604
       604
       +
       				// Clean up failed job from Murmur

     

       605
       605
       +
       				await this.deleteWhisperJob(whisperJob.id);

     

       582
       606
        
       			}

     

       583
       583
       -
       

     

       584
       584
       -
       			// Job persists in Murmur until explicitly deleted - we just sync state

     

       585
       607
        
       		} catch {

     

       586
       608
        
       			console.warn(

     

       587
       609
        
       				`[Sync] Failed to retrieve details for job ${whisperJob.id}`,

     
···

       646
       668
        
       		} catch (error) {

     

       647
       669
        
       			console.error("[Cleanup] Failed:", error);

     

       648
       670
        
       		}

     

       671
       671
       +
       	}

     

       672
       672
       +
       

     

       673
       673
       +
       	stop(): void {

     

       674
       674
       +
       		console.log("[Transcription] Closing active streams...");

     

       675
       675
       +
       		// Close all active SSE streams to Murmur

     

       676
       676
       +
       		for (const [transcriptionId, stream] of this.activeStreams.entries()) {

     

       677
       677
       +
       			try {

     

       678
       678
       +
       				stream.close();

     

       679
       679
       +
       				this.streamLocks.delete(transcriptionId);

     

       680
       680
       +
       			} catch (error) {

     

       681
       681
       +
       				console.error(

     

       682
       682
       +
       					`[Transcription] Error closing stream ${transcriptionId}:`,

     

       683
       683
       +
       					error,

     

       684
       684
       +
       				);

     

       685
       685
       +
       			}

     

       686
       686
       +
       		}

     

       687
       687
       +
       		this.activeStreams.clear();

     

       688
       688
       +
       		console.log("[Transcription] All streams closed");

     

       649
       689
        
       	}

     

       650
       690
        
       }

+118

src/lib/validation.test.ts

···

       1
       1
       +
       import { expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	validateClassId,

     

       4
       4
       +
       	validateCourseCode,

     

       5
       5
       +
       	validateCourseName,

     

       6
       6
       +
       	validateEmail,

     

       7
       7
       +
       	validateName,

     

       8
       8
       +
       	validatePasswordHash,

     

       9
       9
       +
       	validateSemester,

     

       10
       10
       +
       	validateYear,

     

       11
       11
       +
       } from "./validation";

     

       12
       12
       +
       

     

       13
       13
       +
       test("validateEmail accepts valid emails", () => {

     

       14
       14
       +
       	expect(validateEmail("test@example.com").valid).toBe(true);

     

       15
       15
       +
       	expect(validateEmail("user.name+tag@example.co.uk").valid).toBe(true);

     

       16
       16
       +
       	expect(validateEmail("test@subdomain.example.com").valid).toBe(true);

     

       17
       17
       +
       });

     

       18
       18
       +
       

     

       19
       19
       +
       test("validateEmail rejects invalid emails", () => {

     

       20
       20
       +
       	expect(validateEmail("").valid).toBe(false);

     

       21
       21
       +
       	expect(validateEmail("not-an-email").valid).toBe(false);

     

       22
       22
       +
       	expect(validateEmail("@example.com").valid).toBe(false);

     

       23
       23
       +
       	expect(validateEmail("test@").valid).toBe(false);

     

       24
       24
       +
       	expect(validateEmail("a".repeat(321)).valid).toBe(false); // Too long

     

       25
       25
       +
       	expect(validateEmail(123).valid).toBe(false); // Not a string

     

       26
       26
       +
       });

     

       27
       27
       +
       

     

       28
       28
       +
       test("validateName accepts valid names", () => {

     

       29
       29
       +
       	expect(validateName("John Doe").valid).toBe(true);

     

       30
       30
       +
       	expect(validateName("Alice").valid).toBe(true);

     

       31
       31
       +
       	expect(validateName("María García").valid).toBe(true);

     

       32
       32
       +
       });

     

       33
       33
       +
       

     

       34
       34
       +
       test("validateName rejects invalid names", () => {

     

       35
       35
       +
       	expect(validateName("").valid).toBe(false);

     

       36
       36
       +
       	expect(validateName("   ").valid).toBe(false); // Whitespace only

     

       37
       37
       +
       	expect(validateName("a".repeat(256)).valid).toBe(false); // Too long

     

       38
       38
       +
       	expect(validateName(123).valid).toBe(false); // Not a string

     

       39
       39
       +
       });

     

       40
       40
       +
       

     

       41
       41
       +
       test("validatePasswordHash accepts valid PBKDF2 hashes", () => {

     

       42
       42
       +
       	const validHash = "a".repeat(64); // 64 char hex string

     

       43
       43
       +
       	expect(validatePasswordHash(validHash).valid).toBe(true);

     

       44
       44
       +
       	expect(validatePasswordHash("0123456789abcdef".repeat(4)).valid).toBe(true);

     

       45
       45
       +
       });

     

       46
       46
       +
       

     

       47
       47
       +
       test("validatePasswordHash rejects invalid hashes", () => {

     

       48
       48
       +
       	expect(validatePasswordHash("short").valid).toBe(false);

     

       49
       49
       +
       	expect(validatePasswordHash("a".repeat(63)).valid).toBe(false); // Too short

     

       50
       50
       +
       	expect(validatePasswordHash("a".repeat(65)).valid).toBe(false); // Too long

     

       51
       51
       +
       	expect(validatePasswordHash("g".repeat(64)).valid).toBe(false); // Invalid hex

     

       52
       52
       +
       	expect(validatePasswordHash(123).valid).toBe(false); // Not a string

     

       53
       53
       +
       });

     

       54
       54
       +
       

     

       55
       55
       +
       test("validateCourseCode accepts valid course codes", () => {

     

       56
       56
       +
       	expect(validateCourseCode("CS101").valid).toBe(true);

     

       57
       57
       +
       	expect(validateCourseCode("MATH 2410").valid).toBe(true);

     

       58
       58
       +
       	expect(validateCourseCode("BIO-101").valid).toBe(true);

     

       59
       59
       +
       });

     

       60
       60
       +
       

     

       61
       61
       +
       test("validateCourseCode rejects invalid course codes", () => {

     

       62
       62
       +
       	expect(validateCourseCode("").valid).toBe(false);

     

       63
       63
       +
       	expect(validateCourseCode("   ").valid).toBe(false);

     

       64
       64
       +
       	expect(validateCourseCode("a".repeat(51)).valid).toBe(false); // Too long

     

       65
       65
       +
       	expect(validateCourseCode(123).valid).toBe(false); // Not a string

     

       66
       66
       +
       });

     

       67
       67
       +
       

     

       68
       68
       +
       test("validateCourseName accepts valid course names", () => {

     

       69
       69
       +
       	expect(validateCourseName("Introduction to Computer Science").valid).toBe(

     

       70
       70
       +
       		true,

     

       71
       71
       +
       	);

     

       72
       72
       +
       	expect(validateCourseName("Calculus I").valid).toBe(true);

     

       73
       73
       +
       });

     

       74
       74
       +
       

     

       75
       75
       +
       test("validateCourseName rejects invalid course names", () => {

     

       76
       76
       +
       	expect(validateCourseName("").valid).toBe(false);

     

       77
       77
       +
       	expect(validateCourseName("   ").valid).toBe(false);

     

       78
       78
       +
       	expect(validateCourseName("a".repeat(501)).valid).toBe(false); // Too long

     

       79
       79
       +
       	expect(validateCourseName(123).valid).toBe(false); // Not a string

     

       80
       80
       +
       });

     

       81
       81
       +
       

     

       82
       82
       +
       test("validateSemester accepts valid semesters", () => {

     

       83
       83
       +
       	expect(validateSemester("Fall").valid).toBe(true);

     

       84
       84
       +
       	expect(validateSemester("spring").valid).toBe(true); // Case insensitive

     

       85
       85
       +
       	expect(validateSemester("SUMMER").valid).toBe(true);

     

       86
       86
       +
       	expect(validateSemester("Winter").valid).toBe(true);

     

       87
       87
       +
       });

     

       88
       88
       +
       

     

       89
       89
       +
       test("validateSemester rejects invalid semesters", () => {

     

       90
       90
       +
       	expect(validateSemester("").valid).toBe(false);

     

       91
       91
       +
       	expect(validateSemester("Invalid").valid).toBe(false);

     

       92
       92
       +
       	expect(validateSemester("Autumn").valid).toBe(false);

     

       93
       93
       +
       	expect(validateSemester(123).valid).toBe(false); // Not a string

     

       94
       94
       +
       });

     

       95
       95
       +
       

     

       96
       96
       +
       test("validateYear accepts valid years", () => {

     

       97
       97
       +
       	const currentYear = new Date().getFullYear();

     

       98
       98
       +
       	expect(validateYear(currentYear).valid).toBe(true);

     

       99
       99
       +
       	expect(validateYear(2024).valid).toBe(true);

     

       100
       100
       +
       	expect(validateYear(currentYear + 1).valid).toBe(true);

     

       101
       101
       +
       });

     

       102
       102
       +
       

     

       103
       103
       +
       test("validateYear rejects invalid years", () => {

     

       104
       104
       +
       	expect(validateYear(1999).valid).toBe(false); // Too old

     

       105
       105
       +
       	expect(validateYear(2050).valid).toBe(false); // Too far in future

     

       106
       106
       +
       	expect(validateYear("2024").valid).toBe(false); // Not a number

     

       107
       107
       +
       });

     

       108
       108
       +
       

     

       109
       109
       +
       test("validateClassId accepts valid class IDs", () => {

     

       110
       110
       +
       	expect(validateClassId("abc123").valid).toBe(true);

     

       111
       111
       +
       	expect(validateClassId("class-2024-fall").valid).toBe(true);

     

       112
       112
       +
       });

     

       113
       113
       +
       

     

       114
       114
       +
       test("validateClassId rejects invalid class IDs", () => {

     

       115
       115
       +
       	expect(validateClassId("").valid).toBe(false);

     

       116
       116
       +
       	expect(validateClassId("a".repeat(101)).valid).toBe(false); // Too long

     

       117
       117
       +
       	expect(validateClassId(123).valid).toBe(false); // Not a string

     

       118
       118
       +
       });

+223

src/lib/validation.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Input validation utilities

     

       3
       3
       +
        */

     

       4
       4
       +
       

     

       5
       5
       +
       // RFC 5322 compliant email regex (simplified but comprehensive)

     

       6
       6
       +
       const EMAIL_REGEX =

     

       7
       7
       +
       	/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;

     

       8
       8
       +
       

     

       9
       9
       +
       // Validation limits

     

       10
       10
       +
       export const VALIDATION_LIMITS = {

     

       11
       11
       +
       	EMAIL_MAX: 320, // RFC 5321

     

       12
       12
       +
       	NAME_MAX: 255,

     

       13
       13
       +
       	PASSWORD_HASH_LENGTH: 64, // PBKDF2 hex output

     

       14
       14
       +
       	COURSE_CODE_MAX: 50,

     

       15
       15
       +
       	COURSE_NAME_MAX: 500,

     

       16
       16
       +
       	PROFESSOR_NAME_MAX: 255,

     

       17
       17
       +
       	SEMESTER_MAX: 50,

     

       18
       18
       +
       	CLASS_ID_MAX: 100,

     

       19
       19
       +
       };

     

       20
       20
       +
       

     

       21
       21
       +
       export interface ValidationResult {

     

       22
       22
       +
       	valid: boolean;

     

       23
       23
       +
       	error?: string;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       /**

     

       27
       27
       +
        * Validate email address

     

       28
       28
       +
        */

     

       29
       29
       +
       export function validateEmail(email: unknown): ValidationResult {

     

       30
       30
       +
       	if (typeof email !== "string") {

     

       31
       31
       +
       		return { valid: false, error: "Email must be a string" };

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	const trimmed = email.trim();

     

       35
       35
       +
       

     

       36
       36
       +
       	if (trimmed.length === 0) {

     

       37
       37
       +
       		return { valid: false, error: "Email is required" };

     

       38
       38
       +
       	}

     

       39
       39
       +
       

     

       40
       40
       +
       	if (trimmed.length > VALIDATION_LIMITS.EMAIL_MAX) {

     

       41
       41
       +
       		return {

     

       42
       42
       +
       			valid: false,

     

       43
       43
       +
       			error: `Email must be less than ${VALIDATION_LIMITS.EMAIL_MAX} characters`,

     

       44
       44
       +
       		};

     

       45
       45
       +
       	}

     

       46
       46
       +
       

     

       47
       47
       +
       	if (!EMAIL_REGEX.test(trimmed)) {

     

       48
       48
       +
       		return { valid: false, error: "Invalid email format" };

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	return { valid: true };

     

       52
       52
       +
       }

     

       53
       53
       +
       

     

       54
       54
       +
       /**

     

       55
       55
       +
        * Validate name (user name, professor name, etc.)

     

       56
       56
       +
        */

     

       57
       57
       +
       export function validateName(

     

       58
       58
       +
       	name: unknown,

     

       59
       59
       +
       	fieldName = "Name",

     

       60
       60
       +
       ): ValidationResult {

     

       61
       61
       +
       	if (typeof name !== "string") {

     

       62
       62
       +
       		return { valid: false, error: `${fieldName} must be a string` };

     

       63
       63
       +
       	}

     

       64
       64
       +
       

     

       65
       65
       +
       	const trimmed = name.trim();

     

       66
       66
       +
       

     

       67
       67
       +
       	if (trimmed.length === 0) {

     

       68
       68
       +
       		return { valid: false, error: `${fieldName} is required` };

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	if (trimmed.length > VALIDATION_LIMITS.NAME_MAX) {

     

       72
       72
       +
       		return {

     

       73
       73
       +
       			valid: false,

     

       74
       74
       +
       			error: `${fieldName} must be less than ${VALIDATION_LIMITS.NAME_MAX} characters`,

     

       75
       75
       +
       		};

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	return { valid: true };

     

       79
       79
       +
       }

     

       80
       80
       +
       

     

       81
       81
       +
       /**

     

       82
       82
       +
        * Validate password hash format (client-side PBKDF2)

     

       83
       83
       +
        */

     

       84
       84
       +
       export function validatePasswordHash(password: unknown): ValidationResult {

     

       85
       85
       +
       	if (typeof password !== "string") {

     

       86
       86
       +
       		return { valid: false, error: "Password must be a string" };

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	// Client sends PBKDF2 as hex string

     

       90
       90
       +
       	if (

     

       91
       91
       +
       		password.length !== VALIDATION_LIMITS.PASSWORD_HASH_LENGTH ||

     

       92
       92
       +
       		!/^[0-9a-f]+$/.test(password)

     

       93
       93
       +
       	) {

     

       94
       94
       +
       		return { valid: false, error: "Invalid password format" };

     

       95
       95
       +
       	}

     

       96
       96
       +
       

     

       97
       97
       +
       	return { valid: true };

     

       98
       98
       +
       }

     

       99
       99
       +
       

     

       100
       100
       +
       /**

     

       101
       101
       +
        * Validate course code

     

       102
       102
       +
        */

     

       103
       103
       +
       export function validateCourseCode(courseCode: unknown): ValidationResult {

     

       104
       104
       +
       	if (typeof courseCode !== "string") {

     

       105
       105
       +
       		return { valid: false, error: "Course code must be a string" };

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	const trimmed = courseCode.trim();

     

       109
       109
       +
       

     

       110
       110
       +
       	if (trimmed.length === 0) {

     

       111
       111
       +
       		return { valid: false, error: "Course code is required" };

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_CODE_MAX) {

     

       115
       115
       +
       		return {

     

       116
       116
       +
       			valid: false,

     

       117
       117
       +
       			error: `Course code must be less than ${VALIDATION_LIMITS.COURSE_CODE_MAX} characters`,

     

       118
       118
       +
       		};

     

       119
       119
       +
       	}

     

       120
       120
       +
       

     

       121
       121
       +
       	return { valid: true };

     

       122
       122
       +
       }

     

       123
       123
       +
       

     

       124
       124
       +
       /**

     

       125
       125
       +
        * Validate course/class name

     

       126
       126
       +
        */

     

       127
       127
       +
       export function validateCourseName(courseName: unknown): ValidationResult {

     

       128
       128
       +
       	if (typeof courseName !== "string") {

     

       129
       129
       +
       		return { valid: false, error: "Course name must be a string" };

     

       130
       130
       +
       	}

     

       131
       131
       +
       

     

       132
       132
       +
       	const trimmed = courseName.trim();

     

       133
       133
       +
       

     

       134
       134
       +
       	if (trimmed.length === 0) {

     

       135
       135
       +
       		return { valid: false, error: "Course name is required" };

     

       136
       136
       +
       	}

     

       137
       137
       +
       

     

       138
       138
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_NAME_MAX) {

     

       139
       139
       +
       		return {

     

       140
       140
       +
       			valid: false,

     

       141
       141
       +
       			error: `Course name must be less than ${VALIDATION_LIMITS.COURSE_NAME_MAX} characters`,

     

       142
       142
       +
       		};

     

       143
       143
       +
       	}

     

       144
       144
       +
       

     

       145
       145
       +
       	return { valid: true };

     

       146
       146
       +
       }

     

       147
       147
       +
       

     

       148
       148
       +
       /**

     

       149
       149
       +
        * Validate semester

     

       150
       150
       +
        */

     

       151
       151
       +
       export function validateSemester(semester: unknown): ValidationResult {

     

       152
       152
       +
       	if (typeof semester !== "string") {

     

       153
       153
       +
       		return { valid: false, error: "Semester must be a string" };

     

       154
       154
       +
       	}

     

       155
       155
       +
       

     

       156
       156
       +
       	const trimmed = semester.trim();

     

       157
       157
       +
       

     

       158
       158
       +
       	if (trimmed.length === 0) {

     

       159
       159
       +
       		return { valid: false, error: "Semester is required" };

     

       160
       160
       +
       	}

     

       161
       161
       +
       

     

       162
       162
       +
       	if (trimmed.length > VALIDATION_LIMITS.SEMESTER_MAX) {

     

       163
       163
       +
       		return {

     

       164
       164
       +
       			valid: false,

     

       165
       165
       +
       			error: `Semester must be less than ${VALIDATION_LIMITS.SEMESTER_MAX} characters`,

     

       166
       166
       +
       		};

     

       167
       167
       +
       	}

     

       168
       168
       +
       

     

       169
       169
       +
       	// Optional: validate it's a known semester value

     

       170
       170
       +
       	const validSemesters = ["fall", "spring", "summer", "winter"];

     

       171
       171
       +
       	if (!validSemesters.includes(trimmed.toLowerCase())) {

     

       172
       172
       +
       		return {

     

       173
       173
       +
       			valid: false,

     

       174
       174
       +
       			error: "Semester must be Fall, Spring, Summer, or Winter",

     

       175
       175
       +
       		};

     

       176
       176
       +
       	}

     

       177
       177
       +
       

     

       178
       178
       +
       	return { valid: true };

     

       179
       179
       +
       }

     

       180
       180
       +
       

     

       181
       181
       +
       /**

     

       182
       182
       +
        * Validate year

     

       183
       183
       +
        */

     

       184
       184
       +
       export function validateYear(year: unknown): ValidationResult {

     

       185
       185
       +
       	if (typeof year !== "number") {

     

       186
       186
       +
       		return { valid: false, error: "Year must be a number" };

     

       187
       187
       +
       	}

     

       188
       188
       +
       

     

       189
       189
       +
       	const currentYear = new Date().getFullYear();

     

       190
       190
       +
       	const minYear = 2000;

     

       191
       191
       +
       	const maxYear = currentYear + 5;

     

       192
       192
       +
       

     

       193
       193
       +
       	if (year < minYear || year > maxYear) {

     

       194
       194
       +
       		return {

     

       195
       195
       +
       			valid: false,

     

       196
       196
       +
       			error: `Year must be between ${minYear} and ${maxYear}`,

     

       197
       197
       +
       		};

     

       198
       198
       +
       	}

     

       199
       199
       +
       

     

       200
       200
       +
       	return { valid: true };

     

       201
       201
       +
       }

     

       202
       202
       +
       

     

       203
       203
       +
       /**

     

       204
       204
       +
        * Validate class ID format

     

       205
       205
       +
        */

     

       206
       206
       +
       export function validateClassId(classId: unknown): ValidationResult {

     

       207
       207
       +
       	if (typeof classId !== "string") {

     

       208
       208
       +
       		return { valid: false, error: "Class ID must be a string" };

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	if (classId.length === 0) {

     

       212
       212
       +
       		return { valid: false, error: "Class ID is required" };

     

       213
       213
       +
       	}

     

       214
       214
       +
       

     

       215
       215
       +
       	if (classId.length > VALIDATION_LIMITS.CLASS_ID_MAX) {

     

       216
       216
       +
       		return {

     

       217
       217
       +
       			valid: false,

     

       218
       218
       +
       			error: `Class ID must be less than ${VALIDATION_LIMITS.CLASS_ID_MAX} characters`,

     

       219
       219
       +
       		};

     

       220
       220
       +
       	}

     

       221
       221
       +
       

     

       222
       222
       +
       	return { valid: true };

     

       223
       223
       +
       }

+227

src/lib/voting.ts

···

       1
       1
       +
       import { nanoid } from "nanoid";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       

     

       4
       4
       +
       /**

     

       5
       5
       +
        * Vote for a recording

     

       6
       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       7
       +
        */

     

       8
       8
       +
       export function voteForRecording(

     

       9
       9
       +
       	transcriptionId: string,

     

       10
       10
       +
       	userId: number,

     

       11
       11
       +
       ): boolean {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		const voteId = nanoid();

     

       14
       14
       +
       		db.run(

     

       15
       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       17
       +
       		);

     

       18
       18
       +
       

     

       19
       19
       +
       		// Increment vote count on transcription

     

       20
       20
       +
       		db.run(

     

       21
       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       22
       +
       			[transcriptionId],

     

       23
       23
       +
       		);

     

       24
       24
       +
       

     

       25
       25
       +
       		return true;

     

       26
       26
       +
       	} catch (error) {

     

       27
       27
       +
       		// Unique constraint violation means user already voted

     

       28
       28
       +
       		if (

     

       29
       29
       +
       			error instanceof Error &&

     

       30
       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       31
       +
       		) {

     

       32
       32
       +
       			return false;

     

       33
       33
       +
       		}

     

       34
       34
       +
       		throw error;

     

       35
       35
       +
       	}

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       /**

     

       39
       39
       +
        * Remove vote for a recording

     

       40
       40
       +
        */

     

       41
       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       42
       +
       	const result = db.run(

     

       43
       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       44
       +
       		[transcriptionId, userId],

     

       45
       45
       +
       	);

     

       46
       46
       +
       

     

       47
       47
       +
       	if (result.changes > 0) {

     

       48
       48
       +
       		// Decrement vote count on transcription

     

       49
       49
       +
       		db.run(

     

       50
       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       51
       +
       			[transcriptionId],

     

       52
       52
       +
       		);

     

       53
       53
       +
       		return true;

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	return false;

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       /**

     

       60
       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       61
       +
        */

     

       62
       62
       +
       export function getUserVoteForMeeting(

     

       63
       63
       +
       	userId: number,

     

       64
       64
       +
       	classId: string,

     

       65
       65
       +
       	meetingTimeId: string,

     

       66
       66
       +
       ): string | null {

     

       67
       67
       +
       	const result = db

     

       68
       68
       +
       		.query<

     

       69
       69
       +
       			{ transcription_id: string },

     

       70
       70
       +
       			[number, string, string]

     

       71
       71
       +
       		>(

     

       72
       72
       +
       			`SELECT rv.transcription_id 

     

       73
       73
       +
              FROM recording_votes rv

     

       74
       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       75
       +
              WHERE rv.user_id = ? 

     

       76
       76
       +
                AND t.class_id = ? 

     

       77
       77
       +
                AND t.meeting_time_id = ?

     

       78
       78
       +
                AND t.status = 'pending'`,

     

       79
       79
       +
       		)

     

       80
       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       81
       +
       

     

       82
       82
       +
       	return result?.transcription_id || null;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       /**

     

       86
       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       87
       +
        */

     

       88
       88
       +
       export function getPendingRecordings(

     

       89
       89
       +
       	classId: string,

     

       90
       90
       +
       	meetingTimeId: string,

     

       91
       91
       +
       	sectionId?: string | null,

     

       92
       92
       +
       ) {

     

       93
       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       95
       +
              FROM transcriptions

     

       96
       96
       +
              WHERE class_id = ? 

     

       97
       97
       +
                AND meeting_time_id = ?

     

       98
       98
       +
                AND status = 'pending'`;

     

       99
       99
       +
       

     

       100
       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       101
       +
       

     

       102
       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       103
       +
       	if (sectionId !== undefined) {

     

       104
       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       105
       +
       		params.push(sectionId);

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       109
       +
       

     

       110
       110
       +
       	return db

     

       111
       111
       +
       		.query<

     

       112
       112
       +
       			{

     

       113
       113
       +
       				id: string;

     

       114
       114
       +
       				user_id: number;

     

       115
       115
       +
       				filename: string;

     

       116
       116
       +
       				original_filename: string;

     

       117
       117
       +
       				vote_count: number;

     

       118
       118
       +
       				created_at: number;

     

       119
       119
       +
       				section_id: string | null;

     

       120
       120
       +
       			},

     

       121
       121
       +
       			(string | null)[]

     

       122
       122
       +
       		>(query)

     

       123
       123
       +
       		.all(...params);

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       /**

     

       127
       127
       +
        * Get total enrolled users count for a class

     

       128
       128
       +
        */

     

       129
       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       130
       +
       	const result = db

     

       131
       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       133
       +
       		)

     

       134
       134
       +
       		.get(classId);

     

       135
       135
       +
       

     

       136
       136
       +
       	return result?.count || 0;

     

       137
       137
       +
       }

     

       138
       138
       +
       

     

       139
       139
       +
       /**

     

       140
       140
       +
        * Check if recording should be auto-submitted

     

       141
       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       142
       +
        */

     

       143
       143
       +
       export function checkAutoSubmit(

     

       144
       144
       +
       	classId: string,

     

       145
       145
       +
       	meetingTimeId: string,

     

       146
       146
       +
       	sectionId?: string | null,

     

       147
       147
       +
       ): string | null {

     

       148
       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       149
       +
       

     

       150
       150
       +
       	if (recordings.length === 0) {

     

       151
       151
       +
       		return null;

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       156
       +
       

     

       157
       157
       +
       	// Get the recording with most votes

     

       158
       158
       +
       	const topRecording = recordings[0];

     

       159
       159
       +
       	if (!topRecording) return null;

     

       160
       160
       +
       

     

       161
       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       163
       +
       

     

       164
       164
       +
       	// Auto-submit if:

     

       165
       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       169
       +
       

     

       170
       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       171
       +
       		console.log(

     

       172
       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       173
       +
       		);

     

       174
       174
       +
       		return topRecording.id;

     

       175
       175
       +
       	}

     

       176
       176
       +
       

     

       177
       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       178
       +
       		console.log(

     

       179
       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       180
       +
       		);

     

       181
       181
       +
       		return topRecording.id;

     

       182
       182
       +
       	}

     

       183
       183
       +
       

     

       184
       184
       +
       	return null;

     

       185
       185
       +
       }

     

       186
       186
       +
       

     

       187
       187
       +
       /**

     

       188
       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       189
       +
        */

     

       190
       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       191
       +
       	db.run(

     

       192
       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       193
       +
       		[transcriptionId],

     

       194
       194
       +
       	);

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       /**

     

       198
       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       199
       +
        */

     

       200
       200
       +
       export function deletePendingRecording(

     

       201
       201
       +
       	transcriptionId: string,

     

       202
       202
       +
       	userId: number,

     

       203
       203
       +
       	isAdmin: boolean,

     

       204
       204
       +
       ): boolean {

     

       205
       205
       +
       	// Check ownership if not admin

     

       206
       206
       +
       	if (!isAdmin) {

     

       207
       207
       +
       		const recording = db

     

       208
       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       210
       +
       			)

     

       211
       211
       +
       			.get(transcriptionId);

     

       212
       212
       +
       

     

       213
       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       214
       +
       			return false;

     

       215
       215
       +
       		}

     

       216
       216
       +
       

     

       217
       217
       +
       		// Only allow deleting pending recordings

     

       218
       218
       +
       		if (recording.status !== "pending") {

     

       219
       219
       +
       			return false;

     

       220
       220
       +
       		}

     

       221
       221
       +
       	}

     

       222
       222
       +
       

     

       223
       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       225
       +
       

     

       226
       226
       +
       	return true;

     

       227
       227
       +
       }

+10

src/lib/vtt-cleaner.test.ts

···

       55
       55
        
       

     

       56
       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       58
       +
       

     

       59
       59
       +
       	// Save and remove API key to avoid burning tokens

     

       60
       60
       +
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       61
       +
       	delete process.env.LLM_API_KEY;

     

       62
       62
       +
       

     

       58
       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       59
       64
        
       

     

       60
       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       66
       +
       

     

       67
       67
       +
       	// Restore original key

     

       68
       68
       +
       	if (originalKey) {

     

       69
       69
       +
       		process.env.LLM_API_KEY = originalKey;

     

       70
       70
       +
       	}

     

       61
       71
        
       });

     

       62
       72
        
       

     

       63
       73
        
       // AI integration test - skip by default to avoid burning credits

+8 -8

src/lib/vtt-cleaner.ts

···

       338
       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
       339
        
       	);

     

       340
       340
        
       

     

       341
       341
       -
       	const apiKey = process.env.LLM_API_KEY;

     

       342
       342
       -
       	const apiBaseUrl = process.env.LLM_API_BASE_URL;

     

       343
       343
       -
       	const model = process.env.LLM_MODEL;

     

       344
       344
       -
       

     

       345
       345
       -
       	if (!apiKey || !apiBaseUrl || !model) {

     

       346
       346
       -
       		console.warn(

     

       347
       347
       -
       			"[VTTCleaner] LLM configuration incomplete (need LLM_API_KEY, LLM_API_BASE_URL, LLM_MODEL), returning uncleaned VTT",

     

       348
       348
       -
       		);

     

       341
       341
       +
       	// Check if API key is available, return original if not

     

       342
       342
       +
       	if (!process.env.LLM_API_KEY) {

     

       343
       343
       +
       		console.warn("[VTTCleaner] LLM_API_KEY not set, returning original VTT");

     

       349
       344
        
       		return vttContent;

     

       350
       345
        
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	// Validated at startup

     

       348
       348
       +
       	const apiKey = process.env.LLM_API_KEY as string;

     

       349
       349
       +
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

     

       350
       350
       +
       	const model = process.env.LLM_MODEL as string;

     

       351
       351
        
       

     

       352
       352
        
       	try {

     

       353
       353
        
       		// Build the input segments

+4 -250

src/pages/admin.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           main {

     

       15
       15
       -
             max-width: 80rem;

     

       16
       16
       -
             margin: 0 auto;

     

       17
       17
       -
             padding: 2rem;

     

       18
       18
       -
           }

     

       19
       19
       -
       

     

       20
       20
       -
           h1 {

     

       21
       21
       -
             margin-bottom: 2rem;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
           }

     

       24
       24
       -
       

     

       25
       25
       -
           .section {

     

       26
       26
       -
             margin-bottom: 3rem;

     

       27
       27
       -
           }

     

       28
       28
       -
       

     

       29
       29
       -
           .section-title {

     

       30
       30
       -
             font-size: 1.5rem;

     

       31
       31
       -
             font-weight: 600;

     

       32
       32
       -
             color: var(--text);

     

       33
       33
       -
             margin-bottom: 1rem;

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             align-items: center;

     

       36
       36
       -
             gap: 0.5rem;

     

       37
       37
       -
           }

     

       38
       38
       -
       

     

       39
       39
       -
           .tabs {

     

       40
       40
       -
             display: flex;

     

       41
       41
       -
             gap: 1rem;

     

       42
       42
       -
             border-bottom: 2px solid var(--secondary);

     

       43
       43
       -
             margin-bottom: 2rem;

     

       44
       44
       -
           }

     

       45
       45
       -
       

     

       46
       46
       -
           .tab {

     

       47
       47
       -
             padding: 0.75rem 1.5rem;

     

       48
       48
       -
             border: none;

     

       49
       49
       -
             background: transparent;

     

       50
       50
       -
             color: var(--text);

     

       51
       51
       -
             cursor: pointer;

     

       52
       52
       -
             font-size: 1rem;

     

       53
       53
       -
             font-weight: 500;

     

       54
       54
       -
             font-family: inherit;

     

       55
       55
       -
             border-bottom: 2px solid transparent;

     

       56
       56
       -
             margin-bottom: -2px;

     

       57
       57
       -
             transition: all 0.2s;

     

       58
       58
       -
           }

     

       59
       59
       -
       

     

       60
       60
       -
           .tab:hover {

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .tab.active {

     

       65
       65
       -
             color: var(--primary);

     

       66
       66
       -
             border-bottom-color: var(--primary);

     

       67
       67
       -
           }

     

       68
       68
       -
       

     

       69
       69
       -
           .tab-content {

     

       70
       70
       -
             display: none;

     

       71
       71
       -
           }

     

       72
       72
       -
       

     

       73
       73
       -
           .tab-content.active {

     

       74
       74
       -
             display: block;

     

       75
       75
       -
           }

     

       76
       76
       -
       

     

       77
       77
       -
           .empty-state {

     

       78
       78
       -
             text-align: center;

     

       79
       79
       -
             padding: 3rem;

     

       80
       80
       -
             color: var(--text);

     

       81
       81
       -
             opacity: 0.6;

     

       82
       82
       -
           }

     

       83
       83
       -
       

     

       84
       84
       -
           .loading {

     

       85
       85
       -
             text-align: center;

     

       86
       86
       -
             padding: 3rem;

     

       87
       87
       -
             color: var(--text);

     

       88
       88
       -
           }

     

       89
       89
       -
       

     

       90
       90
       -
           .error {

     

       91
       91
       -
             background: #fee2e2;

     

       92
       92
       -
             color: #991b1b;

     

       93
       93
       -
             padding: 1rem;

     

       94
       94
       -
             border-radius: 6px;

     

       95
       95
       -
             margin-bottom: 1rem;

     

       96
       96
       -
           }

     

       97
       97
       -
       

     

       98
       98
       -
           .stats {

     

       99
       99
       -
             display: grid;

     

       100
       100
       -
             grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       101
       101
       -
             gap: 1rem;

     

       102
       102
       -
             margin-bottom: 2rem;

     

       103
       103
       -
           }

     

       104
       104
       -
       

     

       105
       105
       -
           .stat-card {

     

       106
       106
       -
             background: var(--background);

     

       107
       107
       -
             border: 2px solid var(--secondary);

     

       108
       108
       -
             border-radius: 8px;

     

       109
       109
       -
             padding: 1.5rem;

     

       110
       110
       -
           }

     

       111
       111
       -
       

     

       112
       112
       -
           .stat-value {

     

       113
       113
       -
             font-size: 2rem;

     

       114
       114
       -
             font-weight: 700;

     

       115
       115
       -
             color: var(--primary);

     

       116
       116
       -
             margin-bottom: 0.25rem;

     

       117
       117
       -
           }

     

       118
       118
       -
       

     

       119
       119
       -
           .stat-label {

     

       120
       120
       -
             color: var(--text);

     

       121
       121
       -
             opacity: 0.7;

     

       122
       122
       -
             font-size: 0.875rem;

     

       123
       123
       -
           }

     

       124
       124
       -
       

     

       125
       125
       -
           .timestamp {

     

       126
       126
       -
             color: var(--text);

     

       127
       127
       -
             opacity: 0.6;

     

       128
       128
       -
             font-size: 0.875rem;

     

       129
       129
       -
           }

     

       130
       130
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/admin.css">

     

       131
       14
        
       </head>

     

       132
       15
        
       

     

       133
       16
        
       <body>

     
···

       144
       27
        
         <main>

     

       145
       28
        
           <h1>Admin Dashboard</h1>

     

       146
       29
        
       

     

       147
       147
       -
           <div id="error-message" class="error" style="display: none;"></div>

     

       30
       30
       +
           <div id="error-message" class="error hidden"></div>

     

       148
       31
        
       

     

       149
       32
        
           <div id="loading" class="loading">Loading...</div>

     

       150
       33
        
       

     

       151
       151
       -
           <div id="content" style="display: none;">

     

       34
       34
       +
           <div id="content" class="hidden">

     

       152
       35
        
             <div class="stats">

     

       153
       36
        
               <div class="stat-card">

     

       154
       37
        
                 <div class="stat-value" id="total-users">0</div>

     
···

       211
       94
        
         <script type="module" src="../components/admin-classes.ts"></script>

     

       212
       95
        
         <script type="module" src="../components/user-modal.ts"></script>

     

       213
       96
        
         <script type="module" src="../components/transcript-view-modal.ts"></script>

     

       214
       214
       -
         <script type="module">

     

       215
       215
       -
           const transcriptionsComponent = document.getElementById('transcriptions-component');

     

       216
       216
       -
           const usersComponent = document.getElementById('users-component');

     

       217
       217
       -
           const userModal = document.getElementById('user-modal');

     

       218
       218
       -
           const transcriptModal = document.getElementById('transcript-modal');

     

       219
       219
       -
           const errorMessage = document.getElementById('error-message');

     

       220
       220
       -
           const loading = document.getElementById('loading');

     

       221
       221
       -
           const content = document.getElementById('content');

     

       222
       222
       -
       

     

       223
       223
       -
           // Modal functions

     

       224
       224
       -
           function openUserModal(userId) {

     

       225
       225
       -
             userModal.setAttribute('open', '');

     

       226
       226
       -
             userModal.userId = userId;

     

       227
       227
       -
           }

     

       228
       228
       -
       

     

       229
       229
       -
           function closeUserModal() {

     

       230
       230
       -
             userModal.removeAttribute('open');

     

       231
       231
       -
             userModal.userId = null;

     

       232
       232
       -
           }

     

       233
       233
       -
       

     

       234
       234
       -
           function openTranscriptModal(transcriptId) {

     

       235
       235
       -
             transcriptModal.setAttribute('open', '');

     

       236
       236
       -
             transcriptModal.transcriptId = transcriptId;

     

       237
       237
       -
           }

     

       238
       238
       -
       

     

       239
       239
       -
           function closeTranscriptModal() {

     

       240
       240
       -
             transcriptModal.removeAttribute('open');

     

       241
       241
       -
             transcriptModal.transcriptId = null;

     

       242
       242
       -
           }

     

       243
       243
       -
       

     

       244
       244
       -
           // Listen for component events

     

       245
       245
       -
           transcriptionsComponent.addEventListener('open-transcription', (e) => {

     

       246
       246
       -
             openTranscriptModal(e.detail.id);

     

       247
       247
       -
           });

     

       248
       248
       -
       

     

       249
       249
       -
           usersComponent.addEventListener('open-user', (e) => {

     

       250
       250
       -
             openUserModal(e.detail.id);

     

       251
       251
       -
           });

     

       252
       252
       -
       

     

       253
       253
       -
           // Listen for modal close events

     

       254
       254
       -
           userModal.addEventListener('close', closeUserModal);

     

       255
       255
       -
           userModal.addEventListener('user-updated', async () => {

     

       256
       256
       -
             await loadStats();

     

       257
       257
       -
           });

     

       258
       258
       -
           userModal.addEventListener('click', (e) => {

     

       259
       259
       -
             if (e.target === userModal) closeUserModal();

     

       260
       260
       -
           });

     

       261
       261
       -
       

     

       262
       262
       -
           transcriptModal.addEventListener('close', closeTranscriptModal);

     

       263
       263
       -
           transcriptModal.addEventListener('transcript-deleted', async () => {

     

       264
       264
       -
             await loadStats();

     

       265
       265
       -
           });

     

       266
       266
       -
           transcriptModal.addEventListener('click', (e) => {

     

       267
       267
       -
             if (e.target === transcriptModal) closeTranscriptModal();

     

       268
       268
       -
           });

     

       269
       269
       -
       

     

       270
       270
       -
           async function loadStats() {

     

       271
       271
       -
             try {

     

       272
       272
       -
               const [transcriptionsRes, usersRes] = await Promise.all([

     

       273
       273
       -
                 fetch('/api/admin/transcriptions'),

     

       274
       274
       -
                 fetch('/api/admin/users')

     

       275
       275
       -
               ]);

     

       276
       276
       -
       

     

       277
       277
       -
               if (!transcriptionsRes.ok || !usersRes.ok) {

     

       278
       278
       -
                 if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       279
       279
       -
                   window.location.href = '/';

     

       280
       280
       -
                   return;

     

       281
       281
       -
                 }

     

       282
       282
       -
                 throw new Error('Failed to load admin data');

     

       283
       283
       -
               }

     

       284
       284
       -
       

     

       285
       285
       -
               const transcriptions = await transcriptionsRes.json();

     

       286
       286
       -
               const users = await usersRes.json();

     

       287
       287
       -
       

     

       288
       288
       -
               document.getElementById('total-users').textContent = users.length;

     

       289
       289
       -
               document.getElementById('total-transcriptions').textContent = transcriptions.length;

     

       290
       290
       -
               

     

       291
       291
       -
               const failed = transcriptions.filter(t => t.status === 'failed');

     

       292
       292
       -
               document.getElementById('failed-transcriptions').textContent = failed.length;

     

       293
       293
       -
       

     

       294
       294
       -
               loading.style.display = 'none';

     

       295
       295
       -
               content.style.display = 'block';

     

       296
       296
       -
             } catch (error) {

     

       297
       297
       -
               errorMessage.textContent = error.message;

     

       298
       298
       -
               errorMessage.style.display = 'block';

     

       299
       299
       -
               loading.style.display = 'none';

     

       300
       300
       -
             }

     

       301
       301
       -
           }

     

       302
       302
       -
       

     

       303
       303
       -
           // Tab switching

     

       304
       304
       -
           function switchTab(tabName) {

     

       305
       305
       -
             document.querySelectorAll('.tab').forEach(t => {

     

       306
       306
       -
               t.classList.remove('active');

     

       307
       307
       -
             });

     

       308
       308
       -
             document.querySelectorAll('.tab-content').forEach(c => {

     

       309
       309
       -
               c.classList.remove('active');

     

       310
       310
       -
             });

     

       311
       311
       -
       

     

       312
       312
       -
             const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       313
       313
       -
             const tabContent = document.getElementById(`${tabName}-tab`);

     

       314
       314
       -
             

     

       315
       315
       -
             if (tabButton && tabContent) {

     

       316
       316
       -
               tabButton.classList.add('active');

     

       317
       317
       -
               tabContent.classList.add('active');

     

       318
       318
       -
               

     

       319
       319
       -
               // Update URL without reloading

     

       320
       320
       -
               const url = new URL(window.location.href);

     

       321
       321
       -
               url.searchParams.set('tab', tabName);

     

       322
       322
       -
               window.history.pushState({}, '', url);

     

       323
       323
       -
             }

     

       324
       324
       -
           }

     

       325
       325
       -
       

     

       326
       326
       -
           document.querySelectorAll('.tab').forEach(tab => {

     

       327
       327
       -
             tab.addEventListener('click', () => {

     

       328
       328
       -
               switchTab(tab.dataset.tab);

     

       329
       329
       -
             });

     

       330
       330
       -
           });

     

       331
       331
       -
       

     

       332
       332
       -
           // Check for tab query parameter on load

     

       333
       333
       -
           const params = new URLSearchParams(window.location.search);

     

       334
       334
       -
           const initialTab = params.get('tab');

     

       335
       335
       -
           const validTabs = ['pending', 'transcriptions', 'users', 'classes'];

     

       336
       336
       -
           

     

       337
       337
       -
           if (initialTab && validTabs.includes(initialTab)) {

     

       338
       338
       -
             switchTab(initialTab);

     

       339
       339
       -
           }

     

       340
       340
       -
       

     

       341
       341
       -
           // Initialize

     

       342
       342
       -
           loadStats();

     

       343
       343
       -
         </script>

     

       97
       97
       +
         <script type="module" src="./admin.ts"></script>

     

       344
       98
        
       </body>

     

       345
       99
        
       

     

       346
       100
        
       </html>

+151

src/pages/admin.ts

···

       1
       1
       +
       const transcriptionsComponent = document.getElementById(

     

       2
       2
       +
       	"transcriptions-component",

     

       3
       3
       +
       ) as HTMLElement | null;

     

       4
       4
       +
       const usersComponent = document.getElementById(

     

       5
       5
       +
       	"users-component",

     

       6
       6
       +
       ) as HTMLElement | null;

     

       7
       7
       +
       const userModal = document.getElementById("user-modal") as HTMLElement | null;

     

       8
       8
       +
       const transcriptModal = document.getElementById(

     

       9
       9
       +
       	"transcript-modal",

     

       10
       10
       +
       ) as HTMLElement | null;

     

       11
       11
       +
       const errorMessage = document.getElementById("error-message") as HTMLElement;

     

       12
       12
       +
       const loading = document.getElementById("loading") as HTMLElement;

     

       13
       13
       +
       const content = document.getElementById("content") as HTMLElement;

     

       14
       14
       +
       

     

       15
       15
       +
       // Modal functions

     

       16
       16
       +
       function openUserModal(userId: string) {

     

       17
       17
       +
       	userModal.setAttribute("open", "");

     

       18
       18
       +
       	userModal.userId = userId;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       function closeUserModal() {

     

       22
       22
       +
       	userModal.removeAttribute("open");

     

       23
       23
       +
       	userModal.userId = null;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       function openTranscriptModal(transcriptId: string) {

     

       27
       27
       +
       	transcriptModal.setAttribute("open", "");

     

       28
       28
       +
       	transcriptModal.transcriptId = transcriptId;

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       function closeTranscriptModal() {

     

       32
       32
       +
       	transcriptModal.removeAttribute("open");

     

       33
       33
       +
       	transcriptModal.transcriptId = null;

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Listen for component events

     

       37
       37
       +
       transcriptionsComponent?.addEventListener(

     

       38
       38
       +
       	"open-transcription",

     

       39
       39
       +
       	(e: CustomEvent) => {

     

       40
       40
       +
       		openTranscriptModal(e.detail.id);

     

       41
       41
       +
       	},

     

       42
       42
       +
       );

     

       43
       43
       +
       

     

       44
       44
       +
       usersComponent?.addEventListener("open-user", (e: CustomEvent) => {

     

       45
       45
       +
       	openUserModal(e.detail.id);

     

       46
       46
       +
       });

     

       47
       47
       +
       

     

       48
       48
       +
       // Listen for modal close events

     

       49
       49
       +
       userModal?.addEventListener("close", closeUserModal);

     

       50
       50
       +
       userModal?.addEventListener("user-updated", async () => {

     

       51
       51
       +
       	await loadStats();

     

       52
       52
       +
       });

     

       53
       53
       +
       userModal?.addEventListener("click", (e: MouseEvent) => {

     

       54
       54
       +
       	if (e.target === userModal) closeUserModal();

     

       55
       55
       +
       });

     

       56
       56
       +
       

     

       57
       57
       +
       transcriptModal?.addEventListener("close", closeTranscriptModal);

     

       58
       58
       +
       transcriptModal?.addEventListener("transcript-deleted", async () => {

     

       59
       59
       +
       	await loadStats();

     

       60
       60
       +
       });

     

       61
       61
       +
       transcriptModal?.addEventListener("click", (e: MouseEvent) => {

     

       62
       62
       +
       	if (e.target === transcriptModal) closeTranscriptModal();

     

       63
       63
       +
       });

     

       64
       64
       +
       

     

       65
       65
       +
       async function loadStats() {

     

       66
       66
       +
       	try {

     

       67
       67
       +
       		const [transcriptionsRes, usersRes] = await Promise.all([

     

       68
       68
       +
       			fetch("/api/admin/transcriptions"),

     

       69
       69
       +
       			fetch("/api/admin/users"),

     

       70
       70
       +
       		]);

     

       71
       71
       +
       

     

       72
       72
       +
       		if (!transcriptionsRes.ok || !usersRes.ok) {

     

       73
       73
       +
       			if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       74
       74
       +
       				window.location.href = "/";

     

       75
       75
       +
       				return;

     

       76
       76
       +
       			}

     

       77
       77
       +
       			throw new Error("Failed to load admin data");

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		const transcriptions = await transcriptionsRes.json();

     

       81
       81
       +
       		const users = await usersRes.json();

     

       82
       82
       +
       

     

       83
       83
       +
       		const totalUsers = document.getElementById("total-users");

     

       84
       84
       +
       		const totalTranscriptions = document.getElementById("total-transcriptions");

     

       85
       85
       +
       		const failedTranscriptions = document.getElementById(

     

       86
       86
       +
       			"failed-transcriptions",

     

       87
       87
       +
       		);

     

       88
       88
       +
       

     

       89
       89
       +
       		if (totalUsers) totalUsers.textContent = users.length.toString();

     

       90
       90
       +
       		if (totalTranscriptions)

     

       91
       91
       +
       			totalTranscriptions.textContent = transcriptions.length.toString();

     

       92
       92
       +
       

     

       93
       93
       +
       		const failed = transcriptions.filter(

     

       94
       94
       +
       			(t: { status: string }) => t.status === "failed",

     

       95
       95
       +
       		);

     

       96
       96
       +
       		if (failedTranscriptions)

     

       97
       97
       +
       			failedTranscriptions.textContent = failed.length.toString();

     

       98
       98
       +
       

     

       99
       99
       +
       		loading.classList.add("hidden");

     

       100
       100
       +
       		content.classList.remove("hidden");

     

       101
       101
       +
       	} catch (error) {

     

       102
       102
       +
       		errorMessage.textContent = (error as Error).message;

     

       103
       103
       +
       		errorMessage.classList.remove("hidden");

     

       104
       104
       +
       		loading.classList.add("hidden");

     

       105
       105
       +
       	}

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       // Tab switching

     

       109
       109
       +
       function switchTab(tabName: string) {

     

       110
       110
       +
       	document.querySelectorAll(".tab").forEach((t) => {

     

       111
       111
       +
       		t.classList.remove("active");

     

       112
       112
       +
       	});

     

       113
       113
       +
       	document.querySelectorAll(".tab-content").forEach((c) => {

     

       114
       114
       +
       		c.classList.remove("active");

     

       115
       115
       +
       	});

     

       116
       116
       +
       

     

       117
       117
       +
       	const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       118
       118
       +
       	const tabContent = document.getElementById(`${tabName}-tab`);

     

       119
       119
       +
       

     

       120
       120
       +
       	if (tabButton && tabContent) {

     

       121
       121
       +
       		tabButton.classList.add("active");

     

       122
       122
       +
       		tabContent.classList.add("active");

     

       123
       123
       +
       

     

       124
       124
       +
       		// Update URL without reloading

     

       125
       125
       +
       		const url = new URL(window.location.href);

     

       126
       126
       +
       		url.searchParams.set("tab", tabName);

     

       127
       127
       +
       		// Remove subtab param when leaving classes tab

     

       128
       128
       +
       		if (tabName !== "classes") {

     

       129
       129
       +
       			url.searchParams.delete("subtab");

     

       130
       130
       +
       		}

     

       131
       131
       +
       		window.history.pushState({}, "", url);

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       document.querySelectorAll(".tab").forEach((tab) => {

     

       136
       136
       +
       	tab.addEventListener("click", () => {

     

       137
       137
       +
       		switchTab((tab as HTMLElement).dataset.tab || "");

     

       138
       138
       +
       	});

     

       139
       139
       +
       });

     

       140
       140
       +
       

     

       141
       141
       +
       // Check for tab query parameter on load

     

       142
       142
       +
       const params = new URLSearchParams(window.location.search);

     

       143
       143
       +
       const initialTab = params.get("tab");

     

       144
       144
       +
       const validTabs = ["pending", "transcriptions", "users", "classes"];

     

       145
       145
       +
       

     

       146
       146
       +
       if (initialTab && validTabs.includes(initialTab)) {

     

       147
       147
       +
       	switchTab(initialTab);

     

       148
       148
       +
       }

     

       149
       149
       +
       

     

       150
       150
       +
       // Initialize

     

       151
       151
       +
       loadStats();

+2 -85

src/pages/index.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .hero-title {

     

       15
       15
       -
             font-size: 3rem;

     

       16
       16
       -
             font-weight: 700;

     

       17
       17
       -
             color: var(--text);

     

       18
       18
       -
             margin-bottom: 1rem;

     

       19
       19
       -
           }

     

       20
       20
       -
       

     

       21
       21
       -
           .hero-subtitle {

     

       22
       22
       -
             font-size: 1.25rem;

     

       23
       23
       -
             color: var(--text);

     

       24
       24
       -
             opacity: 0.8;

     

       25
       25
       -
             margin-bottom: 2rem;

     

       26
       26
       -
           }

     

       27
       27
       -
       

     

       28
       28
       -
           main {

     

       29
       29
       -
             text-align: center;

     

       30
       30
       -
             padding: 4rem 2rem;

     

       31
       31
       -
           }

     

       32
       32
       -
       

     

       33
       33
       -
           .cta-buttons {

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             gap: 1rem;

     

       36
       36
       -
             justify-content: center;

     

       37
       37
       -
             margin-top: 2rem;

     

       38
       38
       -
           }

     

       39
       39
       -
       

     

       40
       40
       -
           .btn {

     

       41
       41
       -
             padding: 0.75rem 1.5rem;

     

       42
       42
       -
             border-radius: 6px;

     

       43
       43
       -
             font-size: 1rem;

     

       44
       44
       -
             font-weight: 500;

     

       45
       45
       -
             cursor: pointer;

     

       46
       46
       -
             transition: all 0.2s;

     

       47
       47
       -
             font-family: inherit;

     

       48
       48
       -
             border: 2px solid;

     

       49
       49
       -
             text-decoration: none;

     

       50
       50
       -
             display: inline-block;

     

       51
       51
       -
           }

     

       52
       52
       -
       

     

       53
       53
       -
           .btn-primary {

     

       54
       54
       -
             background: var(--primary);

     

       55
       55
       -
             color: white;

     

       56
       56
       -
             border-color: var(--primary);

     

       57
       57
       -
           }

     

       58
       58
       -
       

     

       59
       59
       -
           .btn-primary:hover {

     

       60
       60
       -
             background: transparent;

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .btn-secondary {

     

       65
       65
       -
             background: transparent;

     

       66
       66
       -
             color: var(--text);

     

       67
       67
       -
             border-color: var(--secondary);

     

       68
       68
       -
           }

     

       69
       69
       -
       

     

       70
       70
       -
           .btn-secondary:hover {

     

       71
       71
       -
             border-color: var(--primary);

     

       72
       72
       -
             color: var(--primary);

     

       73
       73
       -
           }

     

       74
       74
       -
       

     

       75
       75
       -
           @media (max-width: 640px) {

     

       76
       76
       -
             .hero-title {

     

       77
       77
       -
               font-size: 2.5rem;

     

       78
       78
       -
             }

     

       79
       79
       -
       

     

       80
       80
       -
             .cta-buttons {

     

       81
       81
       -
               flex-direction: column;

     

       82
       82
       -
               align-items: center;

     

       83
       83
       -
             }

     

       84
       84
       -
           }

     

       85
       85
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/index.css">

     

       86
       14
        
       </head>

     

       87
       15
        
       

     

       88
       16
        
       <body>

     
···

       106
       34
        
         </main>

     

       107
       35
        
       

     

       108
       36
        
         <script type="module" src="../components/auth.ts"></script>

     

       109
       109
       -
         <script type="module">

     

       110
       110
       -
           document.getElementById('start-btn').addEventListener('click', async () => {

     

       111
       111
       -
             const authComponent = document.querySelector('auth-component');

     

       112
       112
       -
             const isLoggedIn = await authComponent.isAuthenticated();

     

       113
       113
       -
       

     

       114
       114
       -
             if (isLoggedIn) {

     

       115
       115
       -
               window.location.href = '/classes';

     

       116
       116
       -
             } else {

     

       117
       117
       -
               authComponent.openAuthModal();

     

       118
       118
       -
             }

     

       119
       119
       -
           });

     

       120
       120
       -
         </script>

     

       37
       37
       +
         <script type="module" src="./index.ts"></script>

     

       121
       38
        
       </body>

     

       122
       39
        
       

     

       123
       40
        
       </html>

+14

src/pages/index.ts

···

       1
       1
       +
       document.getElementById("start-btn")?.addEventListener("click", async () => {

     

       2
       2
       +
       	const authComponent = document.querySelector("auth-component");

     

       3
       3
       +
       	if (!authComponent) return;

     

       4
       4
       +
       

     

       5
       5
       +
       	const isLoggedIn = await (

     

       6
       6
       +
       		authComponent as { isAuthenticated: () => Promise<boolean> }

     

       7
       7
       +
       	).isAuthenticated();

     

       8
       8
       +
       

     

       9
       9
       +
       	if (isLoggedIn) {

     

       10
       10
       +
       		window.location.href = "/classes";

     

       11
       11
       +
       	} else {

     

       12
       12
       +
       		(authComponent as { openAuthModal: () => void }).openAuthModal();

     

       13
       13
       +
       	}

     

       14
       14
       +
       });

+36

src/pages/reset-password.html

···

       1
       1
       +
       <!DOCTYPE html>

     

       2
       2
       +
       <html lang="en">

     

       3
       3
       +
       

     

       4
       4
       +
       <head>

     

       5
       5
       +
         <meta charset="UTF-8">

     

       6
       6
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       +
         <title>Reset Password - Thistle</title>

     

       8
       8
       +
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
       9
       +
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

     

       10
       10
       +
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
       +
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
       +
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/reset-password.css">

     

       14
       14
       +
       </head>

     

       15
       15
       +
       

     

       16
       16
       +
       <body>

     

       17
       17
       +
         <header>

     

       18
       18
       +
           <div class="header-content">

     

       19
       19
       +
             <a href="/" class="site-title">

     

       20
       20
       +
               <img src="../../public/favicon/favicon-32x32.png" alt="Thistle logo">

     

       21
       21
       +
               <span>Thistle</span>

     

       22
       22
       +
             </a>

     

       23
       23
       +
             <auth-component></auth-component>

     

       24
       24
       +
           </div>

     

       25
       25
       +
         </header>

     

       26
       26
       +
       

     

       27
       27
       +
         <main>

     

       28
       28
       +
           <reset-password-form id="reset-form"></reset-password-form>

     

       29
       29
       +
         </main>

     

       30
       30
       +
       

     

       31
       31
       +
         <script type="module" src="../components/auth.ts"></script>

     

       32
       32
       +
         <script type="module" src="../components/reset-password-form.ts"></script>

     

       33
       33
       +
         <script type="module" src="./reset-password.ts"></script>

     

       34
       34
       +
       </body>

     

       35
       35
       +
       

     

       36
       36
       +
       </html>

+10

src/pages/reset-password.ts

···

       1
       1
       +
       // Wait for component to be defined before setting token

     

       2
       2
       +
       await customElements.whenDefined("reset-password-form");

     

       3
       3
       +
       

     

       4
       4
       +
       // Get token from URL and pass to component

     

       5
       5
       +
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       6
       +
       const token = urlParams.get("token");

     

       7
       7
       +
       const resetForm = document.getElementById("reset-form");

     

       8
       8
       +
       if (resetForm) {

     

       9
       9
       +
       	(resetForm as { token: string | null }).token = token;

     

       10
       10
       +
       }

+1 -6

src/pages/settings.html

···

       10
       10
        
       	<link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
       	<link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
       	<link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
       

     

       14
       14
       -
       	<style>

     

       15
       15
       -
       		main {

     

       16
       16
       -
       			max-width: 64rem;

     

       17
       17
       -
       		}

     

       18
       18
       -
       	</style>

     

       13
       13
       +
       	<link rel="stylesheet" href="../styles/settings.css">

     

       19
       14
        
       </head>

     

       20
       15
        
       

     

       21
       16
        
       <body>

+3 -21

src/pages/transcribe.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .page-header {

     

       15
       15
       -
             text-align: center;

     

       16
       16
       -
             margin-bottom: 3rem;

     

       17
       17
       -
           }

     

       18
       18
       -
       

     

       19
       19
       -
           .page-title {

     

       20
       20
       -
             font-size: 2.5rem;

     

       21
       21
       -
             font-weight: 700;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
             margin-bottom: 0.5rem;

     

       24
       24
       -
           }

     

       25
       25
       -
       

     

       26
       26
       -
           .page-subtitle {

     

       27
       27
       -
             font-size: 1.125rem;

     

       28
       28
       -
             color: var(--text);

     

       29
       29
       -
             opacity: 0.8;

     

       30
       30
       -
           }

     

       31
       31
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/transcribe.css">

     

       32
       14
        
       </head>

     

       33
       15
        
       

     

       34
       16
        
       <body>

     
···

       43
       25
        
         </header>

     

       44
       26
        
       

     

       45
       27
        
         <main>

     

       46
       46
       -
           <div style="margin-bottom: 1rem;">

     

       47
       47
       -
             <a href="/classes" style="color: var(--paynes-gray); text-decoration: none; font-size: 0.875rem;">

     

       28
       28
       +
           <div class="mb-1">

     

       29
       29
       +
             <a href="/classes" class="back-link">

     

       48
       30
        
               ← Back to classes

     

       49
       31
        
             </a>

     

       50
       32
        
           </div>

+120

src/styles/admin.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 80rem;

     

       3
       3
       +
       	margin: 0 auto;

     

       4
       4
       +
       	padding: 2rem;

     

       5
       5
       +
       }

     

       6
       6
       +
       

     

       7
       7
       +
       h1 {

     

       8
       8
       +
       	margin-bottom: 2rem;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       }

     

       11
       11
       +
       

     

       12
       12
       +
       .section {

     

       13
       13
       +
       	margin-bottom: 3rem;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       .section-title {

     

       17
       17
       +
       	font-size: 1.5rem;

     

       18
       18
       +
       	font-weight: 600;

     

       19
       19
       +
       	color: var(--text);

     

       20
       20
       +
       	margin-bottom: 1rem;

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	align-items: center;

     

       23
       23
       +
       	gap: 0.5rem;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       .tabs {

     

       27
       27
       +
       	display: flex;

     

       28
       28
       +
       	gap: 1rem;

     

       29
       29
       +
       	border-bottom: 2px solid var(--secondary);

     

       30
       30
       +
       	margin-bottom: 2rem;

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       .tab {

     

       34
       34
       +
       	padding: 0.75rem 1.5rem;

     

       35
       35
       +
       	border: none;

     

       36
       36
       +
       	background: transparent;

     

       37
       37
       +
       	color: var(--text);

     

       38
       38
       +
       	cursor: pointer;

     

       39
       39
       +
       	font-size: 1rem;

     

       40
       40
       +
       	font-weight: 500;

     

       41
       41
       +
       	font-family: inherit;

     

       42
       42
       +
       	border-bottom: 2px solid transparent;

     

       43
       43
       +
       	margin-bottom: -2px;

     

       44
       44
       +
       	transition: all 0.2s;

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       .tab:hover {

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .tab.active {

     

       52
       52
       +
       	color: var(--primary);

     

       53
       53
       +
       	border-bottom-color: var(--primary);

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       .tab-content {

     

       57
       57
       +
       	display: none;

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       60
       60
       +
       .tab-content.active {

     

       61
       61
       +
       	display: block;

     

       62
       62
       +
       }

     

       63
       63
       +
       

     

       64
       64
       +
       .empty-state {

     

       65
       65
       +
       	text-align: center;

     

       66
       66
       +
       	padding: 3rem;

     

       67
       67
       +
       	color: var(--text);

     

       68
       68
       +
       	opacity: 0.6;

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       .loading {

     

       72
       72
       +
       	text-align: center;

     

       73
       73
       +
       	padding: 3rem;

     

       74
       74
       +
       	color: var(--text);

     

       75
       75
       +
       }

     

       76
       76
       +
       

     

       77
       77
       +
       .error {

     

       78
       78
       +
       	background: #fee2e2;

     

       79
       79
       +
       	color: #991b1b;

     

       80
       80
       +
       	padding: 1rem;

     

       81
       81
       +
       	border-radius: 6px;

     

       82
       82
       +
       	margin-bottom: 1rem;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       .stats {

     

       86
       86
       +
       	display: grid;

     

       87
       87
       +
       	grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       88
       +
       	gap: 1rem;

     

       89
       89
       +
       	margin-bottom: 2rem;

     

       90
       90
       +
       }

     

       91
       91
       +
       

     

       92
       92
       +
       .stat-card {

     

       93
       93
       +
       	background: var(--background);

     

       94
       94
       +
       	border: 2px solid var(--secondary);

     

       95
       95
       +
       	border-radius: 8px;

     

       96
       96
       +
       	padding: 1.5rem;

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       .stat-value {

     

       100
       100
       +
       	font-size: 2rem;

     

       101
       101
       +
       	font-weight: 700;

     

       102
       102
       +
       	color: var(--primary);

     

       103
       103
       +
       	margin-bottom: 0.25rem;

     

       104
       104
       +
       }

     

       105
       105
       +
       

     

       106
       106
       +
       .stat-label {

     

       107
       107
       +
       	color: var(--text);

     

       108
       108
       +
       	opacity: 0.7;

     

       109
       109
       +
       	font-size: 0.875rem;

     

       110
       110
       +
       }

     

       111
       111
       +
       

     

       112
       112
       +
       .timestamp {

     

       113
       113
       +
       	color: var(--text);

     

       114
       114
       +
       	opacity: 0.6;

     

       115
       115
       +
       	font-size: 0.875rem;

     

       116
       116
       +
       }

     

       117
       117
       +
       

     

       118
       118
       +
       .hidden {

     

       119
       119
       +
       	display: none;

     

       120
       120
       +
       }

+71

src/styles/index.css

···

       1
       1
       +
       .hero-title {

     

       2
       2
       +
       	font-size: 3rem;

     

       3
       3
       +
       	font-weight: 700;

     

       4
       4
       +
       	color: var(--text);

     

       5
       5
       +
       	margin-bottom: 1rem;

     

       6
       6
       +
       }

     

       7
       7
       +
       

     

       8
       8
       +
       .hero-subtitle {

     

       9
       9
       +
       	font-size: 1.25rem;

     

       10
       10
       +
       	color: var(--text);

     

       11
       11
       +
       	opacity: 0.8;

     

       12
       12
       +
       	margin-bottom: 2rem;

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       main {

     

       16
       16
       +
       	text-align: center;

     

       17
       17
       +
       	padding: 4rem 2rem;

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       .cta-buttons {

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	gap: 1rem;

     

       23
       23
       +
       	justify-content: center;

     

       24
       24
       +
       	margin-top: 2rem;

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       .btn {

     

       28
       28
       +
       	padding: 0.75rem 1.5rem;

     

       29
       29
       +
       	border-radius: 6px;

     

       30
       30
       +
       	font-size: 1rem;

     

       31
       31
       +
       	font-weight: 500;

     

       32
       32
       +
       	cursor: pointer;

     

       33
       33
       +
       	transition: all 0.2s;

     

       34
       34
       +
       	font-family: inherit;

     

       35
       35
       +
       	border: 2px solid;

     

       36
       36
       +
       	text-decoration: none;

     

       37
       37
       +
       	display: inline-block;

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       .btn-primary {

     

       41
       41
       +
       	background: var(--primary);

     

       42
       42
       +
       	color: white;

     

       43
       43
       +
       	border-color: var(--primary);

     

       44
       44
       +
       }

     

       45
       45
       +
       

     

       46
       46
       +
       .btn-primary:hover {

     

       47
       47
       +
       	background: transparent;

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .btn-secondary {

     

       52
       52
       +
       	background: transparent;

     

       53
       53
       +
       	color: var(--text);

     

       54
       54
       +
       	border-color: var(--secondary);

     

       55
       55
       +
       }

     

       56
       56
       +
       

     

       57
       57
       +
       .btn-secondary:hover {

     

       58
       58
       +
       	border-color: var(--primary);

     

       59
       59
       +
       	color: var(--primary);

     

       60
       60
       +
       }

     

       61
       61
       +
       

     

       62
       62
       +
       @media (max-width: 640px) {

     

       63
       63
       +
       	.hero-title {

     

       64
       64
       +
       		font-size: 2.5rem;

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	.cta-buttons {

     

       68
       68
       +
       		flex-direction: column;

     

       69
       69
       +
       		align-items: center;

     

       70
       70
       +
       	}

     

       71
       71
       +
       }

src/styles/reset-password.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	display: flex;

     

       3
       3
       +
       	align-items: center;

     

       4
       4
       +
       	justify-content: center;

     

       5
       5
       +
       	padding: 4rem 1rem;

     

       6
       6
       +
       }

src/styles/settings.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 64rem;

     

       3
       3
       +
       }

+27

src/styles/transcribe.css

···

       1
       1
       +
       .page-header {

     

       2
       2
       +
       	text-align: center;

     

       3
       3
       +
       	margin-bottom: 3rem;

     

       4
       4
       +
       }

     

       5
       5
       +
       

     

       6
       6
       +
       .page-title {

     

       7
       7
       +
       	font-size: 2.5rem;

     

       8
       8
       +
       	font-weight: 700;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       	margin-bottom: 0.5rem;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       .page-subtitle {

     

       14
       14
       +
       	font-size: 1.125rem;

     

       15
       15
       +
       	color: var(--text);

     

       16
       16
       +
       	opacity: 0.8;

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       .back-link {

     

       20
       20
       +
       	color: var(--paynes-gray);

     

       21
       21
       +
       	text-decoration: none;

     

       22
       22
       +
       	font-size: 0.875rem;

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       .mb-1 {

     

       26
       26
       +
       	margin-bottom: 1rem;

     

       27
       27
       +
       }

Compare changes