comparing b406ff868f0f5595fbb854ed162eb7f7ac447d1c and main on dunkirk.sh/thistle

+24 -10

.env.example

···

       3
       3
        
       # See README for setup instructions

     

       4
       4
        
       WHISPER_SERVICE_URL=http://localhost:8000

     

       5
       5
        
       

     

       6
       6
       -
       # LLM API Configuration (Required for VTT cleaning)

     

       6
       6
       +
       # LLM API Configuration (REQUIRED for VTT cleaning)

     

       7
       7
        
       # Configure your LLM service endpoint and credentials

     

       8
       8
       -
       LLM_API_KEY=your_api_key_here

     

       9
       9
       -
       LLM_API_BASE_URL=https://api.openai.com/v1

     

       10
       10
       -
       LLM_MODEL=gpt-4o-mini

     

       8
       8
       +
       LLM_API_KEY=paste_your_api_key_here

     

       9
       9
       +
       LLM_API_BASE_URL=https://openrouter.ai/api/v1

     

       10
       10
       +
       LLM_MODEL=moonshotai/kimi-k2-0905

     

       11
       11
        
       

     

       12
       12
        
       # WebAuthn/Passkey Configuration (Production Only)

     

       13
       13
        
       # In development, these default to localhost values

     
···

       17
       17
        
       # Must match the domain where your app is hosted

     

       18
       18
        
       # RP_ID=thistle.app

     

       19
       19
        
       

     

       20
       20
       -
       # Origin - full URL of your app

     

       20
       20
       +
       # Origin - full URL of your app (RECOMMENDED - used for email links)

     

       21
       21
        
       # Must match exactly where users access your app

     

       22
       22
       -
       # ORIGIN=https://thistle.app

     

       22
       22
       +
       # In production, set this to your public URL

     

       23
       23
       +
       ORIGIN=http://localhost:3000

     

       23
       24
        
       

     

       24
       24
       -
       # Polar.sh payment stuff

     

       25
       25
       +
       # Polar.sh Payment Configuration (REQUIRED)

     

       26
       26
       +
       # Get your organization ID from https://polar.sh/settings

     

       27
       27
       +
       POLAR_ORGANIZATION_ID=paste_your_org_id_here

     

       25
       28
        
       # Get your access token from https://polar.sh/settings (or sandbox.polar.sh for testing)

     

       26
       26
       -
       POLAR_ACCESS_TOKEN=XXX

     

       29
       29
       +
       POLAR_ACCESS_TOKEN=paste_your_polar_token_here

     

       27
       30
        
       # Get product ID from your Polar dashboard (create a product first)

     

       28
       28
       -
       POLAR_PRODUCT_ID=3f1ab9f9-d573-49d4-ac0a-a78bfb06c347

     

       31
       31
       +
       POLAR_PRODUCT_ID=paste_your_product_id_here

     

       29
       32
        
       # Redirect URL after successful checkout (use {CHECKOUT_ID} placeholder)

     

       30
       33
        
       POLAR_SUCCESS_URL=http://localhost:3000/checkout?checkout_id={CHECKOUT_ID}

     

       31
       34
        
       # Webhook secret for verifying Polar webhook signatures (get from Polar dashboard)

     

       32
       32
       -
       POLAR_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxx

     

       35
       35
       +
       POLAR_WEBHOOK_SECRET=paste_your_webhook_secret_here

     

       36
       36
       +
       

     

       37
       37
       +
       # Email Configuration (REQUIRED - MailChannels)

     

       38
       38
       +
       # API key from MailChannels dashboard

     

       39
       39
       +
       MAILCHANNELS_API_KEY=paste_your_mailchannels_api_key_here

     

       40
       40
       +
       # DKIM private key for email authentication (required for sending emails)

     

       41
       41
       +
       # Generate: openssl genrsa -out dkim-private.pem 2048

     

       42
       42
       +
       # Then add TXT record: mailchannels._domainkey.yourdomain.com

     

       43
       43
       +
       DKIM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nPASTE_YOUR_DKIM_PRIVATE_KEY_HERE\n-----END PRIVATE KEY-----"

     

       44
       44
       +
       DKIM_DOMAIN=yourdomain.com

     

       45
       45
       +
       SMTP_FROM_EMAIL=noreply@yourdomain.com

     

       46
       46
       +
       SMTP_FROM_NAME=Thistle

     

       33
       47
        
       

     

       34
       48
        
       # Environment (set to 'production' in production)

     

       35
       49
        
       NODE_ENV=development

.gitignore

···

       3
       3
        
       uploads/

     

       4
       4
        
       transcripts/

     

       5
       5
        
       .env

     

       6
       6
       +
       *.pem

+117

CRUSH.md

···

       6
       6
        
       

     

       7
       7
        
       **IMPORTANT**: Do NOT commit changes until the user explicitly asks you to commit. Always wait for user verification that changes are working correctly before making commits.

     

       8
       8
        
       

     

       9
       9
       +
       ## Environment Variables

     

       10
       10
       +
       

     

       11
       11
       +
       **CRITICAL**: Always use `process.env.ORIGIN` for generating URLs in emails and links, NOT hardcoded domains.

     

       12
       12
       +
       

     

       13
       13
       +
       - `ORIGIN` - The public URL of the application (e.g., `https://thistle.app` or `http://localhost:3000`)

     

       14
       14
       +
       - Used for: Email verification links, password reset links, any user-facing URLs

     

       15
       15
       +
       - Default: `http://localhost:3000` (development only)

     

       16
       16
       +
       

     

       17
       17
       +
       **Never hardcode domain names** like `https://thistle.app` in code - always use `process.env.ORIGIN`.

     

       18
       18
       +
       

     

       9
       19
        
       ## Project Info

     

       10
       20
        
       

     

       11
       21
        
       - Name: Thistle

     
···

       677
       687
        
       

     

       678
       688
        
       **Configuration:**

     

       679
       689
        
       Set `WHISPER_SERVICE_URL` in `.env` (default: `http://localhost:8000`)

     

       690
       690
       +
       

     

       691
       691
       +
       ## Issue Tracking

     

       692
       692
       +
       

     

       693
       693
       +
       This project uses [Tangled](https://tangled.org) for issue tracking via the `tangled-cli` tool.

     

       694
       694
       +
       

     

       695
       695
       +
       **Installation:**

     

       696
       696
       +
       ```bash

     

       697
       697
       +
       cargo install --git https://tangled.org/vitorpy.com/tangled-cli

     

       698
       698
       +
       ```

     

       699
       699
       +
       

     

       700
       700
       +
       **Authentication:**

     

       701
       701
       +
       ```bash

     

       702
       702
       +
       tangled-cli auth login

     

       703
       703
       +
       ```

     

       704
       704
       +
       

     

       705
       705
       +
       **Creating issues:**

     

       706
       706
       +
       ```bash

     

       707
       707
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --body "Issue description"

     

       708
       708
       +
       

     

       709
       709
       +
       # With labels (if created in the repo):

     

       710
       710
       +
       tangled-cli issue create --repo "thistle" --title "Issue title" --label "bug" --label "priority:high" --body "Issue description"

     

       711
       711
       +
       ```

     

       712
       712
       +
       

     

       713
       713
       +
       **Listing issues:**

     

       714
       714
       +
       ```bash

     

       715
       715
       +
       # List all open issues

     

       716
       716
       +
       tangled-cli issue list --repo "thistle"

     

       717
       717
       +
       

     

       718
       718
       +
       # List with specific state

     

       719
       719
       +
       tangled-cli issue list --repo "thistle" --state open

     

       720
       720
       +
       tangled-cli issue list --repo "thistle" --state closed

     

       721
       721
       +
       

     

       722
       722
       +
       # List by label

     

       723
       723
       +
       tangled-cli issue list --repo "thistle" --label "priority: low"

     

       724
       724
       +
       tangled-cli issue list --repo "thistle" --label "bug"

     

       725
       725
       +
       

     

       726
       726
       +
       # List by author

     

       727
       727
       +
       tangled-cli issue list --repo "thistle" --author "username"

     

       728
       728
       +
       

     

       729
       729
       +
       # JSON output format

     

       730
       730
       +
       tangled-cli issue list --repo "thistle" --format json

     

       731
       731
       +
       ```

     

       732
       732
       +
       

     

       733
       733
       +
       **Showing issue details:**

     

       734
       734
       +
       ```bash

     

       735
       735
       +
       # Show specific issue by ID

     

       736
       736
       +
       tangled-cli issue show <issue-id>

     

       737
       737
       +
       

     

       738
       738
       +
       # Show with comments

     

       739
       739
       +
       tangled-cli issue show <issue-id> --comments

     

       740
       740
       +
       

     

       741
       741
       +
       # JSON format

     

       742
       742
       +
       tangled-cli issue show <issue-id> --json

     

       743
       743
       +
       ```

     

       744
       744
       +
       

     

       745
       745
       +
       **Commenting on issues:**

     

       746
       746
       +
       ```bash

     

       747
       747
       +
       tangled-cli issue comment <issue-id> --body "Your comment here"

     

       748
       748
       +
       ```

     

       749
       749
       +
       

     

       750
       750
       +
       **Editing issues:**

     

       751
       751
       +
       ```bash

     

       752
       752
       +
       # Update title

     

       753
       753
       +
       tangled-cli issue edit <issue-id> --title "New title"

     

       754
       754
       +
       

     

       755
       755
       +
       # Update body

     

       756
       756
       +
       tangled-cli issue edit <issue-id> --body "New description"

     

       757
       757
       +
       

     

       758
       758
       +
       # Close an issue

     

       759
       759
       +
       tangled-cli issue edit <issue-id> --state closed

     

       760
       760
       +
       

     

       761
       761
       +
       # Reopen an issue

     

       762
       762
       +
       tangled-cli issue edit <issue-id> --state open

     

       763
       763
       +
       ```

     

       764
       764
       +
       

     

       765
       765
       +
       **Repository commands:**

     

       766
       766
       +
       ```bash

     

       767
       767
       +
       # List your repositories

     

       768
       768
       +
       tangled-cli repo list

     

       769
       769
       +
       

     

       770
       770
       +
       # Show repository details

     

       771
       771
       +
       tangled-cli repo info thistle

     

       772
       772
       +
       

     

       773
       773
       +
       # Create a new repository

     

       774
       774
       +
       tangled-cli repo create --name "repo-name" --description "Description"

     

       775
       775
       +
       ```

     

       776
       776
       +
       

     

       777
       777
       +
       **Viewing issues by priority:**

     

       778
       778
       +
       

     

       779
       779
       +
       The thistle repo uses priority labels:

     

       780
       780
       +
       - `priority: high` - Critical issues that need immediate attention

     

       781
       781
       +
       - `priority: medium` - Important issues to address soon

     

       782
       782
       +
       - `priority: low` - Nice-to-have improvements

     

       783
       783
       +
       

     

       784
       784
       +
       ```bash

     

       785
       785
       +
       # View all low priority issues

     

       786
       786
       +
       tangled-cli issue list --repo "thistle" --label "priority: low" --state open

     

       787
       787
       +
       

     

       788
       788
       +
       # View all high priority issues

     

       789
       789
       +
       tangled-cli issue list --repo "thistle" --label "priority: high" --state open

     

       790
       790
       +
       ```

     

       791
       791
       +
       

     

       792
       792
       +
       **Note:** The repo name for this project is `thistle` (resolves to `dunkirk.sh/thistle` in Tangled). Labels are supported but need to be created in the repository first.

     

       793
       793
       +
       

     

       794
       794
       +
       **Known Issues:**

     

       795
       795
       +
       - The CLI may have decoding issues with some API responses (missing `createdAt` field). If `tangled-cli issue list` fails, you can access issues via the web interface at https://tangled.org/dunkirk.sh/thistle

     

       796
       796
       +
       - For complex filtering or browsing, the web UI may be more reliable than the CLI

     

       680
       797
        
       

     

       681
       798
        
       ## Future Additions

     

       682
       799

+10

LICENSE.md

···

       1
       1
       +
       # The O'Saasy License

     

       2
       2
       +
       

     

       3
       3
       +
       Copyright © `2025` `Kieran Klukas`

     

       4
       4
       +
       

     

       5
       5
       +
       Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

     

       6
       6
       +
       

     

       7
       7
       +
       The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

     

       8
       8
       +
       No licensee or downstream recipient may use the Software (including any modified or derivative versions) to directly compete with the original Licensor by offering it to third parties as a hosted, managed, or Software-as-a-Service (SaaS) product or cloud service where the primary value of the service is the functionality of the Software itself.

     

       9
       9
       +
       

     

       10
       10
       +
       THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

+2 -1

README.md

···

       45
       45
        
       ```

     

       46
       46
        
       

     

       47
       47
        
       Or manually:

     

       48
       48
       +
       

     

       48
       49
        
       ```bash

     

       49
       50
        
       cd whisper-server

     

       50
       51
        
       pip install -r requirements.txt

     
···

       134
       135
        
       </p>

     

       135
       136
        
       

     

       136
       137
        
       <p align="center">

     

       137
       137
       -
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=MIT&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       138
       +
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=O'Saasy&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       139
        
       </p>

-264

docs/CLASS_SYSTEM_SPEC.md

···

       1
       1
       -
       # Class System Specification

     

       2
       2
       -
       

     

       3
       3
       -
       ## Overview

     

       4
       4
       -
       

     

       5
       5
       -
       Restructure Thistle from individual transcript management to class-based transcript organization. Users will manage transcripts grouped by classes, with scheduled meeting times and selective transcription.

     

       6
       6
       -
       

     

       7
       7
       -
       ## User Flow

     

       8
       8
       -
       

     

       9
       9
       -
       ### 1. Classes Page (Home)

     

       10
       10
       -
       - Replaces the transcript page as the main view after signup

     

       11
       11
       -
       - Displays grid of class cards organized by semester/year

     

       12
       12
       -
       - Each section (semester/year combo) separated by horizontal rules

     

       13
       13
       -
       - Each card shows:

     

       14
       14
       -
         - Course code (e.g., "CS 101")

     

       15
       15
       -
         - Course name (e.g., "Introduction to Computer Science")

     

       16
       16
       -
         - Professor name

     

       17
       17
       -
         - Semester and year (e.g., "Fall 2024")

     

       18
       18
       -
         - Archive indicator (if archived)

     

       19
       19
       -
       - Final card in grid is "Register for Class" with centered plus icon

     

       20
       20
       -
       - Empty state: Only shows register button if user has no classes

     

       21
       21
       -
       

     

       22
       22
       -
       ### 2. Individual Class Page (`/classes/:id`)

     

       23
       23
       -
       - Lists all recordings and transcripts for the class

     

       24
       24
       -
       - Shows meeting schedule (flexible text, e.g., "Monday Lecture", "Wednesday Lab")

     

       25
       25
       -
       - Displays recordings with statuses:

     

       26
       26
       -
         - **Pending**: Uploaded but not selected for transcription

     

       27
       27
       -
         - **Selected**: Marked for transcription by admin

     

       28
       28
       -
         - **Transcribed**: Processing complete, ready to view

     

       29
       29
       -
         - **Failed**: Transcription failed

     

       30
       30
       -
       - Upload button to add new recordings

     

       31
       31
       -
       - Each recording tagged with meeting time

     

       32
       32
       -
       

     

       33
       33
       -
       ### 3. Recording Upload

     

       34
       34
       -
       - Any enrolled student can upload recordings

     

       35
       35
       -
       - Must select which meeting time the recording is for

     

       36
       36
       -
       - Recording enters "pending" state

     

       37
       37
       -
       - Does not auto-transcribe

     

       38
       38
       -
       

     

       39
       39
       -
       ### 4. Admin Workflow

     

       40
       40
       -
       - Admin views pending recordings

     

       41
       41
       -
       - Selects specific recording to transcribe for each meeting

     

       42
       42
       -
       - Only selected recordings get processed

     

       43
       43
       -
       - Can manage classes (create, archive, enrollments)

     

       44
       44
       -
       

     

       45
       45
       -
       ## Database Schema

     

       46
       46
       -
       

     

       47
       47
       -
       ### Classes Table

     

       48
       48
       -
       ```sql

     

       49
       49
       -
       CREATE TABLE classes (

     

       50
       50
       -
         id TEXT PRIMARY KEY,           -- stable random ID (nanoid or similar)

     

       51
       51
       -
         course_code TEXT NOT NULL,     -- e.g., "CS 101"

     

       52
       52
       -
         name TEXT NOT NULL,            -- e.g., "Introduction to Computer Science"

     

       53
       53
       -
         professor TEXT NOT NULL,

     

       54
       54
       -
         semester TEXT NOT NULL,        -- e.g., "Fall", "Spring", "Summer"

     

       55
       55
       -
         year INTEGER NOT NULL,         -- e.g., 2024

     

       56
       56
       -
         archived BOOLEAN DEFAULT FALSE,

     

       57
       57
       -
         created_at INTEGER NOT NULL

     

       58
       58
       -
       );

     

       59
       59
       -
       ```

     

       60
       60
       -
       

     

       61
       61
       -
       ### Class Members Table

     

       62
       62
       -
       ```sql

     

       63
       63
       -
       CREATE TABLE class_members (

     

       64
       64
       -
         class_id TEXT NOT NULL,

     

       65
       65
       -
         user_id TEXT NOT NULL,

     

       66
       66
       -
         enrolled_at INTEGER NOT NULL,

     

       67
       67
       -
         PRIMARY KEY (class_id, user_id),

     

       68
       68
       -
         FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       69
       69
       -
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       70
       70
       -
       );

     

       71
       71
       -
       ```

     

       72
       72
       -
       

     

       73
       73
       -
       ### Meeting Times Table

     

       74
       74
       -
       ```sql

     

       75
       75
       -
       CREATE TABLE meeting_times (

     

       76
       76
       -
         id TEXT PRIMARY KEY,

     

       77
       77
       -
         class_id TEXT NOT NULL,

     

       78
       78
       -
         label TEXT NOT NULL,           -- flexible text: "Monday Lecture", "Wednesday Lab", etc.

     

       79
       79
       -
         created_at INTEGER NOT NULL,

     

       80
       80
       -
         FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE

     

       81
       81
       -
       );

     

       82
       82
       -
       ```

     

       83
       83
       -
       

     

       84
       84
       -
       ### Updated Transcripts Table

     

       85
       85
       -
       ```sql

     

       86
       86
       -
       -- Add new columns to existing transcripts table:

     

       87
       87
       -
       ALTER TABLE transcripts ADD COLUMN class_id TEXT;

     

       88
       88
       -
       ALTER TABLE transcripts ADD COLUMN meeting_time_id TEXT;

     

       89
       89
       -
       ALTER TABLE transcripts ADD COLUMN status TEXT DEFAULT 'pending';

     

       90
       90
       -
       -- status: 'pending' | 'selected' | 'transcribed' | 'failed'

     

       91
       91
       -
       

     

       92
       92
       -
       -- Add foreign keys:

     

       93
       93
       -
       FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE

     

       94
       94
       -
       FOREIGN KEY (meeting_time_id) REFERENCES meeting_times(id) ON DELETE SET NULL

     

       95
       95
       -
       ```

     

       96
       96
       -
       

     

       97
       97
       -
       **Note**: Add indexes for performance:

     

       98
       98
       -
       - `class_members(user_id)` - lookup user's classes

     

       99
       99
       -
       - `class_members(class_id)` - lookup class members

     

       100
       100
       -
       - `transcripts(class_id)` - lookup class transcripts

     

       101
       101
       -
       - `transcripts(status)` - filter by status

     

       102
       102
       -
       - `meeting_times(class_id)` - lookup class schedule

     

       103
       103
       -
       

     

       104
       104
       -
       ## Permissions

     

       105
       105
       -
       

     

       106
       106
       -
       ### Class Access

     

       107
       107
       -
       - Users can only view classes they're enrolled in

     

       108
       108
       -
       - Admins can view all classes

     

       109
       109
       -
       - Non-enrolled users get 403 when accessing `/classes/:id`

     

       110
       110
       -
       

     

       111
       111
       -
       ### Recording Permissions

     

       112
       112
       -
       - **Upload**: Any enrolled student can upload recordings

     

       113
       113
       -
       - **Delete**: Students can delete their own recordings

     

       114
       114
       -
       - **Select for transcription**: Admin only

     

       115
       115
       -
       - **View**: All enrolled students can view all transcripts in their classes

     

       116
       116
       -
       

     

       117
       117
       -
       ### Class Management

     

       118
       118
       -
       - **Create**: Admin only (via admin UI)

     

       119
       119
       -
       - **Archive**: Admin only (via admin UI)

     

       120
       120
       -
       - **Enroll students**: Admin only (via admin UI)

     

       121
       121
       -
       - **Remove students**: Admin only (via admin UI)

     

       122
       122
       -
       

     

       123
       123
       -
       ## Archive Behavior

     

       124
       124
       -
       

     

       125
       125
       -
       When a class is archived:

     

       126
       126
       -
       - Students can still view the class and all transcripts

     

       127
       127
       -
       - No new recordings can be uploaded

     

       128
       128
       -
       - No recordings can be deleted

     

       129
       129
       -
       - No transcription selection allowed

     

       130
       130
       -
       - No enrollment changes

     

       131
       131
       -
       - Class appears with archive indicator in UI

     

       132
       132
       -
       - Organized with active classes by semester/year

     

       133
       133
       -
       

     

       134
       134
       -
       ## API Endpoints

     

       135
       135
       -
       

     

       136
       136
       -
       ### Classes

     

       137
       137
       -
       - `GET /api/classes` - List user's classes (grouped by semester/year)

     

       138
       138
       -
       - `GET /api/classes/:id` - Get class details (info, meeting times, transcripts)

     

       139
       139
       -
       - `POST /api/classes` (admin) - Create new class

     

       140
       140
       -
       - `PUT /api/classes/:id/archive` (admin) - Archive/unarchive class

     

       141
       141
       -
       - `DELETE /api/classes/:id` (admin) - Delete class

     

       142
       142
       -
       

     

       143
       143
       -
       ### Class Members

     

       144
       144
       -
       - `POST /api/classes/:id/members` (admin) - Enroll student(s)

     

       145
       145
       -
       - `DELETE /api/classes/:id/members/:userId` (admin) - Remove student

     

       146
       146
       -
       - `GET /api/classes/:id/members` (admin) - List class members

     

       147
       147
       -
       

     

       148
       148
       -
       ### Meeting Times

     

       149
       149
       -
       - `GET /api/classes/:id/meetings` - List meeting times

     

       150
       150
       -
       - `POST /api/classes/:id/meetings` (admin) - Create meeting time

     

       151
       151
       -
       - `PUT /api/meetings/:id` (admin) - Update meeting time label

     

       152
       152
       -
       - `DELETE /api/meetings/:id` (admin) - Delete meeting time

     

       153
       153
       -
       

     

       154
       154
       -
       ### Recordings/Transcripts

     

       155
       155
       -
       - `GET /api/classes/:id/transcripts` - List all transcripts for class

     

       156
       156
       -
       - `POST /api/classes/:id/recordings` - Upload recording (enrolled students)

     

       157
       157
       -
       - `PUT /api/transcripts/:id/select` (admin) - Mark recording for transcription

     

       158
       158
       -
       - `DELETE /api/transcripts/:id` - Delete recording (owner or admin)

     

       159
       159
       -
       - `GET /api/transcripts/:id` - View transcript (enrolled students)

     

       160
       160
       -
       

     

       161
       161
       -
       ## Frontend Components

     

       162
       162
       -
       

     

       163
       163
       -
       ### Pages

     

       164
       164
       -
       - `/classes` - Classes grid (home page, replaces transcripts page)

     

       165
       165
       -
       - `/classes/:id` - Individual class view

     

       166
       166
       -
       - `/admin` - Update to include class management

     

       167
       167
       -
       

     

       168
       168
       -
       ### New Components

     

       169
       169
       -
       - `class-card.ts` - Class card component

     

       170
       170
       -
       - `register-card.ts` - Register for class card (plus icon)

     

       171
       171
       -
       - `class-detail.ts` - Individual class page

     

       172
       172
       -
       - `recording-upload.ts` - Recording upload form

     

       173
       173
       -
       - `recording-list.ts` - List of recordings with status

     

       174
       174
       -
       - `admin-classes.ts` - Admin class management interface

     

       175
       175
       -
       

     

       176
       176
       -
       ### Navigation Updates

     

       177
       177
       -
       - Remove transcript page links

     

       178
       178
       -
       - Add classes link (make it home)

     

       179
       179
       -
       - Update auth redirect after signup to `/classes`

     

       180
       180
       -
       

     

       181
       181
       -
       ## Migration Strategy

     

       182
       182
       -
       

     

       183
       183
       -
       **Breaking change**: Reset database schema to consolidate all migrations.

     

       184
       184
       -
       

     

       185
       185
       -
       1. Export any critical production data (if needed)

     

       186
       186
       -
       2. Drop all tables

     

       187
       187
       -
       3. Consolidate migrations in `src/db/schema.ts`:

     

       188
       188
       -
          - Include all previous migrations

     

       189
       189
       -
          - Add new class system tables

     

       190
       190
       -
          - Add new columns to transcripts

     

       191
       191
       -
       4. Restart with version 1

     

       192
       192
       -
       5. Existing transcripts will be lost (acceptable for this phase)

     

       193
       193
       -
       

     

       194
       194
       -
       ## Admin UI Updates

     

       195
       195
       -
       

     

       196
       196
       -
       ### Class Management Tab

     

       197
       197
       -
       - Create new class form:

     

       198
       198
       -
         - Course code

     

       199
       199
       -
         - Course name

     

       200
       200
       -
         - Professor

     

       201
       201
       -
         - Semester dropdown (Fall/Spring/Summer/Winter)

     

       202
       202
       -
         - Year input

     

       203
       203
       -
       - List all classes (with archive status)

     

       204
       204
       -
       - Archive/unarchive button per class

     

       205
       205
       -
       - Delete class button

     

       206
       206
       -
       

     

       207
       207
       -
       ### Enrollment Management

     

       208
       208
       -
       - Search for class

     

       209
       209
       -
       - Add student by email

     

       210
       210
       -
       - Remove enrolled students

     

       211
       211
       -
       - View enrollment list per class

     

       212
       212
       -
       - Future: Bulk CSV import

     

       213
       213
       -
       

     

       214
       214
       -
       ### Recording Selection

     

       215
       215
       -
       - View pending recordings per class

     

       216
       216
       -
       - Select recording to transcribe for each meeting

     

       217
       217
       -
       - View transcription status

     

       218
       218
       -
       - Handle failed transcriptions

     

       219
       219
       -
       

     

       220
       220
       -
       ## Empty States

     

       221
       221
       -
       

     

       222
       222
       -
       - **No classes**: Show only register card with message "No classes yet"

     

       223
       223
       -
       - **No recordings in class**: Show message "No recordings yet" with upload button

     

       224
       224
       -
       - **No pending recordings**: Show message in admin "All recordings processed"

     

       225
       225
       -
       

     

       226
       226
       -
       ## Future Enhancements (Out of Scope)

     

       227
       227
       -
       

     

       228
       228
       -
       - Share/enrollment links for self-enrollment

     

       229
       229
       -
       - Notifications when transcripts ready

     

       230
       230
       -
       - Auto-transcribe settings per class

     

       231
       231
       -
       - Student/instructor roles

     

       232
       232
       -
       - Search/filter classes

     

       233
       233
       -
       - Bulk enrollment via CSV

     

       234
       234
       -
       - Meeting time templates (MWF, TTh patterns)

     

       235
       235
       -
       - Download all transcripts for a class

     

       236
       236
       -
       

     

       237
       237
       -
       ## Open Questions

     

       238
       238
       -
       

     

       239
       239
       -
       None - spec is complete for initial implementation.

     

       240
       240
       -
       

     

       241
       241
       -
       ## Implementation Phases

     

       242
       242
       -
       

     

       243
       243
       -
       ### Phase 1: Database & Backend

     

       244
       244
       -
       1. Consolidate migrations and add new schema

     

       245
       245
       -
       2. Add API endpoints for classes and members

     

       246
       246
       -
       3. Update permissions middleware

     

       247
       247
       -
       4. Add admin endpoints

     

       248
       248
       -
       

     

       249
       249
       -
       ### Phase 2: Admin UI

     

       250
       250
       -
       1. Class management interface

     

       251
       251
       -
       2. Enrollment management

     

       252
       252
       -
       3. Recording selection interface

     

       253
       253
       -
       

     

       254
       254
       -
       ### Phase 3: Student UI

     

       255
       255
       -
       1. Classes page with cards

     

       256
       256
       -
       2. Individual class pages

     

       257
       257
       -
       3. Recording upload

     

       258
       258
       -
       4. Update navigation

     

       259
       259
       -
       

     

       260
       260
       -
       ### Phase 4: Testing & Polish

     

       261
       261
       -
       1. Test permissions thoroughly

     

       262
       262
       -
       2. Test archive behavior

     

       263
       263
       -
       3. Empty states

     

       264
       264
       -
       4. Error handling

+28 -28

package.json

···

       1
       1
        
       {

     

       2
       2
       -
         "name": "thistle",

     

       3
       3
       -
         "module": "src/index.ts",

     

       4
       4
       -
         "type": "module",

     

       5
       5
       -
         "private": true,

     

       6
       6
       -
         "scripts": {

     

       7
       7
       -
           "dev": "bun run src/index.ts --hot",

     

       8
       8
       -
           "clean": "rm -rf transcripts uploads thistle.db",

     

       9
       9
       -
           "test": "bun test",

     

       10
       10
       -
           "test:integration": "bun test src/index.test.ts",

     

       11
       11
       -
           "ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       12
       -
         },

     

       13
       13
       -
         "devDependencies": {

     

       14
       14
       -
           "@biomejs/biome": "^2.3.2",

     

       15
       15
       -
           "@simplewebauthn/types": "^12.0.0",

     

       16
       16
       -
           "@types/bun": "latest"

     

       17
       17
       -
         },

     

       18
       18
       -
         "peerDependencies": {

     

       19
       19
       -
           "typescript": "^5"

     

       20
       20
       -
         },

     

       21
       21
       -
         "dependencies": {

     

       22
       22
       -
           "@polar-sh/sdk": "^0.41.5",

     

       23
       23
       -
           "@simplewebauthn/browser": "^13.2.2",

     

       24
       24
       -
           "@simplewebauthn/server": "^13.2.2",

     

       25
       25
       -
           "eventsource-client": "^1.2.0",

     

       26
       26
       -
           "lit": "^3.3.1",

     

       27
       27
       -
           "nanoid": "^5.1.6",

     

       28
       28
       -
           "ua-parser-js": "^2.0.6"

     

       29
       29
       -
         }

     

       2
       2
       +
       	"name": "thistle",

     

       3
       3
       +
       	"module": "src/index.ts",

     

       4
       4
       +
       	"type": "module",

     

       5
       5
       +
       	"private": true,

     

       6
       6
       +
       	"scripts": {

     

       7
       7
       +
       		"dev": "bun run src/index.ts --hot",

     

       8
       8
       +
       		"clean": "rm -rf transcripts uploads thistle.db",

     

       9
       9
       +
       		"test": "NODE_ENV=test bun test",

     

       10
       10
       +
       		"test:integration": "NODE_ENV=test bun test src/index.test.ts",

     

       11
       11
       +
       		"ngrok": "ngrok http 3000 --domain casual-renewing-reptile.ngrok-free.app"

     

       12
       12
       +
       	},

     

       13
       13
       +
       	"devDependencies": {

     

       14
       14
       +
       		"@biomejs/biome": "^2.3.2",

     

       15
       15
       +
       		"@simplewebauthn/types": "^12.0.0",

     

       16
       16
       +
       		"@types/bun": "latest"

     

       17
       17
       +
       	},

     

       18
       18
       +
       	"peerDependencies": {

     

       19
       19
       +
       		"typescript": "^5"

     

       20
       20
       +
       	},

     

       21
       21
       +
       	"dependencies": {

     

       22
       22
       +
       		"@polar-sh/sdk": "^0.41.5",

     

       23
       23
       +
       		"@simplewebauthn/browser": "^13.2.2",

     

       24
       24
       +
       		"@simplewebauthn/server": "^13.2.2",

     

       25
       25
       +
       		"eventsource-client": "^1.2.0",

     

       26
       26
       +
       		"lit": "^3.3.1",

     

       27
       27
       +
       		"nanoid": "^5.1.6",

     

       28
       28
       +
       		"ua-parser-js": "^2.0.6"

     

       29
       29
       +
       	}

     

       30
       30
        
       }

+19 -1

public/favicon/site.webmanifest

···

       1
       1
       -
       {"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}
     

       1
       1
       +
       {

     

       2
       2
       +
       	"name": "",

     

       3
       3
       +
       	"short_name": "",

     

       4
       4
       +
       	"icons": [

     

       5
       5
       +
       		{

     

       6
       6
       +
       			"src": "/android-chrome-192x192.png",

     

       7
       7
       +
       			"sizes": "192x192",

     

       8
       8
       +
       			"type": "image/png"

     

       9
       9
       +
       		},

     

       10
       10
       +
       		{

     

       11
       11
       +
       			"src": "/android-chrome-512x512.png",

     

       12
       12
       +
       			"sizes": "512x512",

     

       13
       13
       +
       			"type": "image/png"

     

       14
       14
       +
       		}

     

       15
       15
       +
       	],

     

       16
       16
       +
       	"theme_color": "#ffffff",

     

       17
       17
       +
       	"background_color": "#ffffff",

     

       18
       18
       +
       	"display": "standalone"

     

       19
       19
       +
       }

+17

scripts/clear-rate-limits.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       console.log("🧹 Clearing all rate limit attempts...");

     

       6
       6
       +
       

     

       7
       7
       +
       const result = db.run("DELETE FROM rate_limit_attempts");

     

       8
       8
       +
       

     

       9
       9
       +
       const deletedCount = result.changes;

     

       10
       10
       +
       

     

       11
       11
       +
       if (deletedCount === 0) {

     

       12
       12
       +
       	console.log("ℹ️  No rate limit attempts to clear");

     

       13
       13
       +
       } else {

     

       14
       14
       +
       	console.log(

     

       15
       15
       +
       		`✅ Successfully cleared ${deletedCount} rate limit attempt${deletedCount === 1 ? "" : "s"}`,

     

       16
       16
       +
       	);

     

       17
       17
       +
       }

+39

scripts/remove-from-classes.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       const email = process.argv[2];

     

       6
       6
       +
       

     

       7
       7
       +
       if (!email) {

     

       8
       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       10
       +
       	process.exit(1);

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       const user = db

     

       14
       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       16
       +
       	)

     

       17
       17
       +
       	.get(email);

     

       18
       18
       +
       

     

       19
       19
       +
       if (!user) {

     

       20
       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       21
       +
       	process.exit(1);

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // Get current enrollments

     

       25
       25
       +
       const enrollments = db

     

       26
       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       28
       +
       	)

     

       29
       29
       +
       	.all(user.id);

     

       30
       30
       +
       

     

       31
       31
       +
       if (enrollments.length === 0) {

     

       32
       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       33
       +
       	process.exit(0);

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Remove from all classes

     

       37
       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       38
       +
       

     

       39
       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+70

scripts/send-test-emails.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Send test emails to preview all email templates

     

       3
       3
       +
        * Usage: bun scripts/send-test-emails.ts <email>

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       import { sendEmail } from "../src/lib/email";

     

       7
       7
       +
       import {

     

       8
       8
       +
       	passwordResetTemplate,

     

       9
       9
       +
       	transcriptionCompleteTemplate,

     

       10
       10
       +
       	verifyEmailTemplate,

     

       11
       11
       +
       } from "../src/lib/email-templates";

     

       12
       12
       +
       

     

       13
       13
       +
       const targetEmail = process.argv[2];

     

       14
       14
       +
       

     

       15
       15
       +
       if (!targetEmail) {

     

       16
       16
       +
       	console.error("Usage: bun scripts/send-test-emails.ts <email>");

     

       17
       17
       +
       	process.exit(1);

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       async function sendTestEmails() {

     

       21
       21
       +
       	console.log(`Sending test emails to ${targetEmail}...`);

     

       22
       22
       +
       

     

       23
       23
       +
       	try {

     

       24
       24
       +
       		// 1. Email verification

     

       25
       25
       +
       		console.log("\n[1/3] Sending email verification...");

     

       26
       26
       +
       		await sendEmail({

     

       27
       27
       +
       			to: targetEmail,

     

       28
       28
       +
       			subject: "Test: Verify your email - Thistle",

     

       29
       29
       +
       			html: verifyEmailTemplate({

     

       30
       30
       +
       				name: "Test User",

     

       31
       31
       +
       				code: "123456",

     

       32
       32
       +
       				token: "test-token-abc123",

     

       33
       33
       +
       			}),

     

       34
       34
       +
       		});

     

       35
       35
       +
       		console.log("✓ Email verification sent");

     

       36
       36
       +
       

     

       37
       37
       +
       		// 2. Password reset

     

       38
       38
       +
       		console.log("\n[2/3] Sending password reset...");

     

       39
       39
       +
       		await sendEmail({

     

       40
       40
       +
       			to: targetEmail,

     

       41
       41
       +
       			subject: "Test: Reset your password - Thistle",

     

       42
       42
       +
       			html: passwordResetTemplate({

     

       43
       43
       +
       				name: "Test User",

     

       44
       44
       +
       				resetLink: "https://thistle.app/reset-password?token=test-token-xyz789",

     

       45
       45
       +
       			}),

     

       46
       46
       +
       		});

     

       47
       47
       +
       		console.log("✓ Password reset sent");

     

       48
       48
       +
       

     

       49
       49
       +
       		// 3. Transcription complete

     

       50
       50
       +
       		console.log("\n[3/3] Sending transcription complete...");

     

       51
       51
       +
       		await sendEmail({

     

       52
       52
       +
       			to: targetEmail,

     

       53
       53
       +
       			subject: "Test: Transcription complete - Thistle",

     

       54
       54
       +
       			html: transcriptionCompleteTemplate({

     

       55
       55
       +
       				name: "Test User",

     

       56
       56
       +
       				originalFilename: "lecture-2024-11-22.m4a",

     

       57
       57
       +
       				transcriptLink: "https://thistle.app/transcriptions/123",

     

       58
       58
       +
       				className: "Introduction to Computer Science",

     

       59
       59
       +
       			}),

     

       60
       60
       +
       		});

     

       61
       61
       +
       		console.log("✓ Transcription complete sent");

     

       62
       62
       +
       

     

       63
       63
       +
       		console.log("\n✅ All test emails sent successfully!");

     

       64
       64
       +
       	} catch (error) {

     

       65
       65
       +
       		console.error("\n❌ Error sending emails:", error);

     

       66
       66
       +
       		process.exit(1);

     

       67
       67
       +
       	}

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       sendTestEmails();

+260 -29

src/components/admin-classes.ts

···

       12
       12
        
       	year: number;

     

       13
       13
        
       	archived: boolean;

     

       14
       14
        
       	created_at: number;

     

       15
       15
       +
       	student_count?: number;

     

       16
       16
       +
       	transcript_count?: number;

     

       15
       17
        
       }

     

       16
       18
        
       

     

       17
       19
        
       interface WaitlistEntry {

     
···

       38
       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       39
       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       40
       42
        
       	@state() showModal = false;

     

       43
       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       47
       +
       	@state() newSectionNumber = "";

     

       41
       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       49
       +
       	@state() sections: string[] = [];

     

       42
       50
        
       	@state() editingClass = {

     

       43
       51
        
       		courseCode: "",

     

       44
       52
        
       		courseName: "",

     
···

       227
       235
        
             color: var(--paynes-gray);

     

       228
       236
        
           }

     

       229
       237
        
       

     

       230
       230
       -
           .error-message {

     

       231
       231
       -
             background: #fee2e2;

     

       232
       232
       -
             color: #991b1b;

     

       238
       238
       +
           .error-banner {

     

       239
       239
       +
             background: #fecaca;

     

       240
       240
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       241
       241
       +
             border-radius: 6px;

     

       233
       242
        
             padding: 1rem;

     

       234
       234
       -
             border-radius: 6px;

     

       235
       235
       -
             margin-bottom: 1rem;

     

       243
       243
       +
             margin-bottom: 1.5rem;

     

       244
       244
       +
             color: #dc2626;

     

       245
       245
       +
             font-weight: 500;

     

       236
       246
        
           }

     

       237
       247
        
       

     

       238
       248
        
           .tabs {

     
···

       463
       473
        
       

     

       464
       474
        
       	override async connectedCallback() {

     

       465
       475
        
       		super.connectedCallback();

     

       476
       476
       +
       

     

       477
       477
       +
       		// Check for subtab query parameter

     

       478
       478
       +
       		const params = new URLSearchParams(window.location.search);

     

       479
       479
       +
       		const subtab = params.get("subtab");

     

       480
       480
       +
       		if (subtab && this.isValidSubtab(subtab)) {

     

       481
       481
       +
       			this.activeTab = subtab as "classes" | "waitlist";

     

       482
       482
       +
       		} else {

     

       483
       483
       +
       			// Set default subtab in URL if on classes tab

     

       484
       484
       +
       			this.setActiveTab(this.activeTab);

     

       485
       485
       +
       		}

     

       486
       486
       +
       

     

       466
       487
        
       		await this.loadData();

     

       467
       488
        
       	}

     

       468
       489
        
       

     

       490
       490
       +
       	private isValidSubtab(subtab: string): boolean {

     

       491
       491
       +
       		return ["classes", "waitlist"].includes(subtab);

     

       492
       492
       +
       	}

     

       493
       493
       +
       

     

       494
       494
       +
       	private setActiveTab(tab: "classes" | "waitlist") {

     

       495
       495
       +
       		this.activeTab = tab;

     

       496
       496
       +
       		// Update URL without reloading page

     

       497
       497
       +
       		const url = new URL(window.location.href);

     

       498
       498
       +
       		url.searchParams.set("subtab", tab);

     

       499
       499
       +
       		window.history.pushState({}, "", url);

     

       500
       500
       +
       	}

     

       501
       501
       +
       

     

       469
       502
        
       	private async loadData() {

     

       470
       503
        
       		this.isLoading = true;

     

       471
       504
        
       		this.error = "";

     
···

       483
       516
        
       			const classesData = await classesRes.json();

     

       484
       517
        
       			const waitlistData = await waitlistRes.json();

     

       485
       518
        
       

     

       486
       486
       -
       			this.classes = classesData.classes || [];

     

       519
       519
       +
       			// Flatten grouped classes into array

     

       520
       520
       +
       			const groupedClasses = classesData.classes || {};

     

       521
       521
       +
       			this.classes = Object.values(groupedClasses).flat();

     

       487
       522
        
       			this.waitlist = waitlistData.waitlist || [];

     

       488
       523
        
       		} catch {

     

       489
       524
        
       			this.error = "Failed to load data. Please try again.";

     
···

       499
       534
        
       	private async handleToggleArchive(classId: string) {

     

       500
       535
        
       		try {

     

       501
       536
        
       			// Find the class to toggle its archived state

     

       502
       502
       -
       			const classToToggle = this.classes.find(c => c.id === classId);

     

       537
       537
       +
       			const classToToggle = this.classes.find((c) => c.id === classId);

     

       503
       538
        
       			if (!classToToggle) return;

     

       504
       539
        
       

     

       505
       540
        
       			const response = await fetch(`/api/classes/${classId}/archive`, {

     
···

       513
       548
        
       			}

     

       514
       549
        
       

     

       515
       550
        
       			// Update local state instead of reloading

     

       516
       516
       -
       			this.classes = this.classes.map(c => 

     

       517
       517
       -
       				c.id === classId ? { ...c, archived: !c.archived } : c

     

       551
       551
       +
       			this.classes = this.classes.map((c) =>

     

       552
       552
       +
       				c.id === classId ? { ...c, archived: !c.archived } : c,

     

       518
       553
        
       			);

     

       519
       554
        
       		} catch {

     

       520
       555
        
       			this.error = "Failed to update class. Please try again.";

     
···

       635
       670
        
       		this.showModal = true;

     

       636
       671
        
       	}

     

       637
       672
        
       

     

       673
       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       674
       +
       		try {

     

       675
       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       677
       +
       			

     

       678
       678
       +
       			const data = await response.json();

     

       679
       679
       +
       			this.editingClassId = classId;

     

       680
       680
       +
       			this.editingClassInfo = data.class;

     

       681
       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       682
       +
       			this.newSectionNumber = "";

     

       683
       683
       +
       			this.showClassSettingsModal = true;

     

       684
       684
       +
       		} catch {

     

       685
       685
       +
       			this.error = "Failed to load class details";

     

       686
       686
       +
       		}

     

       687
       687
       +
       	}

     

       688
       688
       +
       

     

       689
       689
       +
       	private async handleAddSection() {

     

       690
       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       691
       +
       

     

       692
       692
       +
       		try {

     

       693
       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       694
       +
       				method: "POST",

     

       695
       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       697
       +
       			});

     

       698
       698
       +
       

     

       699
       699
       +
       			if (!response.ok) {

     

       700
       700
       +
       				const data = await response.json();

     

       701
       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       702
       +
       				return;

     

       703
       703
       +
       			}

     

       704
       704
       +
       

     

       705
       705
       +
       			const newSection = await response.json();

     

       706
       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       707
       +
       			this.newSectionNumber = "";

     

       708
       708
       +
       		} catch {

     

       709
       709
       +
       			this.error = "Failed to add section";

     

       710
       710
       +
       		}

     

       711
       711
       +
       	}

     

       712
       712
       +
       

     

       713
       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       714
       +
       		if (!this.editingClassId) return;

     

       715
       715
       +
       

     

       716
       716
       +
       		try {

     

       717
       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       718
       +
       				method: "DELETE",

     

       719
       719
       +
       			});

     

       720
       720
       +
       

     

       721
       721
       +
       			if (!response.ok) {

     

       722
       722
       +
       				const data = await response.json();

     

       723
       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       724
       +
       				return;

     

       725
       725
       +
       			}

     

       726
       726
       +
       

     

       727
       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       728
       +
       		} catch {

     

       729
       729
       +
       			this.error = "Failed to delete section";

     

       730
       730
       +
       		}

     

       731
       731
       +
       	}

     

       732
       732
       +
       

     

       733
       733
       +
       	private handleCloseSectionsModal() {

     

       734
       734
       +
       		this.showClassSettingsModal = false;

     

       735
       735
       +
       		this.editingClassId = null;

     

       736
       736
       +
       		this.editingClassInfo = null;

     

       737
       737
       +
       		this.editingClassSections = [];

     

       738
       738
       +
       		this.newSectionNumber = "";

     

       739
       739
       +
       		this.loadData();

     

       740
       740
       +
       	}

     

       741
       741
       +
       

     

       742
       742
       +
       

     

       638
       743
        
       	private getFilteredClasses() {

     

       639
       744
        
       		if (!this.searchTerm) return this.classes;

     

       640
       745
        
       

     
···

       656
       761
        
       		const filteredClasses = this.getFilteredClasses();

     

       657
       762
        
       

     

       658
       763
        
       		return html`

     

       659
       659
       -
             ${this.error ? html`<div class="error-message">${this.error}</div>` : ""}

     

       764
       764
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       660
       765
        
       

     

       661
       766
        
             <div class="tabs">

     

       662
       767
        
               <button

     

       663
       768
        
                 class="tab ${this.activeTab === "classes" ? "active" : ""}"

     

       664
       769
        
                 @click=${() => {

     

       665
       665
       -
       						this.activeTab = "classes";

     

       770
       770
       +
       						this.setActiveTab("classes");

     

       666
       771
        
       					}}

     

       667
       772
        
               >

     

       668
       773
        
                 Classes

     
···

       670
       775
        
               <button

     

       671
       776
        
                 class="tab ${this.activeTab === "waitlist" ? "active" : ""}"

     

       672
       777
        
                 @click=${() => {

     

       673
       673
       -
       						this.activeTab = "waitlist";

     

       778
       778
       +
       						this.setActiveTab("waitlist");

     

       674
       779
        
       					}}

     

       675
       780
        
               >

     

       676
       781
        
                 Waitlist

     
···

       685
       790
        
       			}

     

       686
       791
        
       

     

       687
       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       688
       794
        
           `;

     

       689
       795
        
       	}

     

       690
       796
        
       

     
···

       714
       820
        
                 <div class="classes-grid">

     

       715
       821
        
                   ${filteredClasses.map(

     

       716
       822
        
       							(cls) => html`

     

       717
       717
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       823
       823
       +
                     <div 

     

       824
       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       826
       +
                       style="cursor: pointer;"

     

       827
       827
       +
                     >

     

       718
       828
        
                       <div class="class-header">

     

       719
       829
        
                         <div class="class-info">

     

       720
       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       722
       832
        
                           <div class="class-meta">

     

       723
       833
        
                             <span>👤 ${cls.professor}</span>

     

       724
       834
        
                             <span>📅 ${cls.semester} ${cls.year}</span>

     

       835
       835
       +
                             <span>👥 ${cls.student_count || 0} students</span>

     

       836
       836
       +
                             <span>📄 ${cls.transcript_count || 0} transcripts</span>

     

       725
       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       726
       838
        
                           </div>

     

       727
       839
        
                         </div>

     

       728
       728
       -
                         <div class="actions">

     

       729
       729
       -
                           <button

     

       730
       730
       -
                             class="btn-archive"

     

       731
       731
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       732
       732
       -
                           >

     

       733
       733
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       734
       734
       -
                           </button>

     

       735
       735
       -
                           <button

     

       736
       736
       -
                             class="btn-delete"

     

       737
       737
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       738
       738
       -
                           >

     

       739
       739
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       740
       740
       -
                           </button>

     

       741
       741
       -
                         </div>

     

       742
       840
        
                       </div>

     

       743
       841
        
                     </div>

     

       744
       842
        
                   `,

     
···

       749
       847
        
           `;

     

       750
       848
        
       	}

     

       751
       849
        
       

     

       850
       850
       +
       	private renderClassSettingsModal() {

     

       851
       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       852
       +
       

     

       853
       853
       +
       		return html`

     

       854
       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       856
       +
                 <div class="modal-header">

     

       857
       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       859
       +
                 </div>

     

       860
       860
       +
       

     

       861
       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       863
       +
                     <button

     

       864
       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       865
       +
                     >

     

       866
       866
       +
                       Sections

     

       867
       867
       +
                     </button>

     

       868
       868
       +
                   </div>

     

       869
       869
       +
                 </div>

     

       870
       870
       +
       

     

       871
       871
       +
                 <!-- Sections Tab -->

     

       872
       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       874
       +
                   

     

       875
       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       876
       +
                     <input

     

       877
       877
       +
                       type="text"

     

       878
       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       879
       +
                       .value=${this.newSectionNumber}

     

       880
       880
       +
                       @input=${(e: Event) => {

     

       881
       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       882
       +
       								}}

     

       883
       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       884
       +
       									if (e.key === "Enter") {

     

       885
       885
       +
       										e.preventDefault();

     

       886
       886
       +
       										this.handleAddSection();

     

       887
       887
       +
       									}

     

       888
       888
       +
       								}}

     

       889
       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       890
       +
                     />

     

       891
       891
       +
                     <button

     

       892
       892
       +
                       @click=${this.handleAddSection}

     

       893
       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       895
       +
                     >

     

       896
       896
       +
                       Add Section

     

       897
       897
       +
                     </button>

     

       898
       898
       +
                   </div>

     

       899
       899
       +
       

     

       900
       900
       +
                   ${

     

       901
       901
       +
       							this.editingClassSections.length === 0

     

       902
       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       903
       +
       								: html`

     

       904
       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       905
       +
                         ${this.editingClassSections.map(

     

       906
       906
       +
       										(section) => html`

     

       907
       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       909
       +
                             <button

     

       910
       910
       +
                               @click=${(e: Event) => {

     

       911
       911
       +
       													e.stopPropagation();

     

       912
       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       913
       +
       												}}

     

       914
       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       915
       +
                             >

     

       916
       916
       +
                               Delete

     

       917
       917
       +
                             </button>

     

       918
       918
       +
                           </div>

     

       919
       919
       +
                         `,

     

       920
       920
       +
       									)}

     

       921
       921
       +
                       </div>

     

       922
       922
       +
                     `

     

       923
       923
       +
       						}

     

       924
       924
       +
                 </div>

     

       925
       925
       +
       

     

       926
       926
       +
                 <!-- Actions -->

     

       927
       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       929
       +
                     <button

     

       930
       930
       +
                       @click=${(e: Event) => {

     

       931
       931
       +
       									e.stopPropagation();

     

       932
       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       933
       +
       									this.handleCloseSectionsModal();

     

       934
       934
       +
       								}}

     

       935
       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       936
       +
                     >

     

       937
       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       938
       +
                     </button>

     

       939
       939
       +
                     <button

     

       940
       940
       +
                       @click=${(e: Event) => {

     

       941
       941
       +
       									e.stopPropagation();

     

       942
       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       943
       +
       								}}

     

       944
       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       945
       +
                     >

     

       946
       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       947
       +
                     </button>

     

       948
       948
       +
                   </div>

     

       949
       949
       +
                   <button

     

       950
       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       952
       +
                   >

     

       953
       953
       +
                     Done

     

       954
       954
       +
                   </button>

     

       955
       955
       +
                 </div>

     

       956
       956
       +
       

     

       957
       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       958
       +
               </div>

     

       959
       959
       +
             </div>

     

       960
       960
       +
           `;

     

       961
       961
       +
       	}

     

       962
       962
       +
       

     

       752
       963
        
       	private renderWaitlist() {

     

       753
       964
        
       		return html`

     

       754
       965
        
             ${

     
···

       834
       1045
        
       		this.meetingTimes = e.detail;

     

       835
       1046
        
       	}

     

       836
       1047
        
       

     

       1048
       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       1050
       +
       		this.sections = value

     

       1051
       1051
       +
       			.split(",")

     

       1052
       1052
       +
       			.map((s) => s.trim())

     

       1053
       1053
       +
       			.filter((s) => s);

     

       1054
       1054
       +
       	}

     

       1055
       1055
       +
       

     

       837
       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       838
       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       839
       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       843
       1062
        
       		this.showModal = false;

     

       844
       1063
        
       		this.approvingEntry = null;

     

       845
       1064
        
       		this.meetingTimes = [];

     

       1065
       1065
       +
       		this.sections = [];

     

       846
       1066
        
       		this.editingClass = {

     

       847
       1067
        
       			courseCode: "",

     

       848
       1068
        
       			courseName: "",

     
···

       872
       1092
        
       					semester: this.editingClass.semester,

     

       873
       1093
        
       					year: this.editingClass.year,

     

       874
       1094
        
       					meeting_times: labels,

     

       1095
       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       875
       1096
        
       				}),

     

       876
       1097
        
       			});

     

       877
       1098
        
       

     
···

       890
       1111
        
       

     

       891
       1112
        
       			await this.loadData();

     

       892
       1113
        
       

     

       893
       893
       -
       			this.activeTab = "classes";

     

       1114
       1114
       +
       			this.setActiveTab("classes");

     

       894
       1115
        
       			this.showModal = false;

     

       895
       1116
        
       			this.approvingEntry = null;

     

       896
       1117
        
       			this.meetingTimes = [];

     
···

       926
       1147
        
                   ${description}

     

       927
       1148
        
                 </p>

     

       928
       1149
        
       

     

       929
       929
       -
                 ${this.error ? html`<div class="error-message">${this.error}</div>` : ""}

     

       1150
       1150
       +
                 ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       930
       1151
        
       

     

       931
       1152
        
                 <div class="form-grid">

     

       932
       1153
        
                   <div class="form-group">

     
···

       987
       1208
        
                       .value=${this.meetingTimes}

     

       988
       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       989
       1210
        
                     ></meeting-time-picker>

     

       1211
       1211
       +
                   </div>

     

       1212
       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       1214
       +
                     <input

     

       1215
       1215
       +
                       type="text"

     

       1216
       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       1219
       +
                     />

     

       1220
       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       990
       1221
        
                   </div>

     

       991
       1222
        
                 </div>

     

       992
       1223

+36 -13

src/components/admin-pending-recordings.ts

···

       46
       46
        
             display: block;

     

       47
       47
        
           }

     

       48
       48
        
       

     

       49
       49
       +
           .error-banner {

     

       50
       50
       +
             background: #fecaca;

     

       51
       51
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       52
       52
       +
             border-radius: 6px;

     

       53
       53
       +
             padding: 1rem;

     

       54
       54
       +
             margin-bottom: 1.5rem;

     

       55
       55
       +
             color: #dc2626;

     

       56
       56
       +
             font-weight: 500;

     

       57
       57
       +
           }

     

       58
       58
       +
       

     

       49
       59
        
           .loading,

     

       50
       60
        
           .empty-state {

     

       51
       61
        
             text-align: center;

     
···

       240
       250
        
       			// Get all classes with their transcriptions

     

       241
       251
        
       			const response = await fetch("/api/classes");

     

       242
       252
        
       			if (!response.ok) {

     

       243
       243
       -
       				throw new Error("Failed to load classes");

     

       253
       253
       +
       				const data = await response.json();

     

       254
       254
       +
       				throw new Error(data.error || "Failed to load classes");

     

       244
       255
        
       			}

     

       245
       256
        
       

     

       246
       257
        
       			const data = await response.json();

     
···

       305
       316
        
       			pendingRecordings.sort((a, b) => b.created_at - a.created_at);

     

       306
       317
        
       

     

       307
       318
        
       			this.recordings = pendingRecordings;

     

       308
       308
       -
       		} catch (error) {

     

       309
       309
       -
       			console.error("Failed to load pending recordings:", error);

     

       310
       310
       -
       			this.error = "Failed to load pending recordings. Please try again.";

     

       319
       319
       +
       		} catch (err) {

     

       320
       320
       +
       			this.error =

     

       321
       321
       +
       				err instanceof Error

     

       322
       322
       +
       					? err.message

     

       323
       323
       +
       					: "Failed to load pending recordings. Please try again.";

     

       311
       324
        
       		} finally {

     

       312
       325
        
       			this.isLoading = false;

     

       313
       326
        
       		}

     

       314
       327
        
       	}

     

       315
       328
        
       

     

       316
       329
        
       	private async handleApprove(recordingId: string) {

     

       330
       330
       +
       		this.error = null;

     

       317
       331
        
       		try {

     

       318
       332
        
       			const response = await fetch(`/api/transcripts/${recordingId}/select`, {

     

       319
       333
        
       				method: "PUT",

     

       320
       334
        
       			});

     

       321
       335
        
       

     

       322
       336
        
       			if (!response.ok) {

     

       323
       323
       -
       				throw new Error("Failed to approve recording");

     

       337
       337
       +
       				const data = await response.json();

     

       338
       338
       +
       				throw new Error(data.error || "Failed to approve recording");

     

       324
       339
        
       			}

     

       325
       340
        
       

     

       326
       341
        
       			// Reload recordings

     

       327
       342
        
       			await this.loadRecordings();

     

       328
       328
       -
       		} catch (error) {

     

       329
       329
       -
       			console.error("Failed to approve recording:", error);

     

       330
       330
       -
       			alert("Failed to approve recording. Please try again.");

     

       343
       343
       +
       		} catch (err) {

     

       344
       344
       +
       			this.error =

     

       345
       345
       +
       				err instanceof Error

     

       346
       346
       +
       					? err.message

     

       347
       347
       +
       					: "Failed to approve recording. Please try again.";

     

       331
       348
        
       		}

     

       332
       349
        
       	}

     

       333
       350
        
       

     
···

       340
       357
        
       			return;

     

       341
       358
        
       		}

     

       342
       359
        
       

     

       360
       360
       +
       		this.error = null;

     

       343
       361
        
       		try {

     

       344
       362
        
       			const response = await fetch(`/api/admin/transcriptions/${recordingId}`, {

     

       345
       363
        
       				method: "DELETE",

     

       346
       364
        
       			});

     

       347
       365
        
       

     

       348
       366
        
       			if (!response.ok) {

     

       349
       349
       -
       				throw new Error("Failed to delete recording");

     

       367
       367
       +
       				const data = await response.json();

     

       368
       368
       +
       				throw new Error(data.error || "Failed to delete recording");

     

       350
       369
        
       			}

     

       351
       370
        
       

     

       352
       371
        
       			// Reload recordings

     

       353
       372
        
       			await this.loadRecordings();

     

       354
       354
       -
       		} catch (error) {

     

       355
       355
       -
       			console.error("Failed to delete recording:", error);

     

       356
       356
       -
       			alert("Failed to delete recording. Please try again.");

     

       373
       373
       +
       		} catch (err) {

     

       374
       374
       +
       			this.error =

     

       375
       375
       +
       				err instanceof Error

     

       376
       376
       +
       					? err.message

     

       377
       377
       +
       					: "Failed to delete recording. Please try again.";

     

       357
       378
        
       		}

     

       358
       379
        
       	}

     

       359
       380
        
       

     
···

       369
       390
        
       

     

       370
       391
        
       		if (this.error) {

     

       371
       392
        
       			return html`

     

       372
       372
       -
               <div class="error">${this.error}</div>

     

       393
       393
       +
               <div class="error-banner">${this.error}</div>

     

       373
       394
        
               <button @click=${this.loadRecordings}>Retry</button>

     

       374
       395
        
             `;

     

       375
       396
        
       		}

     
···

       383
       404
        
       		}

     

       384
       405
        
       

     

       385
       406
        
       		return html`

     

       407
       407
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       408
       408
       +
             

     

       386
       409
        
             <div class="recordings-grid">

     

       387
       410
        
               ${this.recordings.map(

     

       388
       411
        
       					(recording) => html`

+30 -10

src/components/admin-transcriptions.ts

···

       24
       24
        
             display: block;

     

       25
       25
        
           }

     

       26
       26
        
       

     

       27
       27
       +
           .error-banner {

     

       28
       28
       +
             background: #fecaca;

     

       29
       29
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       30
       30
       +
             border-radius: 6px;

     

       31
       31
       +
             padding: 1rem;

     

       32
       32
       +
             margin-bottom: 1.5rem;

     

       33
       33
       +
             color: #dc2626;

     

       34
       34
       +
             font-weight: 500;

     

       35
       35
       +
           }

     

       36
       36
       +
       

     

       27
       37
        
           .search-box {

     

       28
       38
        
             width: 100%;

     

       29
       39
        
             max-width: 30rem;

     
···

       180
       190
        
       		try {

     

       181
       191
        
       			const response = await fetch("/api/admin/transcriptions");

     

       182
       192
        
       			if (!response.ok) {

     

       183
       183
       -
       				throw new Error("Failed to load transcriptions");

     

       193
       193
       +
       				const data = await response.json();

     

       194
       194
       +
       				throw new Error(data.error || "Failed to load transcriptions");

     

       184
       195
        
       			}

     

       185
       196
        
       

     

       186
       186
       -
       			this.transcriptions = await response.json();

     

       187
       187
       -
       		} catch (error) {

     

       188
       188
       -
       			console.error("Failed to load transcriptions:", error);

     

       189
       189
       -
       			this.error = "Failed to load transcriptions. Please try again.";

     

       197
       197
       +
       			const result = await response.json();

     

       198
       198
       +
       			this.transcriptions = result.data || result;

     

       199
       199
       +
       		} catch (err) {

     

       200
       200
       +
       			this.error =

     

       201
       201
       +
       				err instanceof Error

     

       202
       202
       +
       					? err.message

     

       203
       203
       +
       					: "Failed to load transcriptions. Please try again.";

     

       190
       204
        
       		} finally {

     

       191
       205
        
       			this.isLoading = false;

     

       192
       206
        
       		}

     
···

       201
       215
        
       			return;

     

       202
       216
        
       		}

     

       203
       217
        
       

     

       218
       218
       +
       		this.error = null;

     

       204
       219
        
       		try {

     

       205
       220
        
       			const response = await fetch(

     

       206
       221
        
       				`/api/admin/transcriptions/${transcriptionId}`,

     
···

       210
       225
        
       			);

     

       211
       226
        
       

     

       212
       227
        
       			if (!response.ok) {

     

       213
       213
       -
       				throw new Error("Failed to delete transcription");

     

       228
       228
       +
       				const data = await response.json();

     

       229
       229
       +
       				throw new Error(data.error || "Failed to delete transcription");

     

       214
       230
        
       			}

     

       215
       231
        
       

     

       216
       232
        
       			await this.loadTranscriptions();

     

       217
       233
        
       			this.dispatchEvent(new CustomEvent("transcription-deleted"));

     

       218
       218
       -
       		} catch (error) {

     

       219
       219
       -
       			console.error("Failed to delete transcription:", error);

     

       220
       220
       -
       			alert("Failed to delete transcription. Please try again.");

     

       234
       234
       +
       		} catch (err) {

     

       235
       235
       +
       			this.error =

     

       236
       236
       +
       				err instanceof Error

     

       237
       237
       +
       					? err.message

     

       238
       238
       +
       					: "Failed to delete transcription. Please try again.";

     

       221
       239
        
       		}

     

       222
       240
        
       	}

     

       223
       241
        
       

     
···

       257
       275
        
       

     

       258
       276
        
       		if (this.error) {

     

       259
       277
        
       			return html`

     

       260
       260
       -
               <div class="error">${this.error}</div>

     

       278
       278
       +
               <div class="error-banner">${this.error}</div>

     

       261
       279
        
               <button @click=${this.loadTranscriptions}>Retry</button>

     

       262
       280
        
             `;

     

       263
       281
        
       		}

     
···

       265
       283
        
       		const filtered = this.filteredTranscriptions;

     

       266
       284
        
       

     

       267
       285
        
       		return html`

     

       286
       286
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       287
       287
       +
             

     

       268
       288
        
             <input

     

       269
       289
        
               type="text"

     

       270
       290
        
               class="search-box"

+94 -44

src/components/admin-users.ts

···

       29
       29
        
             display: block;

     

       30
       30
        
           }

     

       31
       31
        
       

     

       32
       32
       +
           .error-banner {

     

       33
       33
       +
             background: #fecaca;

     

       34
       34
       +
             border: 2px solid rgba(220, 38, 38, 0.8);

     

       35
       35
       +
             border-radius: 6px;

     

       36
       36
       +
             padding: 1rem;

     

       37
       37
       +
             margin-bottom: 1.5rem;

     

       38
       38
       +
             color: #dc2626;

     

       39
       39
       +
             font-weight: 500;

     

       40
       40
       +
           }

     

       41
       41
       +
       

     

       32
       42
        
           .search-box {

     

       33
       43
        
             width: 100%;

     

       34
       44
        
             max-width: 30rem;

     
···

       310
       320
        
       		try {

     

       311
       321
        
       			const response = await fetch("/api/admin/users");

     

       312
       322
        
       			if (!response.ok) {

     

       313
       313
       -
       				throw new Error("Failed to load users");

     

       323
       323
       +
       				const data = await response.json();

     

       324
       324
       +
       				throw new Error(data.error || "Failed to load users");

     

       314
       325
        
       			}

     

       315
       326
        
       

     

       316
       316
       -
       			this.users = await response.json();

     

       317
       317
       -
       		} catch (error) {

     

       318
       318
       -
       			console.error("Failed to load users:", error);

     

       319
       319
       -
       			this.error = "Failed to load users. Please try again.";

     

       327
       327
       +
       			const result = await response.json();

     

       328
       328
       +
       			this.users = result.data || result;

     

       329
       329
       +
       		} catch (err) {

     

       330
       330
       +
       			this.error =

     

       331
       331
       +
       				err instanceof Error

     

       332
       332
       +
       					? err.message

     

       333
       333
       +
       					: "Failed to load users. Please try again.";

     

       320
       334
        
       		} finally {

     

       321
       335
        
       			this.isLoading = false;

     

       322
       336
        
       		}

     
···

       369
       383
        
       			});

     

       370
       384
        
       

     

       371
       385
        
       			if (!response.ok) {

     

       372
       372
       -
       				throw new Error("Failed to update role");

     

       386
       386
       +
       				const data = await response.json();

     

       387
       387
       +
       				throw new Error(data.error || "Failed to update role");

     

       373
       388
        
       			}

     

       374
       389
        
       

     

       375
       390
        
       			if (isDemotingSelf) {

     
···

       377
       392
        
       			} else {

     

       378
       393
        
       				await this.loadUsers();

     

       379
       394
        
       			}

     

       380
       380
       -
       		} catch (error) {

     

       381
       381
       -
       			console.error("Failed to update role:", error);

     

       382
       382
       -
       			alert("Failed to update user role");

     

       395
       395
       +
       		} catch (err) {

     

       396
       396
       +
       			this.error =

     

       397
       397
       +
       				err instanceof Error ? err.message : "Failed to update user role";

     

       383
       398
        
       			select.value = oldRole;

     

       384
       399
        
       		}

     

       385
       400
        
       	}

     
···

       438
       453
        
       	}

     

       439
       454
        
       

     

       440
       455
        
       	private async performDeleteUser(userId: number) {

     

       456
       456
       +
       		this.error = null;

     

       441
       457
        
       		try {

     

       442
       458
        
       			const response = await fetch(`/api/admin/users/${userId}`, {

     

       443
       459
        
       				method: "DELETE",

     

       444
       460
        
       			});

     

       445
       461
        
       

     

       446
       462
        
       			if (!response.ok) {

     

       447
       447
       -
       				throw new Error("Failed to delete user");

     

       463
       463
       +
       				const data = await response.json();

     

       464
       464
       +
       				throw new Error(data.error || "Failed to delete user");

     

       448
       465
        
       			}

     

       449
       466
        
       

     

       450
       467
        
       			// Remove user from local array instead of reloading

     

       451
       451
       -
       			this.users = this.users.filter(u => u.id !== userId);

     

       468
       468
       +
       			this.users = this.users.filter((u) => u.id !== userId);

     

       452
       469
        
       			this.dispatchEvent(new CustomEvent("user-deleted"));

     

       453
       453
       -
       		} catch {

     

       454
       454
       -
       			alert("Failed to delete user. Please try again.");

     

       470
       470
       +
       		} catch (err) {

     

       471
       471
       +
       			this.error =

     

       472
       472
       +
       				err instanceof Error

     

       473
       473
       +
       					? err.message

     

       474
       474
       +
       					: "Failed to delete user. Please try again.";

     

       455
       475
        
       		}

     

       456
       476
        
       	}

     

       457
       477
        
       

     

       458
       458
       -
       	private handleRevokeClick(userId: number, email: string, subscriptionId: string, event: Event) {

     

       478
       478
       +
       	private handleRevokeClick(

     

       479
       479
       +
       		userId: number,

     

       480
       480
       +
       		email: string,

     

       481
       481
       +
       		subscriptionId: string,

     

       482
       482
       +
       		event: Event,

     

       483
       483
       +
       	) {

     

       459
       484
        
       		event.stopPropagation();

     

       460
       485
        
       

     

       461
       486
        
       		// If this is a different item or timeout expired, reset

     
···

       498
       523
        
       			this.deleteState = null;

     

       499
       524
        
       		}, 1000);

     

       500
       525
        
       

     

       501
       501
       -
       		this.deleteState = { id: userId, type: "revoke", clicks: newClicks, timeout };

     

       526
       526
       +
       		this.deleteState = {

     

       527
       527
       +
       			id: userId,

     

       528
       528
       +
       			type: "revoke",

     

       529
       529
       +
       			clicks: newClicks,

     

       530
       530
       +
       			timeout,

     

       531
       531
       +
       		};

     

       502
       532
        
       	}

     

       503
       533
        
       

     

       504
       504
       -
       	private async performRevokeSubscription(userId: number, email: string, subscriptionId: string) {

     

       534
       534
       +
       	private async performRevokeSubscription(

     

       535
       535
       +
       		userId: number,

     

       536
       536
       +
       		_email: string,

     

       537
       537
       +
       		subscriptionId: string,

     

       538
       538
       +
       	) {

     

       505
       539
        
       		this.revokingSubscriptions.add(userId);

     

       506
       540
        
       		this.requestUpdate();

     

       541
       541
       +
       		this.error = null;

     

       507
       542
        
       

     

       508
       543
        
       		try {

     

       509
       544
        
       			const response = await fetch(`/api/admin/users/${userId}/subscription`, {

     
···

       518
       553
        
       			}

     

       519
       554
        
       

     

       520
       555
        
       			await this.loadUsers();

     

       521
       521
       -
       			alert(`Subscription revoked for ${email}`);

     

       522
       522
       -
       		} catch (error) {

     

       523
       523
       -
       			alert(`Failed to revoke subscription: ${error instanceof Error ? error.message : "Unknown error"}`);

     

       556
       556
       +
       		} catch (err) {

     

       557
       557
       +
       			this.error =

     

       558
       558
       +
       				err instanceof Error ? err.message : "Failed to revoke subscription";

     

       524
       559
        
       			this.revokingSubscriptions.delete(userId);

     

       525
       560
        
       		}

     

       526
       561
        
       	}

     
···

       530
       565
        
       

     

       531
       566
        
       		this.syncingSubscriptions.add(userId);

     

       532
       567
        
       		this.requestUpdate();

     

       568
       568
       +
       		this.error = null;

     

       533
       569
        
       

     

       534
       570
        
       		try {

     

       535
       571
        
       			const response = await fetch(`/api/admin/users/${userId}/subscription`, {

     
···

       539
       575
        
       

     

       540
       576
        
       			if (!response.ok) {

     

       541
       577
        
       				const data = await response.json();

     

       542
       542
       -
       				// Don't alert if there's just no subscription

     

       578
       578
       +
       				// Don't show error if there's just no subscription

     

       543
       579
        
       				if (response.status !== 404) {

     

       544
       544
       -
       					alert(`Failed to sync subscription: ${data.error || "Unknown error"}`);

     

       580
       580
       +
       					this.error = data.error || "Failed to sync subscription";

     

       545
       581
        
       				}

     

       546
       582
        
       				return;

     

       547
       583
        
       			}

     
···

       578
       614
        
       		if (userId === 0) {

     

       579
       615
        
       			return;

     

       580
       616
        
       		}

     

       581
       581
       -
       		

     

       617
       617
       +
       

     

       582
       618
        
       		// Don't open modal if clicking on delete button, revoke button, sync button, or role select

     

       583
       619
        
       		if (

     

       584
       620
        
       			(event.target as HTMLElement).closest(".delete-btn") ||

     
···

       603
       639
        
       

     

       604
       640
        
       	private get filteredUsers() {

     

       605
       641
        
       		const query = this.searchQuery.toLowerCase();

     

       606
       606
       -
       		

     

       642
       642
       +
       

     

       607
       643
        
       		// Filter users based on search query

     

       608
       644
        
       		let filtered = this.users.filter(

     

       609
       645
        
       			(u) =>

     

       610
       646
        
       				u.email.toLowerCase().includes(query) ||

     

       611
       647
        
       				u.name?.toLowerCase().includes(query),

     

       612
       648
        
       		);

     

       613
       613
       -
       		

     

       649
       649
       +
       

     

       614
       650
        
       		// Hide ghost user unless specifically searched for

     

       615
       615
       -
       		if (!query.includes("deleted") && !query.includes("ghost") && !query.includes("system")) {

     

       616
       616
       -
       			filtered = filtered.filter(u => u.id !== 0);

     

       651
       651
       +
       		if (

     

       652
       652
       +
       			!query.includes("deleted") &&

     

       653
       653
       +
       			!query.includes("ghost") &&

     

       654
       654
       +
       			!query.includes("system")

     

       655
       655
       +
       		) {

     

       656
       656
       +
       			filtered = filtered.filter((u) => u.id !== 0);

     

       617
       657
        
       		}

     

       618
       618
       -
       		

     

       658
       658
       +
       

     

       619
       659
        
       		return filtered;

     

       620
       660
        
       	}

     

       621
       661
        
       

     
···

       626
       666
        
       

     

       627
       667
        
       		if (this.error) {

     

       628
       668
        
       			return html`

     

       629
       629
       -
               <div class="error">${this.error}</div>

     

       669
       669
       +
               <div class="error-banner">${this.error}</div>

     

       630
       670
        
               <button @click=${this.loadUsers}>Retry</button>

     

       631
       671
        
             `;

     

       632
       672
        
       		}

     
···

       634
       674
        
       		const filtered = this.filteredUsers;

     

       635
       675
        
       

     

       636
       676
        
       		return html`

     

       677
       677
       +
             ${this.error ? html`<div class="error-banner">${this.error}</div>` : ""}

     

       678
       678
       +
             

     

       637
       679
        
             <input

     

       638
       680
        
               type="text"

     

       639
       681
        
               class="search-box"

     
···

       651
       693
        
                 <div class="users-grid">

     

       652
       694
        
                   ${filtered.map(

     

       653
       695
        
       							(u) => html`

     

       654
       654
       -
                     <div class="user-card ${u.id === 0 ? 'system' : ''}" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       696
       696
       +
                     <div class="user-card ${u.id === 0 ? "system" : ""}" @click=${(e: Event) => this.handleCardClick(u.id, e)}>

     

       655
       697
        
                       <div class="card-header">

     

       656
       698
        
                         <div class="user-info">

     

       657
       699
        
                           <img

     
···

       664
       706
        
                             <div class="user-email">${u.email}</div>

     

       665
       707
        
                           </div>

     

       666
       708
        
                         </div>

     

       667
       667
       -
                         ${u.id === 0 

     

       668
       668
       -
                           ? html`<span class="system-badge">System</span>` 

     

       669
       669
       -
                           : u.role === "admin" 

     

       670
       670
       -
                             ? html`<span class="admin-badge">Admin</span>` 

     

       671
       671
       -
                             : ""

     

       672
       672
       -
                         }

     

       709
       709
       +
                         ${

     

       710
       710
       +
       										u.id === 0

     

       711
       711
       +
       											? html`<span class="system-badge">System</span>`

     

       712
       712
       +
       											: u.role === "admin"

     

       713
       713
       +
       												? html`<span class="admin-badge">Admin</span>`

     

       714
       714
       +
       												: ""

     

       715
       715
       +
       									}

     

       673
       716
        
                       </div>

     

       674
       717
        
       

     

       675
       718
        
                       <div class="meta-row">

     
···

       680
       723
        
                         <div class="meta-item">

     

       681
       724
        
                           <div class="meta-label">Subscription</div>

     

       682
       725
        
                           <div class="meta-value">

     

       683
       683
       -
                             ${u.subscription_status 

     

       684
       684
       -
                               ? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>` 

     

       685
       685
       -
                               : html`<span class="subscription-badge none">None</span>`

     

       686
       686
       -
                             }

     

       726
       726
       +
                             ${

     

       727
       727
       +
       												u.subscription_status

     

       728
       728
       +
       													? html`<span class="subscription-badge ${u.subscription_status.toLowerCase()}">${u.subscription_status}</span>`

     

       729
       729
       +
       													: html`<span class="subscription-badge none">None</span>`

     

       730
       730
       +
       											}

     

       687
       731
        
                           </div>

     

       688
       732
        
                         </div>

     

       689
       733
        
                         <div class="meta-item">

     
···

       701
       745
        
                       </div>

     

       702
       746
        
       

     

       703
       747
        
                       <div class="actions">

     

       704
       704
       -
                         ${u.id === 0 

     

       705
       705
       -
                           ? html`<div style="color: var(--paynes-gray); font-size: 0.875rem; padding: 0.5rem;">System account cannot be modified</div>`

     

       706
       706
       -
                           : html`

     

       748
       748
       +
                         ${

     

       749
       749
       +
       										u.id === 0

     

       750
       750
       +
       											? html`<div style="color: var(--paynes-gray); font-size: 0.875rem; padding: 0.5rem;">System account cannot be modified</div>`

     

       751
       751
       +
       											: html`

     

       707
       752
        
                             <select

     

       708
       753
        
                               class="role-select"

     

       709
       754
        
                               .value=${u.role}

     
···

       725
       770
        
                               ?disabled=${!u.subscription_status || !u.subscription_id || this.revokingSubscriptions.has(u.id)}

     

       726
       771
        
                               @click=${(e: Event) => {

     

       727
       772
        
       													if (u.subscription_id) {

     

       728
       728
       -
       														this.handleRevokeClick(u.id, u.email, u.subscription_id, e);

     

       773
       773
       +
       														this.handleRevokeClick(

     

       774
       774
       +
       															u.id,

     

       775
       775
       +
       															u.email,

     

       776
       776
       +
       															u.subscription_id,

     

       777
       777
       +
       															e,

     

       778
       778
       +
       														);

     

       729
       779
        
       													}

     

       730
       780
        
       												}}

     

       731
       781
        
                             >

     
···

       735
       785
        
                               ${this.getDeleteButtonText(u.id, "user")}

     

       736
       786
        
                             </button>

     

       737
       787
        
                           `

     

       738
       738
       -
                         }

     

       788
       788
       +
       									}

     

       739
       789
        
                       </div>

     

       740
       790
        
                     </div>

     

       741
       791
        
                   `,

+273 -4

src/components/auth.ts

···

       30
       30
        
       	@state() needsRegistration = false;

     

       31
       31
        
       	@state() passwordStrength: PasswordStrengthResult | null = null;

     

       32
       32
        
       	@state() passkeySupported = false;

     

       33
       33
       +
       	@state() needsEmailVerification = false;

     

       34
       34
       +
       	@state() verificationCode = "";

     

       35
       35
       +
       	@state() resendCodeTimer = 0;

     

       36
       36
       +
       	@state() resendingCode = false;

     

       37
       37
       +
       	private resendInterval: number | null = null;

     

       38
       38
       +
       	private codeSentAt: number | null = null; // Unix timestamp in seconds when code was sent

     

       33
       39
        
       

     

       34
       40
        
       	static override styles = css`

     

       35
       41
        
       		:host {

     
···

       268
       274
        
       		.info-text {

     

       269
       275
        
       			color: var(--text);

     

       270
       276
        
       			font-size: 0.875rem;

     

       271
       271
       -
       			margin: 0;

     

       277
       277
       +
       			margin: 0 0 1.5rem 0;

     

       278
       278
       +
       			line-height: 1.5;

     

       279
       279
       +
       		}

     

       280
       280
       +
       

     

       281
       281
       +
       		.verification-code-input {

     

       282
       282
       +
       			text-align: center;

     

       283
       283
       +
       			font-size: 1.5rem;

     

       284
       284
       +
       			letter-spacing: 0.5rem;

     

       285
       285
       +
       			font-weight: 600;

     

       286
       286
       +
       			padding: 1rem;

     

       287
       287
       +
       			font-family: 'Monaco', 'Courier New', monospace;

     

       288
       288
       +
       		}

     

       289
       289
       +
       

     

       290
       290
       +
       		.resend-link {

     

       291
       291
       +
       			text-align: center;

     

       292
       292
       +
       			margin-top: 1rem;

     

       293
       293
       +
       			font-size: 0.875rem;

     

       294
       294
       +
       			color: var(--text);

     

       295
       295
       +
       		}

     

       296
       296
       +
       

     

       297
       297
       +
       		.resend-button {

     

       298
       298
       +
       			background: none;

     

       299
       299
       +
       			border: none;

     

       300
       300
       +
       			color: var(--primary);

     

       301
       301
       +
       			cursor: pointer;

     

       302
       302
       +
       			text-decoration: underline;

     

       303
       303
       +
       			font-size: 0.875rem;

     

       304
       304
       +
       			padding: 0;

     

       305
       305
       +
       			font-family: inherit;

     

       306
       306
       +
       		}

     

       307
       307
       +
       

     

       308
       308
       +
       		.resend-button:hover:not(:disabled) {

     

       309
       309
       +
       			color: var(--accent);

     

       310
       310
       +
       		}

     

       311
       311
       +
       

     

       312
       312
       +
       		.resend-button:disabled {

     

       313
       313
       +
       			color: var(--secondary);

     

       314
       314
       +
       			cursor: not-allowed;

     

       315
       315
       +
       			text-decoration: none;

     

       316
       316
       +
       		}

     

       317
       317
       +
       

     

       318
       318
       +
       		.btn-secondary {

     

       319
       319
       +
       			background: transparent;

     

       320
       320
       +
       			color: var(--text);

     

       321
       321
       +
       			border-color: var(--secondary);

     

       322
       322
       +
       			flex: 1;

     

       323
       323
       +
       		}

     

       324
       324
       +
       

     

       325
       325
       +
       		.btn-secondary:hover:not(:disabled) {

     

       326
       326
       +
       			border-color: var(--primary);

     

       327
       327
       +
       			color: var(--primary);

     

       272
       328
        
       		}

     

       273
       329
        
       

     

       274
       330
        
       	.divider {

     
···

       383
       439
        
       					return;

     

       384
       440
        
       				}

     

       385
       441
        
       

     

       386
       386
       -
       				this.user = await response.json();

     

       442
       442
       +
       				const data = await response.json();

     

       443
       443
       +
       

     

       444
       444
       +
       				if (data.email_verification_required) {

     

       445
       445
       +
       					this.needsEmailVerification = true;

     

       446
       446
       +
       					this.password = "";

     

       447
       447
       +
       					this.error = "";

     

       448
       448
       +
       					this.startResendTimer(data.verification_code_sent_at);

     

       449
       449
       +
       					return;

     

       450
       450
       +
       				}

     

       451
       451
       +
       

     

       452
       452
       +
       				this.user = data;

     

       387
       453
        
       				this.closeModal();

     

       388
       454
        
       				await this.checkAuth();

     

       389
       455
        
       				window.dispatchEvent(new CustomEvent("auth-changed"));

     
···

       411
       477
        
       					return;

     

       412
       478
        
       				}

     

       413
       479
        
       

     

       414
       414
       -
       				this.user = await response.json();

     

       480
       480
       +
       				const data = await response.json();

     

       481
       481
       +
       

     

       482
       482
       +
       				if (data.email_verification_required) {

     

       483
       483
       +
       					this.needsEmailVerification = true;

     

       484
       484
       +
       					this.password = "";

     

       485
       485
       +
       					this.error = "";

     

       486
       486
       +
       					this.startResendTimer(data.verification_code_sent_at);

     

       487
       487
       +
       					return;

     

       488
       488
       +
       				}

     

       489
       489
       +
       

     

       490
       490
       +
       				this.user = data;

     

       415
       491
        
       				this.closeModal();

     

       416
       492
        
       				await this.checkAuth();

     

       417
       493
        
       				window.dispatchEvent(new CustomEvent("auth-changed"));

     
···

       453
       529
        
       		this.password = (e.target as HTMLInputElement).value;

     

       454
       530
        
       	}

     

       455
       531
        
       

     

       532
       532
       +
       	private handleVerificationCodeInput(e: Event) {

     

       533
       533
       +
       		this.verificationCode = (e.target as HTMLInputElement).value;

     

       534
       534
       +
       	}

     

       535
       535
       +
       

     

       536
       536
       +
       	private async handleVerifyEmail(e: Event) {

     

       537
       537
       +
       		e.preventDefault();

     

       538
       538
       +
       		this.error = "";

     

       539
       539
       +
       		this.isSubmitting = true;

     

       540
       540
       +
       

     

       541
       541
       +
       		try {

     

       542
       542
       +
       			const response = await fetch("/api/auth/verify-email", {

     

       543
       543
       +
       				method: "POST",

     

       544
       544
       +
       				headers: {

     

       545
       545
       +
       					"Content-Type": "application/json",

     

       546
       546
       +
       				},

     

       547
       547
       +
       				body: JSON.stringify({

     

       548
       548
       +
       					email: this.email,

     

       549
       549
       +
       					code: this.verificationCode,

     

       550
       550
       +
       				}),

     

       551
       551
       +
       			});

     

       552
       552
       +
       

     

       553
       553
       +
       			if (!response.ok) {

     

       554
       554
       +
       				const data = await response.json();

     

       555
       555
       +
       				this.error = data.error || "Verification failed";

     

       556
       556
       +
       				return;

     

       557
       557
       +
       			}

     

       558
       558
       +
       

     

       559
       559
       +
       			// Successfully verified - redirect to classes

     

       560
       560
       +
       			this.closeModal();

     

       561
       561
       +
       			await this.checkAuth();

     

       562
       562
       +
       			window.dispatchEvent(new CustomEvent("auth-changed"));

     

       563
       563
       +
       			window.location.href = "/classes";

     

       564
       564
       +
       		} catch (error) {

     

       565
       565
       +
       			this.error = error instanceof Error ? error.message : "An error occurred";

     

       566
       566
       +
       		} finally {

     

       567
       567
       +
       			this.isSubmitting = false;

     

       568
       568
       +
       		}

     

       569
       569
       +
       	}

     

       570
       570
       +
       

     

       456
       571
        
       	private handlePasswordBlur() {

     

       457
       572
        
       		if (!this.needsRegistration) return;

     

       458
       573
        
       

     
···

       490
       605
        
       		}

     

       491
       606
        
       	}

     

       492
       607
        
       

     

       608
       608
       +
       	private startResendTimer(sentAtTimestamp: number) {

     

       609
       609
       +
       		// Use provided timestamp

     

       610
       610
       +
       		this.codeSentAt = sentAtTimestamp;

     

       611
       611
       +
       

     

       612
       612
       +
       		// Clear existing interval if any

     

       613
       613
       +
       		if (this.resendInterval !== null) {

     

       614
       614
       +
       			clearInterval(this.resendInterval);

     

       615
       615
       +
       		}

     

       616
       616
       +
       

     

       617
       617
       +
       		// Update timer based on elapsed time

     

       618
       618
       +
       		const updateTimer = () => {

     

       619
       619
       +
       			if (this.codeSentAt === null) return;

     

       620
       620
       +
       

     

       621
       621
       +
       			const now = Math.floor(Date.now() / 1000);

     

       622
       622
       +
       			const elapsed = now - this.codeSentAt;

     

       623
       623
       +
       			const remaining = Math.max(0, 5 * 60 - elapsed);

     

       624
       624
       +
       			this.resendCodeTimer = remaining;

     

       625
       625
       +
       

     

       626
       626
       +
       			if (remaining <= 0) {

     

       627
       627
       +
       				if (this.resendInterval !== null) {

     

       628
       628
       +
       					clearInterval(this.resendInterval);

     

       629
       629
       +
       					this.resendInterval = null;

     

       630
       630
       +
       				}

     

       631
       631
       +
       			}

     

       632
       632
       +
       		};

     

       633
       633
       +
       

     

       634
       634
       +
       		// Update immediately

     

       635
       635
       +
       		updateTimer();

     

       636
       636
       +
       

     

       637
       637
       +
       		// Then update every second

     

       638
       638
       +
       		this.resendInterval = window.setInterval(updateTimer, 1000);

     

       639
       639
       +
       	}

     

       640
       640
       +
       

     

       641
       641
       +
       	private async handleResendCode() {

     

       642
       642
       +
       		this.error = "";

     

       643
       643
       +
       		this.resendingCode = true;

     

       644
       644
       +
       

     

       645
       645
       +
       		try {

     

       646
       646
       +
       			const response = await fetch("/api/auth/resend-verification-code", {

     

       647
       647
       +
       				method: "POST",

     

       648
       648
       +
       				headers: {

     

       649
       649
       +
       					"Content-Type": "application/json",

     

       650
       650
       +
       				},

     

       651
       651
       +
       				body: JSON.stringify({

     

       652
       652
       +
       					email: this.email,

     

       653
       653
       +
       				}),

     

       654
       654
       +
       			});

     

       655
       655
       +
       

     

       656
       656
       +
       			if (!response.ok) {

     

       657
       657
       +
       				const data = await response.json();

     

       658
       658
       +
       				this.error = data.error || "Failed to resend code";

     

       659
       659
       +
       				return;

     

       660
       660
       +
       			}

     

       661
       661
       +
       

     

       662
       662
       +
       			// Start the 5-minute timer

     

       663
       663
       +
       			this.startResendTimer(data.verification_code_sent_at);

     

       664
       664
       +
       		} catch (error) {

     

       665
       665
       +
       			this.error = error instanceof Error ? error.message : "An error occurred";

     

       666
       666
       +
       		} finally {

     

       667
       667
       +
       			this.resendingCode = false;

     

       668
       668
       +
       		}

     

       669
       669
       +
       	}

     

       670
       670
       +
       

     

       671
       671
       +
       	private formatTimer(seconds: number): string {

     

       672
       672
       +
       		const mins = Math.floor(seconds / 60);

     

       673
       673
       +
       		const secs = seconds % 60;

     

       674
       674
       +
       		return `${mins}:${secs.toString().padStart(2, "0")}`;

     

       675
       675
       +
       	}

     

       676
       676
       +
       

     

       677
       677
       +
       	override disconnectedCallback() {

     

       678
       678
       +
       		super.disconnectedCallback();

     

       679
       679
       +
       		// Clean up timer when component is removed

     

       680
       680
       +
       		if (this.resendInterval !== null) {

     

       681
       681
       +
       			clearInterval(this.resendInterval);

     

       682
       682
       +
       			this.resendInterval = null;

     

       683
       683
       +
       		}

     

       684
       684
       +
       	}

     

       685
       685
       +
       

     

       493
       686
        
       	override render() {

     

       494
       687
        
       		if (this.loading) {

     

       495
       688
        
       			return html`<div class="loading">Loading...</div>`;

     
···

       543
       736
        
       						<div class="modal-overlay" @click=${this.closeModal}>

     

       544
       737
        
       							<div class="modal" @click=${(e: Event) => e.stopPropagation()}>

     

       545
       738
        
       								<h2 class="modal-title">

     

       546
       546
       -
       									${this.needsRegistration ? "Create Account" : "Sign In"}

     

       739
       739
       +
       									${this.needsEmailVerification ? "Verify Email" : this.needsRegistration ? "Create Account" : "Sign In"}

     

       547
       740
        
       								</h2>

     

       548
       741
        
       

     

       549
       742
        
       								${

     

       743
       743
       +
       									this.needsEmailVerification

     

       744
       744
       +
       										? html`

     

       745
       745
       +
       											<p class="info-text">

     

       746
       746
       +
       												We sent a 6-digit verification code to <strong>${this.email}</strong>.<br>

     

       747
       747
       +
       												Check your email and enter the code below.

     

       748
       748
       +
       											</p>

     

       749
       749
       +
       											

     

       750
       750
       +
       											<form @submit=${this.handleVerifyEmail}>

     

       751
       751
       +
       												<div class="form-group">

     

       752
       752
       +
       													<label for="verification-code">Verification Code</label>

     

       753
       753
       +
       													<input

     

       754
       754
       +
       														type="text"

     

       755
       755
       +
       														id="verification-code"

     

       756
       756
       +
       														class="verification-code-input"

     

       757
       757
       +
       														placeholder="000000"

     

       758
       758
       +
       														.value=${this.verificationCode}

     

       759
       759
       +
       														@input=${this.handleVerificationCodeInput}

     

       760
       760
       +
       														required

     

       761
       761
       +
       														maxlength="6"

     

       762
       762
       +
       														pattern="[0-9]{6}"

     

       763
       763
       +
       														inputmode="numeric"

     

       764
       764
       +
       														?disabled=${this.isSubmitting}

     

       765
       765
       +
       														autocomplete="one-time-code"

     

       766
       766
       +
       													/>

     

       767
       767
       +
       												</div>

     

       768
       768
       +
       

     

       769
       769
       +
       												${

     

       770
       770
       +
       													this.error

     

       771
       771
       +
       														? html`<div class="error-message">${this.error}</div>`

     

       772
       772
       +
       														: ""

     

       773
       773
       +
       												}

     

       774
       774
       +
       

     

       775
       775
       +
       												<div class="resend-link">

     

       776
       776
       +
       													${

     

       777
       777
       +
       														this.resendCodeTimer > 0

     

       778
       778
       +
       															? html`Resend code in ${this.formatTimer(this.resendCodeTimer)}`

     

       779
       779
       +
       															: html`

     

       780
       780
       +
       																<button

     

       781
       781
       +
       																	type="button"

     

       782
       782
       +
       																	class="resend-button"

     

       783
       783
       +
       																	@click=${this.handleResendCode}

     

       784
       784
       +
       																	?disabled=${this.resendingCode}

     

       785
       785
       +
       																>

     

       786
       786
       +
       																	${this.resendingCode ? "Sending..." : "Resend code"}

     

       787
       787
       +
       																</button>

     

       788
       788
       +
       															`

     

       789
       789
       +
       													}

     

       790
       790
       +
       												</div>

     

       791
       791
       +
       

     

       792
       792
       +
       												<div class="modal-actions">

     

       793
       793
       +
       													<button

     

       794
       794
       +
       														type="submit"

     

       795
       795
       +
       														class="btn-primary"

     

       796
       796
       +
       														?disabled=${this.isSubmitting || this.verificationCode.length !== 6}

     

       797
       797
       +
       													>

     

       798
       798
       +
       														${this.isSubmitting ? "Verifying..." : "Verify Email"}

     

       799
       799
       +
       													</button>

     

       800
       800
       +
       													<button

     

       801
       801
       +
       														type="button"

     

       802
       802
       +
       														class="btn-secondary"

     

       803
       803
       +
       														@click=${() => {

     

       804
       804
       +
       															this.needsEmailVerification = false;

     

       805
       805
       +
       															this.verificationCode = "";

     

       806
       806
       +
       															this.error = "";

     

       807
       807
       +
       														}}

     

       808
       808
       +
       														?disabled=${this.isSubmitting}

     

       809
       809
       +
       													>

     

       810
       810
       +
       														Back

     

       811
       811
       +
       													</button>

     

       812
       812
       +
       												</div>

     

       813
       813
       +
       											</form>

     

       814
       814
       +
       										`

     

       815
       815
       +
       										: html`

     

       816
       816
       +
       								${

     

       550
       817
        
       									this.needsRegistration

     

       551
       818
        
       										? html`

     

       552
       819
        
       											<p class="info-text">

     
···

       660
       927
        
       										</button>

     

       661
       928
        
       									</div>

     

       662
       929
        
       								</form>

     

       930
       930
       +
       										`

     

       931
       931
       +
       								}

     

       663
       932
        
       							</div>

     

       664
       933
        
       						</div>

     

       665
       934
        
       					`

+123 -13

src/components/class-view.ts

···

       2
       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
       3
        
       import "./upload-recording-modal.ts";

     

       4
       4
        
       import "./vtt-viewer.ts";

     

       5
       5
       +
       import "./pending-recordings-view.ts";

     

       5
       6
        
       

     

       6
       7
        
       interface Class {

     

       7
       8
        
       	id: string;

     
···

       24
       25
        
       	id: string;

     

       25
       26
        
       	user_id: number;

     

       26
       27
        
       	meeting_time_id: string | null;

     

       28
       28
       +
       	section_id: string | null;

     

       27
       29
        
       	filename: string;

     

       28
       30
        
       	original_filename: string;

     

       29
       31
        
       	status:

     
···

       42
       44
        
       	audioUrl?: string;

     

       43
       45
        
       }

     

       44
       46
        
       

     

       47
       47
       +
       interface ClassSection {

     

       48
       48
       +
       	id: string;

     

       49
       49
       +
       	section_number: string;

     

       50
       50
       +
       }

     

       51
       51
       +
       

     

       45
       52
        
       @customElement("class-view")

     

       46
       53
        
       export class ClassView extends LitElement {

     

       47
       54
        
       	@state() classId = "";

     

       48
       55
        
       	@state() classInfo: Class | null = null;

     

       49
       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       58
       +
       	@state() userSection: string | null = null;

     

       59
       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       50
       60
        
       	@state() transcriptions: Transcription[] = [];

     

       51
       61
        
       	@state() isLoading = true;

     

       52
       62
        
       	@state() error: string | null = null;

     
···

       363
       373
        
       			const data = await response.json();

     

       364
       374
        
       			this.classInfo = data.class;

     

       365
       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       376
       +
       			this.sections = data.sections || [];

     

       377
       377
       +
       			this.userSection = data.userSection || null;

     

       366
       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       379
       +
       

     

       380
       380
       +
       			// Default to user's section for filtering

     

       381
       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       383
       +
       			}

     

       367
       384
        
       

     

       368
       385
        
       			// Load VTT for completed transcriptions

     

       369
       386
        
       			await this.loadVTTForCompleted();

     
···

       450
       467
        
       	}

     

       451
       468
        
       

     

       452
       469
        
       	private get filteredTranscriptions() {

     

       453
       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       470
       470
       +
       		let filtered = this.transcriptions;

     

       454
       471
        
       

     

       455
       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       458
       -
       		);

     

       472
       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       474
       +
       		

     

       475
       475
       +
       		// Only filter by section if:

     

       476
       476
       +
       		// 1. There are sections in the class

     

       477
       477
       +
       		// 2. User has a section OR has selected one

     

       478
       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       479
       +
       			// For admins: show all transcriptions

     

       480
       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       481
       +
       			if (!this.isAdmin) {

     

       482
       482
       +
       				filtered = filtered.filter(

     

       483
       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       484
       +
       				);

     

       485
       485
       +
       			}

     

       486
       486
       +
       		}

     

       487
       487
       +
       

     

       488
       488
       +
       		// Filter by search query

     

       489
       489
       +
       		if (this.searchQuery) {

     

       490
       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       493
       +
       			);

     

       494
       494
       +
       		}

     

       495
       495
       +
       

     

       496
       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       498
       +
       

     

       499
       499
       +
       		return filtered;

     

       459
       500
        
       	}

     

       460
       501
        
       

     

       461
       502
        
       	private formatDate(timestamp: number): string {

     
···

       521
       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
       563
        
                   <h1>${this.classInfo.name}</h1>

     

       523
       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       565
       565
       +
                   <div class="semester">

     

       566
       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       567
       +
                     ${

     

       568
       568
       +
       								this.userSection

     

       569
       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       570
       +
       									: ""

     

       571
       571
       +
       							}

     

       572
       572
       +
                   </div>

     

       525
       573
        
                 </div>

     

       526
       574
        
               </div>

     

       527
       575
        
       

     
···

       538
       586
        
       						: ""

     

       539
       587
        
       				}

     

       540
       588
        
       

     

       541
       541
       -
               ${!canAccessTranscriptions ? html`

     

       589
       589
       +
               ${

     

       590
       590
       +
       					!canAccessTranscriptions

     

       591
       591
       +
       						? html`

     

       542
       592
        
                 <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin: 2rem 0; text-align: center;">

     

       543
       593
        
                   <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Access Recordings</h3>

     

       544
       594
        
                   <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and view transcriptions.</p>

     

       545
       595
        
                   <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       546
       596
        
                 </div>

     

       547
       547
       -
               ` : html`

     

       597
       597
       +
               `

     

       598
       598
       +
       						: html`

     

       548
       599
        
               <div class="search-upload">

     

       600
       600
       +
                 ${

     

       601
       601
       +
       						this.sections.length > 1

     

       602
       602
       +
       							? html`

     

       603
       603
       +
                     <select

     

       604
       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       605
       +
                       @change=${(e: Event) => {

     

       606
       606
       +
       									this.selectedSectionFilter =

     

       607
       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       608
       +
       								}}

     

       609
       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       610
       +
                     >

     

       611
       611
       +
                       ${this.sections.map(

     

       612
       612
       +
       									(s) =>

     

       613
       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       614
       +
       								)}

     

       615
       615
       +
                     </select>

     

       616
       616
       +
                   `

     

       617
       617
       +
       							: ""

     

       618
       618
       +
       					}

     

       549
       619
        
                 <input

     

       550
       620
        
                   type="text"

     

       551
       621
        
                   class="search-box"

     
···

       564
       634
        
                 </button>

     

       565
       635
        
               </div>

     

       566
       636
        
       

     

       637
       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       638
       +
               ${

     

       639
       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       640
       +
       						// Apply section filtering to pending recordings

     

       641
       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       642
       +
       						

     

       643
       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       645
       +
       								return false;

     

       646
       646
       +
       							}

     

       647
       647
       +
       							

     

       648
       648
       +
       							// Filter by section if applicable

     

       649
       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       652
       +
       							}

     

       653
       653
       +
       							

     

       654
       654
       +
       							return true;

     

       655
       655
       +
       						}).length;

     

       656
       656
       +
       

     

       657
       657
       +
       						// Only show if there are pending recordings

     

       658
       658
       +
       						if (pendingCount === 0) return "";

     

       659
       659
       +
       

     

       660
       660
       +
       						return html`

     

       661
       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       662
       +
                     <pending-recordings-view

     

       663
       663
       +
                       .classId=${this.classId}

     

       664
       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       666
       +
                       .sectionId=${sectionFilter}

     

       667
       667
       +
                     ></pending-recordings-view>

     

       668
       668
       +
                   </div>

     

       669
       669
       +
                 `;

     

       670
       670
       +
       					})

     

       671
       671
       +
       				}

     

       672
       672
       +
       

     

       673
       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       567
       674
        
               ${

     

       568
       675
        
       					this.filteredTranscriptions.length === 0

     

       569
       676
        
       						? html`

     
···

       572
       679
        
                 <p>${this.searchQuery ? "Try a different search term" : "Upload a recording to get started!"}</p>

     

       573
       680
        
               </div>

     

       574
       681
        
             `

     

       575
       575
       -
       					: html`

     

       682
       682
       +
       						: html`

     

       576
       683
        
               ${this.filteredTranscriptions.map(

     

       577
       577
       -
       						(t) => html`

     

       684
       684
       +
       					(t) => html`

     

       578
       685
        
                 <div class="transcription-card">

     

       579
       686
        
                   <div class="transcription-header">

     

       580
       687
        
                     <div>

     
···

       617
       724
        
                   ${t.error_message ? html`<div class="error">${t.error_message}</div>` : ""}

     

       618
       725
        
                 </div>

     

       619
       726
        
               `,

     

       620
       620
       -
       					)}

     

       727
       727
       +
       				)}

     

       621
       728
        
             `

     

       622
       622
       -
       			}

     

       623
       623
       -
               `}

     

       729
       729
       +
       				}

     

       730
       730
       +
               `

     

       731
       731
       +
       				}

     

       624
       732
        
             </div>

     

       625
       733
        
       

     

       626
       734
        
             <upload-recording-modal

     

       627
       735
        
               ?open=${this.uploadModalOpen}

     

       628
       736
        
               .classId=${this.classId}

     

       629
       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       738
       +
               .sections=${this.sections}

     

       739
       739
       +
               .userSection=${this.userSection}

     

       630
       740
        
               @close=${this.handleModalClose}

     

       631
       741
        
               @upload-success=${this.handleUploadSuccess}

     

       632
       742
        
             ></upload-recording-modal>

+21 -7

src/components/classes-overview.ts

···

       150
       150
        
             margin-bottom: 1rem;

     

       151
       151
        
           }

     

       152
       152
        
       

     

       153
       153
       +
           .empty-state button {

     

       154
       154
       +
             margin-top: 2rem;

     

       155
       155
       +
             padding: 0.75rem 2rem;

     

       156
       156
       +
             background: var(--accent);

     

       157
       157
       +
             color: var(--white);

     

       158
       158
       +
             border: none;

     

       159
       159
       +
             border-radius: 8px;

     

       160
       160
       +
             font-size: 1rem;

     

       161
       161
       +
             font-weight: 600;

     

       162
       162
       +
             cursor: pointer;

     

       163
       163
       +
             transition: all 0.2s;

     

       164
       164
       +
           }

     

       165
       165
       +
       

     

       166
       166
       +
           .empty-state button:hover {

     

       167
       167
       +
             background: color-mix(in srgb, var(--accent) 90%, black);

     

       168
       168
       +
             transform: translateY(-2px);

     

       169
       169
       +
           }

     

       170
       170
       +
       

     

       153
       171
        
           .loading {

     

       154
       172
        
             text-align: center;

     

       155
       173
        
             padding: 4rem 2rem;

     
···

       214
       232
        
       	}

     

       215
       233
        
       

     

       216
       234
        
       	private async handleClassJoined() {

     

       235
       235
       +
       		this.showRegistrationModal = false;

     

       217
       236
        
       		await this.loadClasses();

     

       218
       237
        
       	}

     

       219
       238
        
       

     
···

       259
       278
        
       										? html`

     

       260
       279
        
                         <div class="register-card" @click=${this.handleRegisterClick}>

     

       261
       280
        
                           <div class="register-icon">+</div>

     

       262
       262
       -
                           <div class="register-text">Register for Class</div>

     

       281
       281
       +
                           <div class="register-text">Register for a Class</div>

     

       263
       282
        
                         </div>

     

       264
       283
        
                       `

     

       265
       284
        
       										: ""

     
···

       273
       292
        
                 <div class="empty-state">

     

       274
       293
        
                   <h2>No classes yet</h2>

     

       275
       294
        
                   <p>You haven't been enrolled in any classes.</p>

     

       276
       276
       -
                 </div>

     

       277
       277
       -
                 <div class="classes-grid">

     

       278
       278
       -
                   <div class="register-card" @click=${this.handleRegisterClick}>

     

       279
       279
       -
                     <div class="register-icon">+</div>

     

       280
       280
       -
                     <div class="register-text">Register for Class</div>

     

       281
       281
       -
                   </div>

     

       295
       295
       +
                   <button @click=${this.handleRegisterClick}>Register for a Class</button>

     

       282
       296
        
                 </div>

     

       283
       297
        
               `

     

       284
       298
        
       			}

+436

src/components/pending-recordings-view.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       

     

       4
       4
       +
       interface PendingRecording {

     

       5
       5
       +
       	id: string;

     

       6
       6
       +
       	user_id: number;

     

       7
       7
       +
       	filename: string;

     

       8
       8
       +
       	original_filename: string;

     

       9
       9
       +
       	vote_count: number;

     

       10
       10
       +
       	created_at: number;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       interface RecordingsData {

     

       14
       14
       +
       	recordings: PendingRecording[];

     

       15
       15
       +
       	total_users: number;

     

       16
       16
       +
       	user_vote: string | null;

     

       17
       17
       +
       	vote_threshold: number;

     

       18
       18
       +
       	winning_recording_id: string | null;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       @customElement("pending-recordings-view")

     

       22
       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       23
       +
       	@property({ type: String }) classId = "";

     

       24
       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       27
       +
       

     

       28
       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       29
       +
       	@state() private userVote: string | null = null;

     

       30
       30
       +
       	@state() private voteThreshold = 0;

     

       31
       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       32
       +
       	@state() private error: string | null = null;

     

       33
       33
       +
       	@state() private timeRemaining = "";

     

       34
       34
       +
       

     

       35
       35
       +
       	private refreshInterval?: number;

     

       36
       36
       +
       	private loadingInProgress = false;

     

       37
       37
       +
       

     

       38
       38
       +
       	static override styles = css`

     

       39
       39
       +
           :host {

     

       40
       40
       +
             display: block;

     

       41
       41
       +
             padding: 1rem;

     

       42
       42
       +
           }

     

       43
       43
       +
       

     

       44
       44
       +
           .container {

     

       45
       45
       +
             max-width: 56rem;

     

       46
       46
       +
             margin: 0 auto;

     

       47
       47
       +
           }

     

       48
       48
       +
       

     

       49
       49
       +
           h2 {

     

       50
       50
       +
             color: var(--text);

     

       51
       51
       +
             margin-bottom: 0.5rem;

     

       52
       52
       +
           }

     

       53
       53
       +
       

     

       54
       54
       +
           .info {

     

       55
       55
       +
             color: var(--paynes-gray);

     

       56
       56
       +
             font-size: 0.875rem;

     

       57
       57
       +
             margin-bottom: 1.5rem;

     

       58
       58
       +
           }

     

       59
       59
       +
       

     

       60
       60
       +
           .stats {

     

       61
       61
       +
             display: flex;

     

       62
       62
       +
             gap: 2rem;

     

       63
       63
       +
             margin-bottom: 1.5rem;

     

       64
       64
       +
             padding: 1rem;

     

       65
       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       66
       +
             border-radius: 8px;

     

       67
       67
       +
           }

     

       68
       68
       +
       

     

       69
       69
       +
           .stat {

     

       70
       70
       +
             display: flex;

     

       71
       71
       +
             flex-direction: column;

     

       72
       72
       +
             gap: 0.25rem;

     

       73
       73
       +
           }

     

       74
       74
       +
       

     

       75
       75
       +
           .stat-label {

     

       76
       76
       +
             font-size: 0.75rem;

     

       77
       77
       +
             color: var(--paynes-gray);

     

       78
       78
       +
             text-transform: uppercase;

     

       79
       79
       +
             letter-spacing: 0.05em;

     

       80
       80
       +
           }

     

       81
       81
       +
       

     

       82
       82
       +
           .stat-value {

     

       83
       83
       +
             font-size: 1.5rem;

     

       84
       84
       +
             font-weight: 600;

     

       85
       85
       +
             color: var(--text);

     

       86
       86
       +
           }

     

       87
       87
       +
       

     

       88
       88
       +
           .recordings-list {

     

       89
       89
       +
             display: flex;

     

       90
       90
       +
             flex-direction: column;

     

       91
       91
       +
             gap: 1rem;

     

       92
       92
       +
           }

     

       93
       93
       +
       

     

       94
       94
       +
           .recording-card {

     

       95
       95
       +
             border: 2px solid var(--secondary);

     

       96
       96
       +
             border-radius: 8px;

     

       97
       97
       +
             padding: 1rem;

     

       98
       98
       +
             transition: all 0.2s;

     

       99
       99
       +
           }

     

       100
       100
       +
       

     

       101
       101
       +
           .recording-card.voted {

     

       102
       102
       +
             border-color: var(--accent);

     

       103
       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       104
       +
           }

     

       105
       105
       +
       

     

       106
       106
       +
           .recording-card.winning {

     

       107
       107
       +
             border-color: var(--accent);

     

       108
       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       109
       +
           }

     

       110
       110
       +
       

     

       111
       111
       +
           .recording-header {

     

       112
       112
       +
             display: flex;

     

       113
       113
       +
             justify-content: space-between;

     

       114
       114
       +
             align-items: center;

     

       115
       115
       +
             margin-bottom: 0.75rem;

     

       116
       116
       +
           }

     

       117
       117
       +
       

     

       118
       118
       +
           .recording-info {

     

       119
       119
       +
             flex: 1;

     

       120
       120
       +
           }

     

       121
       121
       +
       

     

       122
       122
       +
           .recording-name {

     

       123
       123
       +
             font-weight: 600;

     

       124
       124
       +
             color: var(--text);

     

       125
       125
       +
             margin-bottom: 0.25rem;

     

       126
       126
       +
           }

     

       127
       127
       +
       

     

       128
       128
       +
           .recording-meta {

     

       129
       129
       +
             font-size: 0.75rem;

     

       130
       130
       +
             color: var(--paynes-gray);

     

       131
       131
       +
           }

     

       132
       132
       +
       

     

       133
       133
       +
           .vote-section {

     

       134
       134
       +
             display: flex;

     

       135
       135
       +
             align-items: center;

     

       136
       136
       +
             gap: 1rem;

     

       137
       137
       +
           }

     

       138
       138
       +
       

     

       139
       139
       +
           .vote-count {

     

       140
       140
       +
             font-size: 1.25rem;

     

       141
       141
       +
             font-weight: 600;

     

       142
       142
       +
             color: var(--accent);

     

       143
       143
       +
             min-width: 3rem;

     

       144
       144
       +
             text-align: center;

     

       145
       145
       +
           }

     

       146
       146
       +
       

     

       147
       147
       +
           .vote-button {

     

       148
       148
       +
             padding: 0.5rem 1rem;

     

       149
       149
       +
             border-radius: 6px;

     

       150
       150
       +
             font-size: 0.875rem;

     

       151
       151
       +
             font-weight: 500;

     

       152
       152
       +
             cursor: pointer;

     

       153
       153
       +
             transition: all 0.2s;

     

       154
       154
       +
             border: 2px solid var(--secondary);

     

       155
       155
       +
             background: var(--background);

     

       156
       156
       +
             color: var(--text);

     

       157
       157
       +
           }

     

       158
       158
       +
       

     

       159
       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       160
       +
             border-color: var(--accent);

     

       161
       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       162
       +
           }

     

       163
       163
       +
       

     

       164
       164
       +
           .vote-button.voted {

     

       165
       165
       +
             border-color: var(--accent);

     

       166
       166
       +
             background: var(--accent);

     

       167
       167
       +
             color: var(--white);

     

       168
       168
       +
           }

     

       169
       169
       +
       

     

       170
       170
       +
           .vote-button:disabled {

     

       171
       171
       +
             opacity: 0.5;

     

       172
       172
       +
             cursor: not-allowed;

     

       173
       173
       +
           }

     

       174
       174
       +
       

     

       175
       175
       +
           .delete-button {

     

       176
       176
       +
             padding: 0.5rem;

     

       177
       177
       +
             border: none;

     

       178
       178
       +
             background: transparent;

     

       179
       179
       +
             color: var(--paynes-gray);

     

       180
       180
       +
             cursor: pointer;

     

       181
       181
       +
             border-radius: 4px;

     

       182
       182
       +
             transition: all 0.2s;

     

       183
       183
       +
           }

     

       184
       184
       +
       

     

       185
       185
       +
           .delete-button:hover {

     

       186
       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       187
       +
             color: red;

     

       188
       188
       +
           }

     

       189
       189
       +
       

     

       190
       190
       +
           .winning-badge {

     

       191
       191
       +
             background: var(--accent);

     

       192
       192
       +
             color: var(--white);

     

       193
       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       194
       +
             border-radius: 12px;

     

       195
       195
       +
             font-size: 0.75rem;

     

       196
       196
       +
             font-weight: 600;

     

       197
       197
       +
           }

     

       198
       198
       +
       

     

       199
       199
       +
           .error {

     

       200
       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       201
       +
             border: 1px solid red;

     

       202
       202
       +
             color: red;

     

       203
       203
       +
             padding: 0.75rem;

     

       204
       204
       +
             border-radius: 4px;

     

       205
       205
       +
             margin-bottom: 1rem;

     

       206
       206
       +
             font-size: 0.875rem;

     

       207
       207
       +
           }

     

       208
       208
       +
       

     

       209
       209
       +
           .empty-state {

     

       210
       210
       +
             text-align: center;

     

       211
       211
       +
             padding: 3rem 1rem;

     

       212
       212
       +
             color: var(--paynes-gray);

     

       213
       213
       +
           }

     

       214
       214
       +
       

     

       215
       215
       +
           .audio-player {

     

       216
       216
       +
             margin-top: 0.75rem;

     

       217
       217
       +
           }

     

       218
       218
       +
       

     

       219
       219
       +
           audio {

     

       220
       220
       +
             width: 100%;

     

       221
       221
       +
             height: 2.5rem;

     

       222
       222
       +
           }

     

       223
       223
       +
         `;

     

       224
       224
       +
       

     

       225
       225
       +
       	override connectedCallback() {

     

       226
       226
       +
       		super.connectedCallback();

     

       227
       227
       +
       		this.loadRecordings();

     

       228
       228
       +
       		// Refresh every 10 seconds

     

       229
       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	override disconnectedCallback() {

     

       233
       233
       +
       		super.disconnectedCallback();

     

       234
       234
       +
       		if (this.refreshInterval) {

     

       235
       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       236
       +
       		}

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	private async loadRecordings() {

     

       240
       240
       +
       		if (this.loadingInProgress) return;

     

       241
       241
       +
       

     

       242
       242
       +
       		this.loadingInProgress = true;

     

       243
       243
       +
       

     

       244
       244
       +
       		try {

     

       245
       245
       +
       			// Build URL with optional section_id parameter

     

       246
       246
       +
       			const url = new URL(

     

       247
       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       248
       +
       				window.location.origin,

     

       249
       249
       +
       			);

     

       250
       250
       +
       			if (this.sectionId !== null) {

     

       251
       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       252
       +
       			}

     

       253
       253
       +
       

     

       254
       254
       +
       			const response = await fetch(url.toString());

     

       255
       255
       +
       

     

       256
       256
       +
       			if (!response.ok) {

     

       257
       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       258
       +
       			}

     

       259
       259
       +
       

     

       260
       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       261
       +
       			this.recordings = data.recordings;

     

       262
       262
       +
       			this.userVote = data.user_vote;

     

       263
       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       265
       +
       

     

       266
       266
       +
       			// Calculate time remaining for first recording

     

       267
       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       269
       +
       				const now = Date.now() / 1000;

     

       270
       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       272
       +
       

     

       273
       273
       +
       				if (remaining > 0) {

     

       274
       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       277
       +
       				} else {

     

       278
       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       279
       +
       				}

     

       280
       280
       +
       			}

     

       281
       281
       +
       

     

       282
       282
       +
       			this.error = null;

     

       283
       283
       +
       		} catch (error) {

     

       284
       284
       +
       			this.error =

     

       285
       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       286
       +
       		} finally {

     

       287
       287
       +
       			this.loadingInProgress = false;

     

       288
       288
       +
       		}

     

       289
       289
       +
       	}

     

       290
       290
       +
       

     

       291
       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       292
       +
       		try {

     

       293
       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       294
       +
       				method: "POST",

     

       295
       295
       +
       			});

     

       296
       296
       +
       

     

       297
       297
       +
       			if (!response.ok) {

     

       298
       298
       +
       				throw new Error("Failed to vote");

     

       299
       299
       +
       			}

     

       300
       300
       +
       

     

       301
       301
       +
       			const data = await response.json();

     

       302
       302
       +
       

     

       303
       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       304
       +
       			if (data.winning_recording_id) {

     

       305
       305
       +
       				window.location.reload();

     

       306
       306
       +
       			} else {

     

       307
       307
       +
       				// Just reload recordings to show updated votes

     

       308
       308
       +
       				await this.loadRecordings();

     

       309
       309
       +
       			}

     

       310
       310
       +
       		} catch (error) {

     

       311
       311
       +
       			this.error =

     

       312
       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       313
       +
       		}

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       318
       +
       			return;

     

       319
       319
       +
       		}

     

       320
       320
       +
       

     

       321
       321
       +
       		try {

     

       322
       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       323
       +
       				method: "DELETE",

     

       324
       324
       +
       			});

     

       325
       325
       +
       

     

       326
       326
       +
       			if (!response.ok) {

     

       327
       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       328
       +
       			}

     

       329
       329
       +
       

     

       330
       330
       +
       			await this.loadRecordings();

     

       331
       331
       +
       		} catch (error) {

     

       332
       332
       +
       			this.error =

     

       333
       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       334
       +
       		}

     

       335
       335
       +
       	}

     

       336
       336
       +
       

     

       337
       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       338
       +
       		const now = Date.now() / 1000;

     

       339
       339
       +
       		const diff = now - timestamp;

     

       340
       340
       +
       

     

       341
       341
       +
       		if (diff < 60) return "just now";

     

       342
       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       345
       +
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	override render() {

     

       348
       348
       +
       		return html`

     

       349
       349
       +
             <div class="container">

     

       350
       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       351
       +
               <p class="info">

     

       352
       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       353
       +
               </p>

     

       354
       354
       +
       

     

       355
       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       356
       +
       

     

       357
       357
       +
               ${

     

       358
       358
       +
       					this.recordings.length > 0

     

       359
       359
       +
       						? html`

     

       360
       360
       +
                   <div class="stats">

     

       361
       361
       +
                     <div class="stat">

     

       362
       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       364
       +
                     </div>

     

       365
       365
       +
                     <div class="stat">

     

       366
       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       368
       +
                     </div>

     

       369
       369
       +
                     <div class="stat">

     

       370
       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       372
       +
                     </div>

     

       373
       373
       +
                   </div>

     

       374
       374
       +
       

     

       375
       375
       +
                   <div class="recordings-list">

     

       376
       376
       +
                     ${this.recordings.map(

     

       377
       377
       +
       								(recording) => html`

     

       378
       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       379
       +
                         <div class="recording-header">

     

       380
       380
       +
                           <div class="recording-info">

     

       381
       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       382
       +
                             <div class="recording-meta">

     

       383
       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       384
       +
                             </div>

     

       385
       385
       +
                           </div>

     

       386
       386
       +
       

     

       387
       387
       +
                           <div class="vote-section">

     

       388
       388
       +
                             ${

     

       389
       389
       +
       												this.winningRecordingId === recording.id

     

       390
       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       391
       +
       													: ""

     

       392
       392
       +
       											}

     

       393
       393
       +
                             

     

       394
       394
       +
                             <div class="vote-count">

     

       395
       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       396
       +
                             </div>

     

       397
       397
       +
       

     

       398
       398
       +
                             <button

     

       399
       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       402
       +
                             >

     

       403
       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       404
       +
                             </button>

     

       405
       405
       +
       

     

       406
       406
       +
                             <button

     

       407
       407
       +
                               class="delete-button"

     

       408
       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       409
       +
                               title="Delete recording"

     

       410
       410
       +
                             >

     

       411
       411
       +
                               🗑️

     

       412
       412
       +
                             </button>

     

       413
       413
       +
                           </div>

     

       414
       414
       +
                         </div>

     

       415
       415
       +
       

     

       416
       416
       +
                         <div class="audio-player">

     

       417
       417
       +
                           <audio controls preload="none">

     

       418
       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       419
       +
                           </audio>

     

       420
       420
       +
                         </div>

     

       421
       421
       +
                       </div>

     

       422
       422
       +
                     `,

     

       423
       423
       +
       							)}

     

       424
       424
       +
                   </div>

     

       425
       425
       +
                 `

     

       426
       426
       +
       						: html`

     

       427
       427
       +
                   <div class="empty-state">

     

       428
       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       430
       +
                   </div>

     

       431
       431
       +
                 `

     

       432
       432
       +
       				}

     

       433
       433
       +
             </div>

     

       434
       434
       +
           `;

     

       435
       435
       +
       	}

     

       436
       436
       +
       }

+335

src/components/reset-password-form.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       import { hashPasswordClient } from "../lib/client-auth";

     

       4
       4
       +
       

     

       5
       5
       +
       @customElement("reset-password-form")

     

       6
       6
       +
       export class ResetPasswordForm extends LitElement {

     

       7
       7
       +
       	@property({ type: String }) token: string | null = null;

     

       8
       8
       +
       	@state() private email: string | null = null;

     

       9
       9
       +
       	@state() private password = "";

     

       10
       10
       +
       	@state() private confirmPassword = "";

     

       11
       11
       +
       	@state() private error = "";

     

       12
       12
       +
       	@state() private isSubmitting = false;

     

       13
       13
       +
       	@state() private isSuccess = false;

     

       14
       14
       +
       	@state() private isLoadingEmail = false;

     

       15
       15
       +
       

     

       16
       16
       +
       	static override styles = css`

     

       17
       17
       +
       		:host {

     

       18
       18
       +
       			display: block;

     

       19
       19
       +
       		}

     

       20
       20
       +
       

     

       21
       21
       +
       		.reset-card {

     

       22
       22
       +
       			background: var(--background);

     

       23
       23
       +
       			border: 2px solid var(--secondary);

     

       24
       24
       +
       			border-radius: 12px;

     

       25
       25
       +
       			padding: 2.5rem;

     

       26
       26
       +
       			max-width: 25rem;

     

       27
       27
       +
       			width: 100%;

     

       28
       28
       +
       			box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);

     

       29
       29
       +
       		}

     

       30
       30
       +
       

     

       31
       31
       +
       		.reset-title {

     

       32
       32
       +
       			margin-top: 0;

     

       33
       33
       +
       			margin-bottom: 2rem;

     

       34
       34
       +
       			color: var(--text);

     

       35
       35
       +
       			text-align: center;

     

       36
       36
       +
       			font-size: 1.75rem;

     

       37
       37
       +
       		}

     

       38
       38
       +
       

     

       39
       39
       +
       		.form-group {

     

       40
       40
       +
       			margin-bottom: 1.5rem;

     

       41
       41
       +
       		}

     

       42
       42
       +
       

     

       43
       43
       +
       		label {

     

       44
       44
       +
       			display: block;

     

       45
       45
       +
       			margin-bottom: 0.25rem;

     

       46
       46
       +
       			font-weight: 500;

     

       47
       47
       +
       			color: var(--text);

     

       48
       48
       +
       			font-size: 0.875rem;

     

       49
       49
       +
       		}

     

       50
       50
       +
       

     

       51
       51
       +
       		input {

     

       52
       52
       +
       			width: 100%;

     

       53
       53
       +
       			padding: 0.75rem;

     

       54
       54
       +
       			border: 2px solid var(--secondary);

     

       55
       55
       +
       			border-radius: 6px;

     

       56
       56
       +
       			font-size: 1rem;

     

       57
       57
       +
       			font-family: inherit;

     

       58
       58
       +
       			background: var(--background);

     

       59
       59
       +
       			color: var(--text);

     

       60
       60
       +
       			transition: all 0.2s;

     

       61
       61
       +
       			box-sizing: border-box;

     

       62
       62
       +
       		}

     

       63
       63
       +
       

     

       64
       64
       +
       		input::placeholder {

     

       65
       65
       +
       			color: var(--secondary);

     

       66
       66
       +
       			opacity: 1;

     

       67
       67
       +
       		}

     

       68
       68
       +
       

     

       69
       69
       +
       		input:focus {

     

       70
       70
       +
       			outline: none;

     

       71
       71
       +
       			border-color: var(--primary);

     

       72
       72
       +
       		}

     

       73
       73
       +
       

     

       74
       74
       +
       		.error-banner {

     

       75
       75
       +
       			background: #fecaca;

     

       76
       76
       +
       			border: 2px solid rgba(220, 38, 38, 0.8);

     

       77
       77
       +
       			border-radius: 6px;

     

       78
       78
       +
       			padding: 1rem;

     

       79
       79
       +
       			margin-bottom: 1rem;

     

       80
       80
       +
       			color: #dc2626;

     

       81
       81
       +
       			font-weight: 500;

     

       82
       82
       +
       		}

     

       83
       83
       +
       

     

       84
       84
       +
       		.btn-primary {

     

       85
       85
       +
       			width: 100%;

     

       86
       86
       +
       			padding: 0.75rem 1.5rem;

     

       87
       87
       +
       			border: 2px solid var(--primary);

     

       88
       88
       +
       			border-radius: 6px;

     

       89
       89
       +
       			font-size: 1rem;

     

       90
       90
       +
       			font-weight: 500;

     

       91
       91
       +
       			cursor: pointer;

     

       92
       92
       +
       			transition: all 0.2s;

     

       93
       93
       +
       			font-family: inherit;

     

       94
       94
       +
       			background: var(--primary);

     

       95
       95
       +
       			color: white;

     

       96
       96
       +
       			margin-top: 0.5rem;

     

       97
       97
       +
       		}

     

       98
       98
       +
       

     

       99
       99
       +
       		.btn-primary:hover:not(:disabled) {

     

       100
       100
       +
       			background: transparent;

     

       101
       101
       +
       			color: var(--primary);

     

       102
       102
       +
       		}

     

       103
       103
       +
       

     

       104
       104
       +
       		.btn-primary:disabled {

     

       105
       105
       +
       			opacity: 0.6;

     

       106
       106
       +
       			cursor: not-allowed;

     

       107
       107
       +
       		}

     

       108
       108
       +
       

     

       109
       109
       +
       		.back-link {

     

       110
       110
       +
       			display: block;

     

       111
       111
       +
       			text-align: center;

     

       112
       112
       +
       			margin-top: 1.5rem;

     

       113
       113
       +
       			color: var(--primary);

     

       114
       114
       +
       			text-decoration: none;

     

       115
       115
       +
       			font-weight: 500;

     

       116
       116
       +
       			font-size: 0.875rem;

     

       117
       117
       +
       			transition: all 0.2s;

     

       118
       118
       +
       		}

     

       119
       119
       +
       

     

       120
       120
       +
       		.back-link:hover {

     

       121
       121
       +
       			color: var(--accent);

     

       122
       122
       +
       		}

     

       123
       123
       +
       

     

       124
       124
       +
       		.success-message {

     

       125
       125
       +
       			text-align: center;

     

       126
       126
       +
       		}

     

       127
       127
       +
       

     

       128
       128
       +
       		.success-icon {

     

       129
       129
       +
       			font-size: 3rem;

     

       130
       130
       +
       			margin-bottom: 1rem;

     

       131
       131
       +
       		}

     

       132
       132
       +
       

     

       133
       133
       +
       		.success-text {

     

       134
       134
       +
       			color: var(--primary);

     

       135
       135
       +
       			font-size: 1.25rem;

     

       136
       136
       +
       			font-weight: 500;

     

       137
       137
       +
       			margin-bottom: 1.5rem;

     

       138
       138
       +
       		}

     

       139
       139
       +
       

     

       140
       140
       +
       		.success-link {

     

       141
       141
       +
       			display: inline-block;

     

       142
       142
       +
       			padding: 0.75rem 1.5rem;

     

       143
       143
       +
       			background: var(--accent);

     

       144
       144
       +
       			color: white;

     

       145
       145
       +
       			text-decoration: none;

     

       146
       146
       +
       			border-radius: 6px;

     

       147
       147
       +
       			font-weight: 500;

     

       148
       148
       +
       			transition: all 0.2s;

     

       149
       149
       +
       		}

     

       150
       150
       +
       

     

       151
       151
       +
       		.success-link:hover {

     

       152
       152
       +
       			background: var(--primary);

     

       153
       153
       +
       		}

     

       154
       154
       +
       	`;

     

       155
       155
       +
       

     

       156
       156
       +
       	override async updated(changedProperties: Map<string, unknown>) {

     

       157
       157
       +
       		super.updated(changedProperties);

     

       158
       158
       +
       

     

       159
       159
       +
       		// When token property changes and we don't have email yet, load it

     

       160
       160
       +
       		if (

     

       161
       161
       +
       			changedProperties.has("token") &&

     

       162
       162
       +
       			this.token &&

     

       163
       163
       +
       			!this.email &&

     

       164
       164
       +
       			!this.isLoadingEmail

     

       165
       165
       +
       		) {

     

       166
       166
       +
       			await this.loadEmail();

     

       167
       167
       +
       		}

     

       168
       168
       +
       	}

     

       169
       169
       +
       

     

       170
       170
       +
       	private async loadEmail() {

     

       171
       171
       +
       		this.isLoadingEmail = true;

     

       172
       172
       +
       		this.error = "";

     

       173
       173
       +
       

     

       174
       174
       +
       		try {

     

       175
       175
       +
       			const url = `/api/auth/reset-password?token=${encodeURIComponent(this.token || "")}`;

     

       176
       176
       +
       			const response = await fetch(url);

     

       177
       177
       +
       			const data = await response.json();

     

       178
       178
       +
       

     

       179
       179
       +
       			if (!response.ok) {

     

       180
       180
       +
       				throw new Error(data.error || "Invalid or expired reset token");

     

       181
       181
       +
       			}

     

       182
       182
       +
       

     

       183
       183
       +
       			this.email = data.email;

     

       184
       184
       +
       		} catch (err) {

     

       185
       185
       +
       			this.error =

     

       186
       186
       +
       				err instanceof Error ? err.message : "Failed to verify reset token";

     

       187
       187
       +
       		} finally {

     

       188
       188
       +
       			this.isLoadingEmail = false;

     

       189
       189
       +
       		}

     

       190
       190
       +
       	}

     

       191
       191
       +
       

     

       192
       192
       +
       	override render() {

     

       193
       193
       +
       		if (!this.token) {

     

       194
       194
       +
       			return html`

     

       195
       195
       +
       				<div class="reset-card">

     

       196
       196
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       197
       197
       +
       					<div class="error-banner">Invalid or missing reset token</div>

     

       198
       198
       +
       					<a href="/" class="back-link">Back to home</a>

     

       199
       199
       +
       				</div>

     

       200
       200
       +
       			`;

     

       201
       201
       +
       		}

     

       202
       202
       +
       

     

       203
       203
       +
       		if (this.isLoadingEmail) {

     

       204
       204
       +
       			return html`

     

       205
       205
       +
       				<div class="reset-card">

     

       206
       206
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       207
       207
       +
       					<p style="text-align: center; color: var(--text);">Verifying reset token...</p>

     

       208
       208
       +
       				</div>

     

       209
       209
       +
       			`;

     

       210
       210
       +
       		}

     

       211
       211
       +
       

     

       212
       212
       +
       		if (this.error && !this.email) {

     

       213
       213
       +
       			return html`

     

       214
       214
       +
       				<div class="reset-card">

     

       215
       215
       +
       					<h1 class="reset-title">Reset Password</h1>

     

       216
       216
       +
       					<div class="error-banner">${this.error}</div>

     

       217
       217
       +
       					<a href="/" class="back-link">Back to home</a>

     

       218
       218
       +
       				</div>

     

       219
       219
       +
       			`;

     

       220
       220
       +
       		}

     

       221
       221
       +
       

     

       222
       222
       +
       		if (this.isSuccess) {

     

       223
       223
       +
       			return html`

     

       224
       224
       +
       				<div class="reset-card">

     

       225
       225
       +
       					<div class="success-message">

     

       226
       226
       +
       						<div class="success-icon">✓</div>

     

       227
       227
       +
       						<div class="success-text">Password reset successfully!</div>

     

       228
       228
       +
       						<a href="/" class="success-link">Go to home</a>

     

       229
       229
       +
       					</div>

     

       230
       230
       +
       				</div>

     

       231
       231
       +
       			`;

     

       232
       232
       +
       		}

     

       233
       233
       +
       

     

       234
       234
       +
       		return html`

     

       235
       235
       +
       			<div class="reset-card">

     

       236
       236
       +
       				<h1 class="reset-title">Reset Password</h1>

     

       237
       237
       +
       				

     

       238
       238
       +
       				<form @submit=${this.handleSubmit}>

     

       239
       239
       +
       					${

     

       240
       240
       +
       						this.error

     

       241
       241
       +
       							? html`<div class="error-banner">${this.error}</div>`

     

       242
       242
       +
       							: ""

     

       243
       243
       +
       					}

     

       244
       244
       +
       					

     

       245
       245
       +
       					<div class="form-group">

     

       246
       246
       +
       						<label for="password">New Password</label>

     

       247
       247
       +
       						<input 

     

       248
       248
       +
       							type="password" 

     

       249
       249
       +
       							id="password" 

     

       250
       250
       +
       							.value=${this.password}

     

       251
       251
       +
       							@input=${(e: Event) => {

     

       252
       252
       +
       								this.password = (e.target as HTMLInputElement).value;

     

       253
       253
       +
       							}}

     

       254
       254
       +
       							required 

     

       255
       255
       +
       							minlength="8"

     

       256
       256
       +
       							placeholder="Enter new password (min 8 characters)"

     

       257
       257
       +
       						>

     

       258
       258
       +
       					</div>

     

       259
       259
       +
       					

     

       260
       260
       +
       					<div class="form-group">

     

       261
       261
       +
       						<label for="confirm-password">Confirm Password</label>

     

       262
       262
       +
       						<input 

     

       263
       263
       +
       							type="password" 

     

       264
       264
       +
       							id="confirm-password" 

     

       265
       265
       +
       							.value=${this.confirmPassword}

     

       266
       266
       +
       							@input=${(e: Event) => {

     

       267
       267
       +
       								this.confirmPassword = (e.target as HTMLInputElement).value;

     

       268
       268
       +
       							}}

     

       269
       269
       +
       							required 

     

       270
       270
       +
       							minlength="8"

     

       271
       271
       +
       							placeholder="Confirm new password"

     

       272
       272
       +
       						>

     

       273
       273
       +
       					</div>

     

       274
       274
       +
       					

     

       275
       275
       +
       					<button type="submit" class="btn-primary" ?disabled=${this.isSubmitting}>

     

       276
       276
       +
       						${this.isSubmitting ? "Resetting..." : "Reset Password"}

     

       277
       277
       +
       					</button>

     

       278
       278
       +
       				</form>

     

       279
       279
       +
       				

     

       280
       280
       +
       				<a href="/" class="back-link">Back to home</a>

     

       281
       281
       +
       			</div>

     

       282
       282
       +
       		`;

     

       283
       283
       +
       	}

     

       284
       284
       +
       

     

       285
       285
       +
       	private async handleSubmit(e: Event) {

     

       286
       286
       +
       		e.preventDefault();

     

       287
       287
       +
       		this.error = "";

     

       288
       288
       +
       

     

       289
       289
       +
       		// Validate passwords match

     

       290
       290
       +
       		if (this.password !== this.confirmPassword) {

     

       291
       291
       +
       			this.error = "Passwords do not match";

     

       292
       292
       +
       			return;

     

       293
       293
       +
       		}

     

       294
       294
       +
       

     

       295
       295
       +
       		// Validate password length

     

       296
       296
       +
       		if (this.password.length < 8) {

     

       297
       297
       +
       			this.error = "Password must be at least 8 characters";

     

       298
       298
       +
       			return;

     

       299
       299
       +
       		}

     

       300
       300
       +
       

     

       301
       301
       +
       		this.isSubmitting = true;

     

       302
       302
       +
       

     

       303
       303
       +
       		try {

     

       304
       304
       +
       			if (!this.email) {

     

       305
       305
       +
       				throw new Error("Email not loaded");

     

       306
       306
       +
       			}

     

       307
       307
       +
       

     

       308
       308
       +
       			// Hash password client-side with user's email

     

       309
       309
       +
       			const hashedPassword = await hashPasswordClient(

     

       310
       310
       +
       				this.password,

     

       311
       311
       +
       				this.email,

     

       312
       312
       +
       			);

     

       313
       313
       +
       

     

       314
       314
       +
       			const response = await fetch("/api/auth/reset-password", {

     

       315
       315
       +
       				method: "POST",

     

       316
       316
       +
       				headers: { "Content-Type": "application/json" },

     

       317
       317
       +
       				body: JSON.stringify({ token: this.token, password: hashedPassword }),

     

       318
       318
       +
       			});

     

       319
       319
       +
       

     

       320
       320
       +
       			const data = await response.json();

     

       321
       321
       +
       

     

       322
       322
       +
       			if (!response.ok) {

     

       323
       323
       +
       				throw new Error(data.error || "Failed to reset password");

     

       324
       324
       +
       			}

     

       325
       325
       +
       

     

       326
       326
       +
       			// Show success message

     

       327
       327
       +
       			this.isSuccess = true;

     

       328
       328
       +
       		} catch (err) {

     

       329
       329
       +
       			this.error =

     

       330
       330
       +
       				err instanceof Error ? err.message : "Failed to reset password";

     

       331
       331
       +
       		} finally {

     

       332
       332
       +
       			this.isSubmitting = false;

     

       333
       333
       +
       		}

     

       334
       334
       +
       	}

     

       335
       335
       +
       }

+10 -5

src/components/transcription.ts

···

       565
       565
        
       

     

       566
       566
        
       	async checkHealth() {

     

       567
       567
        
       		try {

     

       568
       568
       -
       			const response = await fetch("/api/transcriptions/health");

     

       568
       568
       +
       			const response = await fetch("/api/health");

     

       569
       569
        
       			if (response.ok) {

     

       570
       570
        
       				const data = await response.json();

     

       571
       571
       -
       				this.serviceAvailable = data.available;

     

       571
       571
       +
       				this.serviceAvailable = data.status === "healthy";

     

       572
       572
        
       			} else {

     

       573
       573
        
       				this.serviceAvailable = false;

     

       574
       574
        
       			}

     
···

       792
       792
        
       	}

     

       793
       793
        
       

     

       794
       794
        
       	override render() {

     

       795
       795
       -
       		const canUpload = this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       795
       795
       +
       		const canUpload =

     

       796
       796
       +
       			this.serviceAvailable && (this.hasSubscription || this.isAdmin);

     

       796
       797
        
       

     

       797
       798
        
       		return html`

     

       798
       798
       -
             ${!this.hasSubscription && !this.isAdmin ? html`

     

       799
       799
       +
             ${

     

       800
       800
       +
       				!this.hasSubscription && !this.isAdmin

     

       801
       801
       +
       					? html`

     

       799
       802
        
               <div style="background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--accent); border-radius: 8px; padding: 1.5rem; margin-bottom: 2rem; text-align: center;">

     

       800
       803
        
                 <h3 style="margin: 0 0 0.5rem 0; color: var(--text);">Subscribe to Upload Transcriptions</h3>

     

       801
       804
        
                 <p style="margin: 0 0 1rem 0; color: var(--text); opacity: 0.8;">You need an active subscription to upload and transcribe audio files.</p>

     

       802
       805
        
                 <a href="/settings?tab=billing" style="display: inline-block; padding: 0.75rem 1.5rem; background: var(--accent); color: white; text-decoration: none; border-radius: 8px; font-weight: 600; transition: opacity 0.2s;">Subscribe Now</a>

     

       803
       806
        
               </div>

     

       804
       804
       -
             ` : ''}

     

       807
       807
       +
             `

     

       808
       808
       +
       					: ""

     

       809
       809
       +
       			}

     

       805
       810
        
       

     

       806
       811
        
             <div class="upload-area ${this.dragOver ? "drag-over" : ""} ${!canUpload ? "disabled" : ""}"

     

       807
       812
        
                  @dragover=${canUpload ? this.handleDragOver : null}

+339 -43

src/components/user-settings.ts

···

       36
       36
        
       	canceled_at: number | null;

     

       37
       37
        
       }

     

       38
       38
        
       

     

       39
       39
       -
       type SettingsPage = "account" | "sessions" | "passkeys" | "billing" | "danger";

     

       39
       39
       +
       type SettingsPage =

     

       40
       40
       +
       	| "account"

     

       41
       41
       +
       	| "sessions"

     

       42
       42
       +
       	| "passkeys"

     

       43
       43
       +
       	| "billing"

     

       44
       44
       +
       	| "notifications"

     

       45
       45
       +
       	| "danger";

     

       40
       46
        
       

     

       41
       47
        
       @customElement("user-settings")

     

       42
       48
        
       export class UserSettings extends LitElement {

     
···

       59
       65
        
       	@state() newAvatar = "";

     

       60
       66
        
       	@state() passkeySupported = false;

     

       61
       67
        
       	@state() addingPasskey = false;

     

       68
       68
       +
       	@state() emailNotificationsEnabled = true;

     

       69
       69
       +
       	@state() deletingAccount = false;

     

       70
       70
       +
       	@state() emailChangeMessage = "";

     

       71
       71
       +
       	@state() pendingEmailChange = "";

     

       72
       72
       +
       	@state() updatingEmail = false;

     

       62
       73
        
       

     

       63
       74
        
       	static override styles = css`

     

       64
       75
        
       		:host {

     
···

       286
       297
        
       			line-height: 1.5;

     

       287
       298
        
       		}

     

       288
       299
        
       

     

       300
       300
       +
       		.success-message {

     

       301
       301
       +
       			padding: 1rem;

     

       302
       302
       +
       			background: rgba(76, 175, 80, 0.1);

     

       303
       303
       +
       			border: 1px solid rgba(76, 175, 80, 0.3);

     

       304
       304
       +
       			border-radius: 0.5rem;

     

       305
       305
       +
       			color: var(--text);

     

       306
       306
       +
       		}

     

       307
       307
       +
       

     

       308
       308
       +
       		.spinner {

     

       309
       309
       +
       			display: inline-block;

     

       310
       310
       +
       			width: 1rem;

     

       311
       311
       +
       			height: 1rem;

     

       312
       312
       +
       			border: 2px solid rgba(255, 255, 255, 0.3);

     

       313
       313
       +
       			border-top-color: white;

     

       314
       314
       +
       			border-radius: 50%;

     

       315
       315
       +
       			animation: spin 0.6s linear infinite;

     

       316
       316
       +
       		}

     

       317
       317
       +
       

     

       318
       318
       +
       		@keyframes spin {

     

       319
       319
       +
       			to {

     

       320
       320
       +
       				transform: rotate(360deg);

     

       321
       321
       +
       			}

     

       322
       322
       +
       		}

     

       323
       323
       +
       

     

       289
       324
        
       		.session-list {

     

       290
       325
        
       			display: flex;

     

       291
       326
        
       			flex-direction: column;

     
···

       418
       453
        
       			color: var(--accent);

     

       419
       454
        
       		}

     

       420
       455
        
       

     

       456
       456
       +
       		.error-banner {

     

       457
       457
       +
       			background: #fecaca;

     

       458
       458
       +
       			border: 2px solid rgba(220, 38, 38, 0.8);

     

       459
       459
       +
       			border-radius: 6px;

     

       460
       460
       +
       			padding: 1rem;

     

       461
       461
       +
       			margin-bottom: 1.5rem;

     

       462
       462
       +
       			color: #dc2626;

     

       463
       463
       +
       			font-weight: 500;

     

       464
       464
       +
       		}

     

       465
       465
       +
       

     

       421
       466
        
       		.loading {

     

       422
       467
        
       			text-align: center;

     

       423
       468
        
       			color: var(--text);

     

       424
       469
        
       			padding: 2rem;

     

       425
       470
        
       		}

     

       426
       471
        
       

     

       472
       472
       +
       		.setting-row {

     

       473
       473
       +
       			display: flex;

     

       474
       474
       +
       			align-items: center;

     

       475
       475
       +
       			justify-content: space-between;

     

       476
       476
       +
       			padding: 1rem;

     

       477
       477
       +
       			border: 1px solid var(--secondary);

     

       478
       478
       +
       			border-radius: 6px;

     

       479
       479
       +
       			gap: 1rem;

     

       480
       480
       +
       		}

     

       481
       481
       +
       

     

       482
       482
       +
       		.setting-info {

     

       483
       483
       +
       			flex: 1;

     

       484
       484
       +
       		}

     

       485
       485
       +
       

     

       486
       486
       +
       		.toggle {

     

       487
       487
       +
       			position: relative;

     

       488
       488
       +
       			display: inline-block;

     

       489
       489
       +
       			width: 48px;

     

       490
       490
       +
       			height: 24px;

     

       491
       491
       +
       		}

     

       492
       492
       +
       

     

       493
       493
       +
       		.toggle input {

     

       494
       494
       +
       			opacity: 0;

     

       495
       495
       +
       			width: 0;

     

       496
       496
       +
       			height: 0;

     

       497
       497
       +
       		}

     

       498
       498
       +
       

     

       499
       499
       +
       		.toggle-slider {

     

       500
       500
       +
       			position: absolute;

     

       501
       501
       +
       			cursor: pointer;

     

       502
       502
       +
       			top: 0;

     

       503
       503
       +
       			left: 0;

     

       504
       504
       +
       			right: 0;

     

       505
       505
       +
       			bottom: 0;

     

       506
       506
       +
       			background-color: var(--secondary);

     

       507
       507
       +
       			transition: 0.2s;

     

       508
       508
       +
       			border-radius: 24px;

     

       509
       509
       +
       		}

     

       510
       510
       +
       

     

       511
       511
       +
       		.toggle-slider:before {

     

       512
       512
       +
       			position: absolute;

     

       513
       513
       +
       			content: "";

     

       514
       514
       +
       			height: 18px;

     

       515
       515
       +
       			width: 18px;

     

       516
       516
       +
       			left: 3px;

     

       517
       517
       +
       			bottom: 3px;

     

       518
       518
       +
       			background-color: white;

     

       519
       519
       +
       			transition: 0.2s;

     

       520
       520
       +
       			border-radius: 50%;

     

       521
       521
       +
       		}

     

       522
       522
       +
       

     

       523
       523
       +
       		.toggle input:checked + .toggle-slider {

     

       524
       524
       +
       			background-color: var(--primary);

     

       525
       525
       +
       		}

     

       526
       526
       +
       

     

       527
       527
       +
       		.toggle input:checked + .toggle-slider:before {

     

       528
       528
       +
       			transform: translateX(24px);

     

       529
       529
       +
       		}

     

       530
       530
       +
       

     

       427
       531
        
       		@media (max-width: 768px) {

     

       428
       532
        
       			.settings-container {

     

       429
       533
        
       				padding: 1rem;

     
···

       446
       550
        
       	override async connectedCallback() {

     

       447
       551
        
       		super.connectedCallback();

     

       448
       552
        
       		this.passkeySupported = isPasskeySupported();

     

       449
       449
       -
       		

     

       553
       553
       +
       

     

       450
       554
        
       		// Check for tab query parameter

     

       451
       555
        
       		const params = new URLSearchParams(window.location.search);

     

       452
       556
        
       		const tab = params.get("tab");

     

       453
       557
        
       		if (tab && this.isValidTab(tab)) {

     

       454
       558
        
       			this.currentPage = tab as SettingsPage;

     

       455
       559
        
       		}

     

       456
       456
       -
       		

     

       560
       560
       +
       

     

       457
       561
        
       		await this.loadUser();

     

       458
       562
        
       		await this.loadSessions();

     

       459
       563
        
       		await this.loadSubscription();

     
···

       463
       567
        
       	}

     

       464
       568
        
       

     

       465
       569
        
       	private isValidTab(tab: string): boolean {

     

       466
       466
       -
       		return ["account", "sessions", "passkeys", "billing", "danger"].includes(tab);

     

       570
       570
       +
       		return [

     

       571
       571
       +
       			"account",

     

       572
       572
       +
       			"sessions",

     

       573
       573
       +
       			"passkeys",

     

       574
       574
       +
       			"billing",

     

       575
       575
       +
       			"notifications",

     

       576
       576
       +
       			"danger",

     

       577
       577
       +
       		].includes(tab);

     

       467
       578
        
       	}

     

       468
       579
        
       

     

       469
       580
        
       	private setTab(tab: SettingsPage) {

     

       470
       581
        
       		this.currentPage = tab;

     

       582
       582
       +
       		this.error = ""; // Clear errors when switching tabs

     

       471
       583
        
       		// Update URL without reloading page

     

       472
       584
        
       		const url = new URL(window.location.href);

     

       473
       585
        
       		url.searchParams.set("tab", tab);

     
···

       483
       595
        
       				return;

     

       484
       596
        
       			}

     

       485
       597
        
       

     

       486
       486
       -
       			this.user = await response.json();

     

       598
       598
       +
       			const data = await response.json();

     

       599
       599
       +
       			this.user = data;

     

       600
       600
       +
       			this.emailNotificationsEnabled = data.email_notifications_enabled ?? true;

     

       487
       601
        
       		} finally {

     

       488
       602
        
       			this.loading = false;

     

       489
       603
        
       		}

     
···

       558
       672
        
       			return;

     

       559
       673
        
       		}

     

       560
       674
        
       

     

       675
       675
       +
       		this.error = "";

     

       561
       676
        
       		try {

     

       562
       677
        
       			const response = await fetch(`/api/passkeys/${passkeyId}`, {

     

       563
       678
        
       				method: "DELETE",

     

       564
       679
        
       			});

     

       565
       680
        
       

     

       566
       681
        
       			if (!response.ok) {

     

       567
       567
       -
       				const error = await response.json();

     

       568
       568
       -
       				this.error = error.error || "Failed to delete passkey";

     

       682
       682
       +
       				const data = await response.json();

     

       683
       683
       +
       				this.error = data.error || "Failed to delete passkey";

     

       569
       684
        
       				return;

     

       570
       685
        
       			}

     

       571
       686
        
       

     

       572
       687
        
       			// Reload passkeys

     

       573
       688
        
       			await this.loadPasskeys();

     

       574
       574
       -
       		} catch {

     

       575
       575
       -
       			this.error = "Failed to delete passkey";

     

       689
       689
       +
       		} catch (err) {

     

       690
       690
       +
       			this.error =

     

       691
       691
       +
       				err instanceof Error ? err.message : "Failed to delete passkey";

     

       576
       692
        
       		}

     

       577
       693
        
       	}

     

       578
       694
        
       

     

       579
       695
        
       	async handleLogout() {

     

       696
       696
       +
       		this.error = "";

     

       580
       697
        
       		try {

     

       581
       581
       -
       			await fetch("/api/auth/logout", { method: "POST" });

     

       698
       698
       +
       			const response = await fetch("/api/auth/logout", { method: "POST" });

     

       699
       699
       +
       

     

       700
       700
       +
       			if (!response.ok) {

     

       701
       701
       +
       				const data = await response.json();

     

       702
       702
       +
       				this.error = data.error || "Failed to logout";

     

       703
       703
       +
       				return;

     

       704
       704
       +
       			}

     

       705
       705
       +
       

     

       582
       706
        
       			window.location.href = "/";

     

       583
       583
       -
       		} catch {

     

       584
       584
       -
       			this.error = "Failed to logout";

     

       707
       707
       +
       		} catch (err) {

     

       708
       708
       +
       			this.error = err instanceof Error ? err.message : "Failed to logout";

     

       585
       709
        
       		}

     

       586
       710
        
       	}

     

       587
       711
        
       

     

       588
       712
        
       	async handleDeleteAccount() {

     

       713
       713
       +
       		this.deletingAccount = true;

     

       714
       714
       +
       		this.error = "";

     

       715
       715
       +
       		document.body.style.cursor = "wait";

     

       716
       716
       +
       

     

       589
       717
        
       		try {

     

       590
       718
        
       			const response = await fetch("/api/user", {

     

       591
       719
        
       				method: "DELETE",

     

       592
       720
        
       			});

     

       593
       721
        
       

     

       594
       722
        
       			if (!response.ok) {

     

       595
       595
       -
       				this.error = "Failed to delete account";

     

       723
       723
       +
       				const data = await response.json();

     

       724
       724
       +
       				this.error = data.error || "Failed to delete account";

     

       596
       725
        
       				return;

     

       597
       726
        
       			}

     

       598
       727
        
       

     
···

       600
       729
        
       		} catch {

     

       601
       730
        
       			this.error = "Failed to delete account";

     

       602
       731
        
       		} finally {

     

       732
       732
       +
       			this.deletingAccount = false;

     

       603
       733
        
       			this.showDeleteConfirm = false;

     

       734
       734
       +
       			document.body.style.cursor = "";

     

       604
       735
        
       		}

     

       605
       736
        
       	}

     

       606
       737
        
       

     

       607
       738
        
       	async handleUpdateEmail() {

     

       739
       739
       +
       		this.error = "";

     

       740
       740
       +
       		this.emailChangeMessage = "";

     

       608
       741
        
       		if (!this.newEmail) {

     

       609
       742
        
       			this.error = "Email required";

     

       610
       743
        
       			return;

     

       611
       744
        
       		}

     

       612
       745
        
       

     

       746
       746
       +
       		this.updatingEmail = true;

     

       613
       747
        
       		try {

     

       614
       748
        
       			const response = await fetch("/api/user/email", {

     

       615
       749
        
       				method: "PUT",

     

       616
       750
        
       				headers: { "Content-Type": "application/json" },

     

       617
       751
        
       				body: JSON.stringify({ email: this.newEmail }),

     

       618
       752
        
       			});

     

       753
       753
       +
       

     

       754
       754
       +
       			const data = await response.json();

     

       619
       755
        
       

     

       620
       756
        
       			if (!response.ok) {

     

       621
       621
       -
       				const data = await response.json();

     

       622
       757
        
       				this.error = data.error || "Failed to update email";

     

       623
       758
        
       				return;

     

       624
       759
        
       			}

     

       625
       760
        
       

     

       626
       626
       -
       			// Reload user data

     

       627
       627
       -
       			await this.loadUser();

     

       761
       761
       +
       			// Show success message with pending email

     

       762
       762
       +
       			this.emailChangeMessage = data.message || "Verification email sent";

     

       763
       763
       +
       			this.pendingEmailChange = data.pendingEmail || this.newEmail;

     

       628
       764
        
       			this.editingEmail = false;

     

       629
       765
        
       			this.newEmail = "";

     

       630
       766
        
       		} catch {

     

       631
       767
        
       			this.error = "Failed to update email";

     

       768
       768
       +
       		} finally {

     

       769
       769
       +
       			this.updatingEmail = false;

     

       632
       770
        
       		}

     

       633
       771
        
       	}

     

       634
       772
        
       

     

       635
       773
        
       	async handleUpdatePassword() {

     

       774
       774
       +
       		this.error = "";

     

       636
       775
        
       		if (!this.newPassword) {

     

       637
       776
        
       			this.error = "Password required";

     

       638
       777
        
       			return;

     
···

       670
       809
        
       	}

     

       671
       810
        
       

     

       672
       811
        
       	async handleUpdateName() {

     

       812
       812
       +
       		this.error = "";

     

       673
       813
        
       		if (!this.newName) {

     

       674
       814
        
       			this.error = "Name required";

     

       675
       815
        
       			return;

     
···

       697
       837
        
       	}

     

       698
       838
        
       

     

       699
       839
        
       	async handleUpdateAvatar() {

     

       840
       840
       +
       		this.error = "";

     

       700
       841
        
       		if (!this.newAvatar) {

     

       701
       842
        
       			this.error = "Avatar required";

     

       702
       843
        
       			return;

     
···

       844
       985
        
       	}

     

       845
       986
        
       

     

       846
       987
        
       	async handleKillSession(sessionId: string) {

     

       988
       988
       +
       		this.error = "";

     

       847
       989
        
       		try {

     

       848
       990
        
       			const response = await fetch(`/api/sessions`, {

     

       849
       991
        
       				method: "DELETE",

     
···

       895
       1037
        
       

     

       896
       1038
        
       		return html`

     

       897
       1039
        
       			<div class="content-inner">

     

       1040
       1040
       +
       			${

     

       1041
       1041
       +
       				this.error

     

       1042
       1042
       +
       					? html`

     

       1043
       1043
       +
       				<div class="error-banner">

     

       1044
       1044
       +
       					${this.error}

     

       1045
       1045
       +
       				</div>

     

       1046
       1046
       +
       			`

     

       1047
       1047
       +
       					: ""

     

       1048
       1048
       +
       			}

     

       898
       1049
        
       			<div class="section">

     

       899
       1050
        
       				<h2 class="section-title">Profile Information</h2>

     

       900
       1051
        
       

     
···

       932
       1083
        
       				<div class="field-group">

     

       933
       1084
        
       					<label class="field-label">Email</label>

     

       934
       1085
        
       					${

     

       935
       935
       -
       						this.editingEmail

     

       1086
       1086
       +
       						this.emailChangeMessage

     

       936
       1087
        
       							? html`

     

       1088
       1088
       +
       							<div class="success-message" style="margin-bottom: 1rem;">

     

       1089
       1089
       +
       								${this.emailChangeMessage}

     

       1090
       1090
       +
       								${this.pendingEmailChange ? html`<br><strong>New email:</strong> ${this.pendingEmailChange}` : ""}

     

       1091
       1091
       +
       							</div>

     

       1092
       1092
       +
       							<div class="field-row">

     

       1093
       1093
       +
       								<div class="field-value">${this.user.email}</div>

     

       1094
       1094
       +
       							</div>

     

       1095
       1095
       +
       						  `

     

       1096
       1096
       +
       							: this.editingEmail

     

       1097
       1097
       +
       								? html`

     

       937
       1098
        
       							<div style="display: flex; gap: 0.5rem; align-items: center;">

     

       938
       1099
        
       								<input

     

       939
       1100
        
       									type="email"

     
···

       947
       1108
        
       								<button

     

       948
       1109
        
       									class="btn btn-affirmative btn-small"

     

       949
       1110
        
       									@click=${this.handleUpdateEmail}

     

       1111
       1111
       +
       									?disabled=${this.updatingEmail}

     

       950
       1112
        
       								>

     

       951
       951
       -
       									Save

     

       1113
       1113
       +
       									${this.updatingEmail ? html`<span class="spinner"></span>` : "Save"}

     

       952
       1114
        
       								</button>

     

       953
       1115
        
       								<button

     

       954
       1116
        
       									class="btn btn-neutral btn-small"

     
···

       961
       1123
        
       								</button>

     

       962
       1124
        
       							</div>

     

       963
       1125
        
       						  `

     

       964
       964
       -
       							: html`

     

       1126
       1126
       +
       								: html`

     

       965
       1127
        
       							<div class="field-row">

     

       966
       1128
        
       								<div class="field-value">${this.user.email}</div>

     

       967
       1129
        
       								<button

     
···

       969
       1131
        
       									@click=${() => {

     

       970
       1132
        
       										this.editingEmail = true;

     

       971
       1133
        
       										this.newEmail = this.user?.email ?? "";

     

       1134
       1134
       +
       										this.emailChangeMessage = "";

     

       972
       1135
        
       									}}

     

       973
       1136
        
       								>

     

       974
       1137
        
       									Change

     
···

       1103
       1266
        
       	renderSessionsPage() {

     

       1104
       1267
        
       		return html`

     

       1105
       1268
        
       			<div class="content-inner">

     

       1269
       1269
       +
       			${

     

       1270
       1270
       +
       				this.error

     

       1271
       1271
       +
       					? html`

     

       1272
       1272
       +
       				<div class="error-banner">

     

       1273
       1273
       +
       					${this.error}

     

       1274
       1274
       +
       				</div>

     

       1275
       1275
       +
       			`

     

       1276
       1276
       +
       					: ""

     

       1277
       1277
       +
       			}

     

       1106
       1278
        
       			<div class="section">

     

       1107
       1279
        
       				<h2 class="section-title">Active Sessions</h2>

     

       1108
       1280
        
       				${

     
···

       1180
       1352
        
       			`;

     

       1181
       1353
        
       		}

     

       1182
       1354
        
       

     

       1183
       1183
       -
       		const hasActiveSubscription = this.subscription && (

     

       1184
       1184
       -
       			this.subscription.status === "active" || 

     

       1185
       1185
       -
       			this.subscription.status === "trialing"

     

       1186
       1186
       -
       		);

     

       1355
       1355
       +
       		const hasActiveSubscription =

     

       1356
       1356
       +
       			this.subscription &&

     

       1357
       1357
       +
       			(this.subscription.status === "active" ||

     

       1358
       1358
       +
       				this.subscription.status === "trialing");

     

       1187
       1359
        
       

     

       1188
       1360
        
       		if (this.subscription && !hasActiveSubscription) {

     

       1189
       1361
        
       			// Has a subscription but it's not active (canceled, expired, etc.)

     

       1190
       1190
       -
       			const statusColor = 

     

       1191
       1191
       -
       				this.subscription.status === "canceled" ? "var(--accent)" :

     

       1192
       1192
       -
       				"var(--secondary)";

     

       1362
       1362
       +
       			const statusColor =

     

       1363
       1363
       +
       				this.subscription.status === "canceled"

     

       1364
       1364
       +
       					? "var(--accent)"

     

       1365
       1365
       +
       					: "var(--secondary)";

     

       1193
       1366
        
       

     

       1194
       1367
        
       			return html`

     

       1195
       1368
        
       				<div class="content-inner">

     

       1369
       1369
       +
       					${

     

       1370
       1370
       +
       						this.error

     

       1371
       1371
       +
       							? html`

     

       1372
       1372
       +
       						<div class="error-banner">

     

       1373
       1373
       +
       							${this.error}

     

       1374
       1374
       +
       						</div>

     

       1375
       1375
       +
       					`

     

       1376
       1376
       +
       							: ""

     

       1377
       1377
       +
       					}

     

       1196
       1378
        
       					<div class="section">

     

       1197
       1379
        
       						<h2 class="section-title">Subscription</h2>

     

       1198
       1380
        
       						

     
···

       1214
       1396
        
       							</div>

     

       1215
       1397
        
       						</div>

     

       1216
       1398
        
       

     

       1217
       1217
       -
       						${this.subscription.canceled_at ? html`

     

       1399
       1399
       +
       						${

     

       1400
       1400
       +
       							this.subscription.canceled_at

     

       1401
       1401
       +
       								? html`

     

       1218
       1402
        
       							<div class="field-group">

     

       1219
       1403
        
       								<label class="field-label">Canceled At</label>

     

       1220
       1404
        
       								<div class="field-value" style="color: var(--accent);">

     

       1221
       1405
        
       									${this.formatDate(this.subscription.canceled_at)}

     

       1222
       1406
        
       								</div>

     

       1223
       1407
        
       							</div>

     

       1224
       1224
       -
       						` : ""}

     

       1408
       1408
       +
       						`

     

       1409
       1409
       +
       								: ""

     

       1410
       1410
       +
       						}

     

       1225
       1411
        
       

     

       1226
       1412
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1227
       1413
        
       							<button

     
···

       1235
       1421
        
       								Reactivate your subscription to unlock unlimited transcriptions.

     

       1236
       1422
        
       							</p>

     

       1237
       1423
        
       						</div>

     

       1238
       1238
       -
       

     

       1239
       1239
       -
       						${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1240
       1424
        
       					</div>

     

       1241
       1425
        
       				</div>

     

       1242
       1426
        
       			`;

     
···

       1245
       1429
        
       		if (hasActiveSubscription) {

     

       1246
       1430
        
       			return html`

     

       1247
       1431
        
       				<div class="content-inner">

     

       1432
       1432
       +
       					${

     

       1433
       1433
       +
       						this.error

     

       1434
       1434
       +
       							? html`

     

       1435
       1435
       +
       						<div class="error-banner">

     

       1436
       1436
       +
       							${this.error}

     

       1437
       1437
       +
       						</div>

     

       1438
       1438
       +
       					`

     

       1439
       1439
       +
       							: ""

     

       1440
       1440
       +
       					}

     

       1248
       1441
        
       					<div class="section">

     

       1249
       1442
        
       						<h2 class="section-title">Subscription</h2>

     

       1250
       1443
        
       						

     
···

       1263
       1456
        
       								">

     

       1264
       1457
        
       									${this.subscription.status}

     

       1265
       1458
        
       								</span>

     

       1266
       1266
       -
       								${this.subscription.cancel_at_period_end ? html`

     

       1459
       1459
       +
       								${

     

       1460
       1460
       +
       									this.subscription.cancel_at_period_end

     

       1461
       1461
       +
       										? html`

     

       1267
       1462
        
       									<span style="color: var(--accent); font-size: 0.875rem;">

     

       1268
       1463
        
       										(Cancels at end of period)

     

       1269
       1464
        
       									</span>

     

       1270
       1270
       -
       								` : ""}

     

       1465
       1465
       +
       								`

     

       1466
       1466
       +
       										: ""

     

       1467
       1467
       +
       								}

     

       1271
       1468
        
       							</div>

     

       1272
       1469
        
       						</div>

     

       1273
       1470
        
       

     

       1274
       1274
       -
       						${this.subscription.current_period_start && this.subscription.current_period_end ? html`

     

       1471
       1471
       +
       						${

     

       1472
       1472
       +
       							this.subscription.current_period_start &&

     

       1473
       1473
       +
       							this.subscription.current_period_end

     

       1474
       1474
       +
       								? html`

     

       1275
       1475
        
       							<div class="field-group">

     

       1276
       1476
        
       								<label class="field-label">Current Period</label>

     

       1277
       1477
        
       								<div class="field-value">

     
···

       1279
       1479
        
       									${this.formatDate(this.subscription.current_period_end)}

     

       1280
       1480
        
       								</div>

     

       1281
       1481
        
       							</div>

     

       1282
       1282
       -
       						` : ""}

     

       1482
       1482
       +
       						`

     

       1483
       1483
       +
       								: ""

     

       1484
       1484
       +
       						}

     

       1283
       1485
        
       

     

       1284
       1486
        
       						<div class="field-group" style="margin-top: 2rem;">

     

       1285
       1487
        
       							<button

     
···

       1293
       1495
        
       								Opens the customer portal where you can update payment methods, view invoices, and manage your subscription.

     

       1294
       1496
        
       							</p>

     

       1295
       1497
        
       						</div>

     

       1296
       1296
       -
       

     

       1297
       1297
       -
       						${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1298
       1498
        
       					</div>

     

       1299
       1499
        
       				</div>

     

       1300
       1500
        
       			`;

     
···

       1302
       1502
        
       

     

       1303
       1503
        
       		return html`

     

       1304
       1504
        
       			<div class="content-inner">

     

       1505
       1505
       +
       				${

     

       1506
       1506
       +
       					this.error

     

       1507
       1507
       +
       						? html`

     

       1508
       1508
       +
       					<div class="error-banner">

     

       1509
       1509
       +
       						${this.error}

     

       1510
       1510
       +
       					</div>

     

       1511
       1511
       +
       				`

     

       1512
       1512
       +
       						: ""

     

       1513
       1513
       +
       				}

     

       1305
       1514
        
       				<div class="section">

     

       1306
       1515
        
       					<h2 class="section-title">Billing & Subscription</h2>

     

       1307
       1516
        
       					<p class="field-description" style="margin-bottom: 1.5rem;">

     
···

       1314
       1523
        
       					>

     

       1315
       1524
        
       						${this.loading ? "Loading..." : "Activate Your Subscription"}

     

       1316
       1525
        
       					</button>

     

       1317
       1317
       -
       					${this.error ? html`<p class="error" style="margin-top: 1rem;">${this.error}</p>` : ""}

     

       1318
       1526
        
       				</div>

     

       1319
       1527
        
       			</div>

     

       1320
       1528
        
       		`;

     
···

       1323
       1531
        
       	renderDangerPage() {

     

       1324
       1532
        
       		return html`

     

       1325
       1533
        
       			<div class="content-inner">

     

       1534
       1534
       +
       			${

     

       1535
       1535
       +
       				this.error

     

       1536
       1536
       +
       					? html`

     

       1537
       1537
       +
       				<div class="error-banner">

     

       1538
       1538
       +
       					${this.error}

     

       1539
       1539
       +
       				</div>

     

       1540
       1540
       +
       			`

     

       1541
       1541
       +
       					: ""

     

       1542
       1542
       +
       			}

     

       1326
       1543
        
       			<div class="section danger-section">

     

       1327
       1544
        
       				<h2 class="section-title">Delete Account</h2>

     

       1328
       1545
        
       				<p class="danger-text">

     
···

       1342
       1559
        
       		`;

     

       1343
       1560
        
       	}

     

       1344
       1561
        
       

     

       1562
       1562
       +
       	renderNotificationsPage() {

     

       1563
       1563
       +
       		return html`

     

       1564
       1564
       +
       			<div class="content-inner">

     

       1565
       1565
       +
       				${

     

       1566
       1566
       +
       					this.error

     

       1567
       1567
       +
       						? html`

     

       1568
       1568
       +
       					<div class="error-banner">

     

       1569
       1569
       +
       						${this.error}

     

       1570
       1570
       +
       					</div>

     

       1571
       1571
       +
       				`

     

       1572
       1572
       +
       						: ""

     

       1573
       1573
       +
       				}

     

       1574
       1574
       +
       				<div class="section">

     

       1575
       1575
       +
       					<h2 class="section-title">Email Notifications</h2>

     

       1576
       1576
       +
       					<p style="color: var(--text); margin-bottom: 1rem;">

     

       1577
       1577
       +
       						Control which emails you receive from Thistle.

     

       1578
       1578
       +
       					</p>

     

       1579
       1579
       +
       					

     

       1580
       1580
       +
       					<div class="setting-row">

     

       1581
       1581
       +
       						<div class="setting-info">

     

       1582
       1582
       +
       							<strong>Transcription Complete</strong>

     

       1583
       1583
       +
       							<p style="color: var(--paynes-gray); font-size: 0.875rem; margin: 0.25rem 0 0 0;">

     

       1584
       1584
       +
       								Get notified when your transcription is ready

     

       1585
       1585
       +
       							</p>

     

       1586
       1586
       +
       						</div>

     

       1587
       1587
       +
       						<label class="toggle">

     

       1588
       1588
       +
       							<input

     

       1589
       1589
       +
       								type="checkbox"

     

       1590
       1590
       +
       								.checked=${this.emailNotificationsEnabled}

     

       1591
       1591
       +
       								@change=${async (e: Event) => {

     

       1592
       1592
       +
       									const target = e.target as HTMLInputElement;

     

       1593
       1593
       +
       									this.emailNotificationsEnabled = target.checked;

     

       1594
       1594
       +
       									this.error = "";

     

       1595
       1595
       +
       

     

       1596
       1596
       +
       									try {

     

       1597
       1597
       +
       										const response = await fetch("/api/user/notifications", {

     

       1598
       1598
       +
       											method: "PUT",

     

       1599
       1599
       +
       											headers: { "Content-Type": "application/json" },

     

       1600
       1600
       +
       											body: JSON.stringify({

     

       1601
       1601
       +
       												email_notifications_enabled:

     

       1602
       1602
       +
       													this.emailNotificationsEnabled,

     

       1603
       1603
       +
       											}),

     

       1604
       1604
       +
       										});

     

       1605
       1605
       +
       

     

       1606
       1606
       +
       										if (!response.ok) {

     

       1607
       1607
       +
       											const data = await response.json();

     

       1608
       1608
       +
       											throw new Error(

     

       1609
       1609
       +
       												data.error || "Failed to update notification settings",

     

       1610
       1610
       +
       											);

     

       1611
       1611
       +
       										}

     

       1612
       1612
       +
       									} catch (err) {

     

       1613
       1613
       +
       										// Revert on error

     

       1614
       1614
       +
       										this.emailNotificationsEnabled = !target.checked;

     

       1615
       1615
       +
       										target.checked = !target.checked;

     

       1616
       1616
       +
       										this.error =

     

       1617
       1617
       +
       											err instanceof Error

     

       1618
       1618
       +
       												? err.message

     

       1619
       1619
       +
       												: "Failed to update notification settings";

     

       1620
       1620
       +
       									}

     

       1621
       1621
       +
       								}}

     

       1622
       1622
       +
       							/>

     

       1623
       1623
       +
       							<span class="toggle-slider"></span>

     

       1624
       1624
       +
       						</label>

     

       1625
       1625
       +
       					</div>

     

       1626
       1626
       +
       				</div>

     

       1627
       1627
       +
       			</div>

     

       1628
       1628
       +
       		`;

     

       1629
       1629
       +
       	}

     

       1630
       1630
       +
       

     

       1345
       1631
        
       	override render() {

     

       1346
       1632
        
       		if (this.loading) {

     

       1347
       1633
        
       			return html`<div class="loading">Loading...</div>`;

     

       1348
       1348
       -
       		}

     

       1349
       1349
       -
       

     

       1350
       1350
       -
       		if (this.error) {

     

       1351
       1351
       -
       			return html`<div class="error">${this.error}</div>`;

     

       1352
       1634
        
       		}

     

       1353
       1635
        
       

     

       1354
       1636
        
       		if (!this.user) {

     
···

       1385
       1667
        
       						Billing

     

       1386
       1668
        
       					</button>

     

       1387
       1669
        
       					<button

     

       1670
       1670
       +
       						class="tab ${this.currentPage === "notifications" ? "active" : ""}"

     

       1671
       1671
       +
       						@click=${() => {

     

       1672
       1672
       +
       							this.setTab("notifications");

     

       1673
       1673
       +
       						}}

     

       1674
       1674
       +
       					>

     

       1675
       1675
       +
       						Notifications

     

       1676
       1676
       +
       					</button>

     

       1677
       1677
       +
       					<button

     

       1388
       1678
        
       						class="tab ${this.currentPage === "danger" ? "active" : ""}"

     

       1389
       1679
        
       						@click=${() => {

     

       1390
       1680
        
       							this.setTab("danger");

     
···

       1397
       1687
        
       				${this.currentPage === "account" ? this.renderAccountPage() : ""}

     

       1398
       1688
        
       				${this.currentPage === "sessions" ? this.renderSessionsPage() : ""}

     

       1399
       1689
        
       				${this.currentPage === "billing" ? this.renderBillingPage() : ""}

     

       1690
       1690
       +
       				${this.currentPage === "notifications" ? this.renderNotificationsPage() : ""}

     

       1400
       1691
        
       				${this.currentPage === "danger" ? this.renderDangerPage() : ""}

     

       1401
       1692
        
       			</div>

     

       1402
       1693
        
       

     
···

       1416
       1707
        
       									permanently deleted.

     

       1417
       1708
        
       								</p>

     

       1418
       1709
        
       								<div class="modal-actions">

     

       1419
       1419
       -
       									<button class="btn btn-rejection" @click=${this.handleDeleteAccount}>

     

       1420
       1420
       -
       										Yes, Delete My Account

     

       1710
       1710
       +
       									<button 

     

       1711
       1711
       +
       										class="btn btn-rejection" 

     

       1712
       1712
       +
       										@click=${this.handleDeleteAccount}

     

       1713
       1713
       +
       										?disabled=${this.deletingAccount}

     

       1714
       1714
       +
       									>

     

       1715
       1715
       +
       										${this.deletingAccount ? "Deleting..." : "Yes, Delete My Account"}

     

       1421
       1716
        
       									</button>

     

       1422
       1717
        
       									<button

     

       1423
       1718
        
       										class="btn btn-neutral"

     

       1424
       1719
        
       										@click=${() => {

     

       1425
       1720
        
       											this.showDeleteConfirm = false;

     

       1426
       1721
        
       										}}

     

       1722
       1722
       +
       										?disabled=${this.deletingAccount}

     

       1427
       1723
        
       									>

     

       1428
       1724
        
       										Cancel

     

       1429
       1725
        
       									</button>

+125 -45

src/db/schema.ts

···

       1
       1
        
       import { Database } from "bun:sqlite";

     

       2
       2
        
       

     

       3
       3
       -
       export const db = new Database("thistle.db");

     

       3
       3
       +
       // Use test database when NODE_ENV is test

     

       4
       4
       +
       const dbPath =

     

       5
       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
       6
       +
       export const db = new Database(dbPath);

     

       7
       7
       +
       

     

       8
       8
       +
       console.log(`[Database] Using database: ${dbPath}`);

     

       4
       9
        
       

     

       5
       10
        
       // Schema version tracking

     

       6
       11
        
       db.run(`

     
···

       13
       18
        
       const migrations = [

     

       14
       19
        
       	{

     

       15
       20
        
       		version: 1,

     

       16
       16
       -
       		name: "Complete schema with class system",

     

       21
       21
       +
       		name: "Initial schema with all tables and constraints",

     

       17
       22
        
       		sql: `

     

       18
       23
        
             -- Users table

     

       19
       24
        
             CREATE TABLE IF NOT EXISTS users (

     
···

       24
       29
        
               avatar TEXT DEFAULT 'd',

     

       25
       30
        
               role TEXT NOT NULL DEFAULT 'user',

     

       26
       31
        
               last_login INTEGER,

     

       32
       32
       +
               email_verified BOOLEAN DEFAULT 0,

     

       33
       33
       +
               email_notifications_enabled BOOLEAN DEFAULT 1,

     

       27
       34
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))

     

       28
       35
        
             );

     

       29
       36
        
       

     

       30
       37
        
             CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);

     

       31
       38
        
             CREATE INDEX IF NOT EXISTS idx_users_last_login ON users(last_login);

     

       39
       39
       +
             CREATE INDEX IF NOT EXISTS idx_users_email_verified ON users(email_verified);

     

       32
       40
        
       

     

       33
       41
        
             -- Sessions table

     

       34
       42
        
             CREATE TABLE IF NOT EXISTS sessions (

     
···

       84
       92
        
       

     

       85
       93
        
             CREATE INDEX IF NOT EXISTS idx_classes_semester_year ON classes(semester, year);

     

       86
       94
        
             CREATE INDEX IF NOT EXISTS idx_classes_archived ON classes(archived);

     

       95
       95
       +
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       87
       96
        
       

     

       88
       97
        
             -- Class members table

     

       89
       98
        
             CREATE TABLE IF NOT EXISTS class_members (

     
···

       132
       141
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_class_id ON transcriptions(class_id);

     

       133
       142
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_status ON transcriptions(status);

     

       134
       143
        
             CREATE INDEX IF NOT EXISTS idx_transcriptions_whisper_job_id ON transcriptions(whisper_job_id);

     

       135
       135
       -
           `,

     

       136
       136
       -
       	},

     

       137
       137
       -
       	{

     

       138
       138
       -
       		version: 2,

     

       139
       139
       -
       		name: "Add section column to classes table",

     

       140
       140
       -
       		sql: `

     

       141
       141
       -
             ALTER TABLE classes ADD COLUMN section TEXT;

     

       142
       142
       -
             CREATE INDEX IF NOT EXISTS idx_classes_course_code ON classes(course_code);

     

       143
       143
       -
           `,

     

       144
       144
       -
       	},

     

       145
       145
       -
       	{

     

       146
       146
       -
       		version: 3,

     

       147
       147
       -
       		name: "Add class waitlist table",

     

       148
       148
       -
       		sql: `

     

       144
       144
       +
             CREATE INDEX IF NOT EXISTS idx_transcriptions_meeting_time_id ON transcriptions(meeting_time_id);

     

       145
       145
       +
       

     

       146
       146
       +
             -- Class waitlist table

     

       149
       147
        
             CREATE TABLE IF NOT EXISTS class_waitlist (

     

       150
       148
        
               id TEXT PRIMARY KEY,

     

       151
       149
        
               user_id INTEGER NOT NULL,

     

       152
       150
        
               course_code TEXT NOT NULL,

     

       153
       151
        
               course_name TEXT NOT NULL,

     

       154
       152
        
               professor TEXT NOT NULL,

     

       155
       155
       -
               section TEXT,

     

       156
       153
        
               semester TEXT NOT NULL,

     

       157
       154
        
               year INTEGER NOT NULL,

     

       155
       155
       +
               meeting_times TEXT,

     

       158
       156
        
               additional_info TEXT,

     

       159
       157
        
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       160
       158
        
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     
···

       162
       160
        
       

     

       163
       161
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_user_id ON class_waitlist(user_id);

     

       164
       162
        
             CREATE INDEX IF NOT EXISTS idx_waitlist_course_code ON class_waitlist(course_code);

     

       165
       165
       -
           `,

     

       166
       166
       -
       	},

     

       167
       167
       -
       	{

     

       168
       168
       -
       		version: 4,

     

       169
       169
       -
       		name: "Add meeting_times to class_waitlist",

     

       170
       170
       -
       		sql: `

     

       171
       171
       -
             ALTER TABLE class_waitlist ADD COLUMN meeting_times TEXT;

     

       172
       172
       -
           `,

     

       173
       173
       -
       	},

     

       174
       174
       -
       	{

     

       175
       175
       -
       		version: 5,

     

       176
       176
       -
       		name: "Remove section columns",

     

       177
       177
       -
       		sql: `

     

       178
       178
       -
             DROP INDEX IF EXISTS idx_classes_section;

     

       179
       179
       -
             ALTER TABLE classes DROP COLUMN section;

     

       180
       180
       -
             ALTER TABLE class_waitlist DROP COLUMN section;

     

       181
       181
       -
           `,

     

       182
       182
       -
       	},

     

       183
       183
       -
       	{

     

       184
       184
       -
       		version: 6,

     

       185
       185
       -
       		name: "Add subscriptions table for Polar integration",

     

       186
       186
       -
       		sql: `

     

       163
       163
       +
       

     

       187
       164
        
             -- Subscriptions table

     

       188
       165
        
             CREATE TABLE IF NOT EXISTS subscriptions (

     

       189
       166
        
               id TEXT PRIMARY KEY,

     
···

       202
       179
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_user_id ON subscriptions(user_id);

     

       203
       180
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);

     

       204
       181
        
             CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);

     

       182
       182
       +
       

     

       183
       183
       +
             -- Email verification tokens table

     

       184
       184
       +
             CREATE TABLE IF NOT EXISTS email_verification_tokens (

     

       185
       185
       +
               id TEXT PRIMARY KEY,

     

       186
       186
       +
               user_id INTEGER NOT NULL,

     

       187
       187
       +
               token TEXT NOT NULL UNIQUE,

     

       188
       188
       +
               expires_at INTEGER NOT NULL,

     

       189
       189
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       190
       190
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       191
       191
       +
             );

     

       192
       192
       +
       

     

       193
       193
       +
             CREATE INDEX IF NOT EXISTS idx_verification_tokens_user_id ON email_verification_tokens(user_id);

     

       194
       194
       +
             CREATE INDEX IF NOT EXISTS idx_verification_tokens_token ON email_verification_tokens(token);

     

       195
       195
       +
       

     

       196
       196
       +
             -- Password reset tokens table

     

       197
       197
       +
             CREATE TABLE IF NOT EXISTS password_reset_tokens (

     

       198
       198
       +
               id TEXT PRIMARY KEY,

     

       199
       199
       +
               user_id INTEGER NOT NULL,

     

       200
       200
       +
               token TEXT NOT NULL UNIQUE,

     

       201
       201
       +
               expires_at INTEGER NOT NULL,

     

       202
       202
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       203
       203
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       204
       204
       +
             );

     

       205
       205
       +
       

     

       206
       206
       +
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user_id ON password_reset_tokens(user_id);

     

       207
       207
       +
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_token ON password_reset_tokens(token);

     

       208
       208
       +
       

     

       209
       209
       +
             -- Email change tokens table

     

       210
       210
       +
             CREATE TABLE IF NOT EXISTS email_change_tokens (

     

       211
       211
       +
               id TEXT PRIMARY KEY,

     

       212
       212
       +
               user_id INTEGER NOT NULL,

     

       213
       213
       +
               new_email TEXT NOT NULL,

     

       214
       214
       +
               token TEXT NOT NULL UNIQUE,

     

       215
       215
       +
               expires_at INTEGER NOT NULL,

     

       216
       216
       +
               created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       217
       217
       +
               FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE

     

       218
       218
       +
             );

     

       219
       219
       +
       

     

       220
       220
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_user_id ON email_change_tokens(user_id);

     

       221
       221
       +
             CREATE INDEX IF NOT EXISTS idx_email_change_tokens_token ON email_change_tokens(token);

     

       222
       222
       +
       

     

       223
       223
       +
             -- Create ghost user for deleted accounts

     

       224
       224
       +
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       225
       225
       +
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       205
       226
        
           `,

     

       206
       227
        
       	},

     

       207
       228
        
       	{

     

       208
       208
       -
       		version: 7,

     

       209
       209
       -
       		name: "Create ghost user for deleted accounts",

     

       229
       229
       +
       		version: 2,

     

       230
       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       231
       +
       		sql: `

     

       232
       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       234
       +
       

     

       235
       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       237
       +
       

     

       238
       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       241
       +
       				class_id TEXT NOT NULL,

     

       242
       242
       +
       				section_number TEXT NOT NULL,

     

       243
       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       246
       +
       			);

     

       247
       247
       +
       

     

       248
       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       249
       +
       

     

       250
       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       252
       +
       

     

       253
       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       254
       +
       		`,

     

       255
       255
       +
       	},

     

       256
       256
       +
       	{

     

       257
       257
       +
       		version: 3,

     

       258
       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       210
       259
        
       		sql: `

     

       211
       211
       -
             -- Create a ghost user account for orphaned transcriptions

     

       212
       212
       -
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       213
       213
       -
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       214
       214
       -
           `,

     

       260
       260
       +
       			-- Add vote count to transcriptions

     

       261
       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       262
       +
       

     

       263
       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       265
       +
       

     

       266
       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       275
       +
       			);

     

       276
       276
       +
       

     

       277
       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       279
       +
       		`,

     

       280
       280
       +
       	},

     

       281
       281
       +
       	{

     

       282
       282
       +
       		version: 4,

     

       283
       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
       284
       +
       		sql: `

     

       285
       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       286
       +
       			-- Defaults to created_at for existing records

     

       287
       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       288
       +
       			

     

       289
       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       291
       +
       

     

       292
       292
       +
       			-- Create index for ordering by recording date

     

       293
       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       294
       +
       		`,

     

       215
       295
        
       	},

     

       216
       296
        
       ];

     

       217
       297

+4 -2

src/index.test.README.md

···

       55
       55
        
       - `PUT /api/passkeys/:id` - Update passkey name

     

       56
       56
        
       - `DELETE /api/passkeys/:id` - Delete passkey

     

       57
       57
        
       

     

       58
       58
       +
       ### Health Endpoint

     

       59
       59
       +
       - `GET /api/health` - Check service health (database, whisper, storage)

     

       60
       60
       +
       

     

       58
       61
        
       ### Transcription Endpoints

     

       59
       59
       -
       - `GET /api/transcriptions/health` - Check transcription service health

     

       60
       62
        
       - `GET /api/transcriptions` - List user transcriptions

     

       61
       63
        
       - `POST /api/transcriptions` - Upload audio file and start transcription

     

       62
       64
        
       - `GET /api/transcriptions/:id` - Get transcription details

     
···

       70
       72
        
       - `PUT /api/admin/users/:id/role` - Update user role

     

       71
       73
        
       - `PUT /api/admin/users/:id/name` - Update user name

     

       72
       74
        
       - `PUT /api/admin/users/:id/email` - Update user email

     

       73
       73
       -
       - `PUT /api/admin/users/:id/password` - Update user password

     

       75
       75
       +
       - `POST /api/admin/users/:id/password-reset` - Send password reset email

     

       74
       76
        
       - `GET /api/admin/users/:id/sessions` - List user sessions

     

       75
       77
        
       - `DELETE /api/admin/users/:id/sessions` - Delete all user sessions

     

       76
       78
        
       - `DELETE /api/admin/users/:id/sessions/:sessionId` - Delete specific session

+353 -747

src/index.test.ts

···

       6
       6
        
       	expect,

     

       7
       7
        
       	test,

     

       8
       8
        
       } from "bun:test";

     

       9
       9
       -
       import db from "./db/schema";

     

       9
       9
       +
       import type { Subprocess } from "bun";

     

       10
       10
        
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
       11
        
       

     

       12
       12
       -
       // Test server URL - uses port 3001 for testing to avoid conflicts

     

       12
       12
       +
       // Test server configuration

     

       13
       13
        
       const TEST_PORT = 3001;

     

       14
       14
        
       const BASE_URL = `http://localhost:${TEST_PORT}`;

     

       15
       15
       +
       const TEST_DB_PATH = "./thistle.test.db";

     

       15
       16
        
       

     

       16
       16
       -
       // Check if server is available

     

       17
       17
       -
       let serverAvailable = false;

     

       17
       17
       +
       // Test server process

     

       18
       18
       +
       let serverProcess: Subprocess | null = null;

     

       18
       19
        
       

     

       19
       20
        
       beforeAll(async () => {

     

       21
       21
       +
       	// Clean up any existing test database

     

       20
       22
        
       	try {

     

       21
       21
       -
       		const response = await fetch(`${BASE_URL}/api/transcriptions/health`, {

     

       22
       22
       -
       			signal: AbortSignal.timeout(1000),

     

       23
       23
       -
       		});

     

       24
       24
       -
       		serverAvailable = response.ok || response.status === 404;

     

       23
       23
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       25
       24
        
       	} catch {

     

       26
       26
       -
       		console.warn(

     

       27
       27
       -
       			`\n⚠️  Test server not running on port ${TEST_PORT}. Start it with:\n   PORT=${TEST_PORT} bun run src/index.ts\n   Then run tests in another terminal.\n`,

     

       28
       28
       -
       		);

     

       29
       29
       -
       		serverAvailable = false;

     

       25
       25
       +
       		// Ignore if doesn't exist

     

       30
       26
        
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	// Start test server as subprocess

     

       29
       29
       +
       	serverProcess = Bun.spawn(["bun", "run", "src/index.ts"], {

     

       30
       30
       +
       		env: {

     

       31
       31
       +
       			...process.env,

     

       32
       32
       +
       			NODE_ENV: "test",

     

       33
       33
       +
       			PORT: TEST_PORT.toString(),

     

       34
       34
       +
       			SKIP_EMAILS: "true",

     

       35
       35
       +
       			SKIP_POLAR_SYNC: "true",

     

       36
       36
       +
       			// Dummy env vars to pass startup validation (won't be used due to SKIP_EMAILS/SKIP_POLAR_SYNC)

     

       37
       37
       +
       			MAILCHANNELS_API_KEY: "test-key",

     

       38
       38
       +
       			DKIM_PRIVATE_KEY: "test-key",

     

       39
       39
       +
       			LLM_API_KEY: "test-key",

     

       40
       40
       +
       			LLM_API_BASE_URL: "https://test.com",

     

       41
       41
       +
       			LLM_MODEL: "test-model",

     

       42
       42
       +
       			POLAR_ACCESS_TOKEN: "test-token",

     

       43
       43
       +
       			POLAR_ORGANIZATION_ID: "test-org",

     

       44
       44
       +
       			POLAR_PRODUCT_ID: "test-product",

     

       45
       45
       +
       			POLAR_SUCCESS_URL: "http://localhost:3001/success",

     

       46
       46
       +
       			POLAR_WEBHOOK_SECRET: "test-webhook-secret",

     

       47
       47
       +
       			ORIGIN: "http://localhost:3001",

     

       48
       48
       +
       		},

     

       49
       49
       +
       		stdout: "pipe",

     

       50
       50
       +
       		stderr: "pipe",

     

       51
       51
       +
       	});

     

       52
       52
       +
       

     

       53
       53
       +
       	// Log server output for debugging

     

       54
       54
       +
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       55
       +
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       56
       +
       	const decoder = new TextDecoder();

     

       57
       57
       +
       

     

       58
       58
       +
       	(async () => {

     

       59
       59
       +
       		try {

     

       60
       60
       +
       			while (true) {

     

       61
       61
       +
       				const { value, done } = await stdoutReader.read();

     

       62
       62
       +
       				if (done) break;

     

       63
       63
       +
       				const text = decoder.decode(value);

     

       64
       64
       +
       				console.log("[SERVER OUT]", text.trim());

     

       65
       65
       +
       			}

     

       66
       66
       +
       		} catch {}

     

       67
       67
       +
       	})();

     

       68
       68
       +
       

     

       69
       69
       +
       	(async () => {

     

       70
       70
       +
       		try {

     

       71
       71
       +
       			while (true) {

     

       72
       72
       +
       				const { value, done } = await stderrReader.read();

     

       73
       73
       +
       				if (done) break;

     

       74
       74
       +
       				const text = decoder.decode(value);

     

       75
       75
       +
       				console.error("[SERVER ERR]", text.trim());

     

       76
       76
       +
       			}

     

       77
       77
       +
       		} catch {}

     

       78
       78
       +
       	})();

     

       79
       79
       +
       

     

       80
       80
       +
       	// Wait for server to be ready

     

       81
       81
       +
       	let retries = 30;

     

       82
       82
       +
       	let ready = false;

     

       83
       83
       +
       	while (retries > 0 && !ready) {

     

       84
       84
       +
       		try {

     

       85
       85
       +
       			const response = await fetch(`${BASE_URL}/api/health`, {

     

       86
       86
       +
       				signal: AbortSignal.timeout(1000),

     

       87
       87
       +
       			});

     

       88
       88
       +
       			if (response.ok) {

     

       89
       89
       +
       				ready = true;

     

       90
       90
       +
       				break;

     

       91
       91
       +
       			}

     

       92
       92
       +
       		} catch {

     

       93
       93
       +
       			// Server not ready yet

     

       94
       94
       +
       		}

     

       95
       95
       +
       		await new Promise((resolve) => setTimeout(resolve, 500));

     

       96
       96
       +
       		retries--;

     

       97
       97
       +
       	}

     

       98
       98
       +
       

     

       99
       99
       +
       	if (!ready) {

     

       100
       100
       +
       		throw new Error("Test server failed to start within 15 seconds");

     

       101
       101
       +
       	}

     

       102
       102
       +
       

     

       103
       103
       +
       	console.log(`✓ Test server running on port ${TEST_PORT}`);

     

       104
       104
       +
       });

     

       105
       105
       +
       

     

       106
       106
       +
       afterAll(async () => {

     

       107
       107
       +
       	// Kill test server

     

       108
       108
       +
       	if (serverProcess) {

     

       109
       109
       +
       		serverProcess.kill();

     

       110
       110
       +
       		await new Promise((resolve) => setTimeout(resolve, 1000));

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Clean up test database

     

       114
       114
       +
       	try {

     

       115
       115
       +
       		await import("node:fs/promises").then((fs) => fs.unlink(TEST_DB_PATH));

     

       116
       116
       +
       	} catch {

     

       117
       117
       +
       		// Ignore if doesn't exist

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       121
       +
       });

     

       122
       122
       +
       

     

       123
       123
       +
       // Clear database between each test

     

       124
       124
       +
       beforeEach(async () => {

     

       125
       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       126
       +
       

     

       127
       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       138
       +
       	db.run("DELETE FROM classes");

     

       139
       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       141
       +
       

     

       142
       142
       +
       	db.close();

     

       31
       143
        
       });

     

       32
       144
        
       

     

       33
       145
        
       // Test user credentials

     
···

       81
       193
        
       	});

     

       82
       194
        
       }

     

       83
       195
        
       

     

       84
       84
       -
       // Cleanup helpers

     

       85
       85
       -
       function cleanupTestData() {

     

       86
       86
       -
       	// Delete test users and their related data (cascade will handle most of it)

     

       87
       87
       -
       	// Include 'newemail%' to catch users whose emails were updated during tests

     

       88
       88
       -
       	db.run(

     

       89
       89
       -
       		"DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       90
       90
       -
       	);

     

       91
       91
       -
       	db.run(

     

       92
       92
       -
       		"DELETE FROM passkeys WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       93
       93
       -
       	);

     

       94
       94
       -
       	db.run(

     

       95
       95
       -
       		"DELETE FROM transcriptions WHERE user_id IN (SELECT id FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%')",

     

       96
       96
       -
       	);

     

       97
       97
       -
       	db.run(

     

       98
       98
       -
       		"DELETE FROM users WHERE email LIKE 'test%' OR email LIKE 'admin@%' OR email LIKE 'newemail%'",

     

       99
       99
       -
       	);

     

       196
       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       197
       +
       async function registerAndLogin(user: {

     

       198
       198
       +
       	email: string;

     

       199
       199
       +
       	password: string;

     

       200
       200
       +
       	name?: string;

     

       201
       201
       +
       }): Promise<string> {

     

       202
       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       203
       +
       

     

       204
       204
       +
       	// Register the user

     

       205
       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       206
       +
       		method: "POST",

     

       207
       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       208
       +
       		body: JSON.stringify({

     

       209
       209
       +
       			email: user.email,

     

       210
       210
       +
       			password: hashedPassword,

     

       211
       211
       +
       			name: user.name || "Test User",

     

       212
       212
       +
       		}),

     

       213
       213
       +
       	});

     

       214
       214
       +
       

     

       215
       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       216
       +
       		const error = await registerResponse.json();

     

       217
       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       218
       +
       	}

     

       219
       219
       +
       

     

       220
       220
       +
       	const registerData = await registerResponse.json();

     

       221
       221
       +
       	const userId = registerData.user.id;

     

       222
       222
       +
       

     

       223
       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       226
       +
       	db.close();

     

       100
       227
        
       

     

       101
       101
       -
       	// Clear ALL rate limit data to prevent accumulation across tests

     

       102
       102
       -
       	// (IP-based rate limits don't contain test/admin in the key)

     

       103
       103
       -
       	db.run("DELETE FROM rate_limit_attempts");

     

       104
       104
       -
       }

     

       228
       228
       +
       	// Now login to get a session

     

       229
       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       230
       +
       		method: "POST",

     

       231
       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       232
       +
       		body: JSON.stringify({

     

       233
       233
       +
       			email: user.email,

     

       234
       234
       +
       			password: hashedPassword,

     

       235
       235
       +
       		}),

     

       236
       236
       +
       	});

     

       105
       237
        
       

     

       106
       106
       -
       beforeEach(() => {

     

       107
       107
       -
       	if (serverAvailable) {

     

       108
       108
       -
       		cleanupTestData();

     

       238
       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       239
       +
       		const error = await loginResponse.json();

     

       240
       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       109
       241
        
       	}

     

       110
       110
       -
       });

     

       111
       242
        
       

     

       112
       112
       -
       afterAll(() => {

     

       113
       113
       -
       	if (serverAvailable) {

     

       114
       114
       -
       		cleanupTestData();

     

       243
       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       // Helper to add active subscription to a user

     

       247
       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       249
       +
       	const user = db

     

       250
       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       251
       +
       		.get(userEmail) as { id: number };

     

       252
       252
       +
       	if (!user) {

     

       253
       253
       +
       		db.close();

     

       254
       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       115
       255
        
       	}

     

       116
       116
       -
       });

     

       117
       256
        
       

     

       118
       118
       -
       // Helper to skip tests if server is not available

     

       119
       119
       -
       function serverTest(name: string, fn: () => void | Promise<void>) {

     

       120
       120
       -
       	test(name, async () => {

     

       121
       121
       -
       		if (!serverAvailable) {

     

       122
       122
       -
       			console.log(`⏭️  Skipping: ${name} (server not running)`);

     

       123
       123
       -
       			return;

     

       124
       124
       -
       		}

     

       125
       125
       -
       		await fn();

     

       126
       126
       -
       	});

     

       257
       257
       +
       	db.run(

     

       258
       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       260
       +
       	);

     

       261
       261
       +
       	db.close();

     

       127
       262
        
       }

     

       128
       263
        
       

     

       264
       264
       +
       // All tests run against a fresh database, no cleanup needed

     

       265
       265
       +
       

     

       129
       266
        
       describe("API Endpoints - Authentication", () => {

     

       130
       267
        
       	describe("POST /api/auth/register", () => {

     

       131
       131
       -
       		serverTest("should register a new user successfully", async () => {

     

       268
       268
       +
       		test("should register a new user successfully", async () => {

     

       132
       269
        
       			const hashedPassword = await clientHashPassword(

     

       133
       270
        
       				TEST_USER.email,

     

       134
       271
        
       				TEST_USER.password,

     
···

       144
       281
        
       				}),

     

       145
       282
        
       			});

     

       146
       283
        
       

     

       147
       147
       -
       			expect(response.status).toBe(200);

     

       284
       284
       +
       			if (response.status !== 201) {

     

       285
       285
       +
       				const error = await response.json();

     

       286
       286
       +
       				console.error("Registration failed:", response.status, error);

     

       287
       287
       +
       			}

     

       288
       288
       +
       

     

       289
       289
       +
       			expect(response.status).toBe(201);

     

       290
       290
       +
       

     

       148
       291
        
       			const data = await response.json();

     

       149
       292
        
       			expect(data.user).toBeDefined();

     

       150
       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       151
       151
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       294
       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       152
       295
        
       		});

     

       153
       296
        
       

     

       154
       154
       -
       		serverTest("should reject registration with missing email", async () => {

     

       297
       297
       +
       		test("should reject registration with missing email", async () => {

     

       155
       298
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       156
       299
        
       				method: "POST",

     

       157
       300
        
       				headers: { "Content-Type": "application/json" },

     
···

       165
       308
        
       			expect(data.error).toBe("Email and password required");

     

       166
       309
        
       		});

     

       167
       310
        
       

     

       168
       168
       -
       		serverTest(

     

       169
       169
       -
       			"should reject registration with invalid password format",

     

       170
       170
       -
       			async () => {

     

       171
       171
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       172
       172
       -
       					method: "POST",

     

       173
       173
       -
       					headers: { "Content-Type": "application/json" },

     

       174
       174
       -
       					body: JSON.stringify({

     

       175
       175
       -
       						email: TEST_USER.email,

     

       176
       176
       -
       						password: "short",

     

       177
       177
       -
       					}),

     

       178
       178
       -
       				});

     

       179
       179
       -
       

     

       180
       180
       -
       				expect(response.status).toBe(400);

     

       181
       181
       -
       				const data = await response.json();

     

       182
       182
       -
       				expect(data.error).toBe("Invalid password format");

     

       183
       183
       -
       			},

     

       184
       184
       -
       		);

     

       185
       185
       -
       

     

       186
       186
       -
       		serverTest("should reject duplicate email registration", async () => {

     

       187
       187
       -
       			const hashedPassword = await clientHashPassword(

     

       188
       188
       -
       				TEST_USER.email,

     

       189
       189
       -
       				TEST_USER.password,

     

       190
       190
       -
       			);

     

       191
       191
       -
       

     

       192
       192
       -
       			// First registration

     

       193
       193
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       194
       194
       -
       				method: "POST",

     

       195
       195
       -
       				headers: { "Content-Type": "application/json" },

     

       196
       196
       -
       				body: JSON.stringify({

     

       197
       197
       -
       					email: TEST_USER.email,

     

       198
       198
       -
       					password: hashedPassword,

     

       199
       199
       -
       					name: TEST_USER.name,

     

       200
       200
       -
       				}),

     

       201
       201
       -
       			});

     

       202
       202
       -
       

     

       203
       203
       -
       			// Duplicate registration

     

       311
       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       204
       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       205
       313
        
       				method: "POST",

     

       206
       314
        
       				headers: { "Content-Type": "application/json" },

     

       207
       315
        
       				body: JSON.stringify({

     

       208
       316
        
       					email: TEST_USER.email,

     

       209
       209
       -
       					password: hashedPassword,

     

       210
       210
       -
       					name: TEST_USER.name,

     

       317
       317
       +
       					password: "short",

     

       211
       318
        
       				}),

     

       212
       319
        
       			});

     

       213
       320
        
       

     

       214
       321
        
       			expect(response.status).toBe(400);

     

       215
       322
        
       			const data = await response.json();

     

       216
       216
       -
       			expect(data.error).toBe("Email already registered");

     

       323
       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       217
       324
        
       		});

     

       218
       325
        
       

     

       219
       219
       -
       		serverTest("should enforce rate limiting on registration", async () => {

     

       220
       220
       -
       			const hashedPassword = await clientHashPassword(

     

       221
       221
       -
       				"test@example.com",

     

       222
       222
       -
       				"password",

     

       223
       223
       -
       			);

     

       224
       224
       -
       

     

       225
       225
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       226
       226
       -
       			let rateLimitHit = false;

     

       227
       227
       -
       			for (let i = 0; i < 10; i++) {

     

       228
       228
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       229
       229
       -
       					method: "POST",

     

       230
       230
       -
       					headers: { "Content-Type": "application/json" },

     

       231
       231
       -
       					body: JSON.stringify({

     

       232
       232
       -
       						email: `test${i}@example.com`,

     

       233
       233
       -
       						password: hashedPassword,

     

       234
       234
       -
       					}),

     

       235
       235
       -
       				});

     

       236
       236
       -
       

     

       237
       237
       -
       				if (response.status === 429) {

     

       238
       238
       -
       					rateLimitHit = true;

     

       239
       239
       -
       					break;

     

       240
       240
       -
       				}

     

       241
       241
       -
       			}

     

       242
       242
       -
       

     

       243
       243
       -
       			// Verify that rate limiting was triggered

     

       244
       244
       -
       			expect(rateLimitHit).toBe(true);

     

       245
       245
       -
       		});

     

       246
       246
       -
       	});

     

       247
       247
       -
       

     

       248
       248
       -
       	describe("POST /api/auth/login", () => {

     

       249
       249
       -
       		serverTest("should login successfully with valid credentials", async () => {

     

       250
       250
       -
       			// Register user first

     

       326
       326
       +
       		test("should reject duplicate email registration", async () => {

     

       251
       327
        
       			const hashedPassword = await clientHashPassword(

     

       252
       328
        
       				TEST_USER.email,

     

       253
       329
        
       				TEST_USER.password,

     

       254
       330
        
       			);

     

       331
       331
       +
       

     

       332
       332
       +
       			// First registration

     

       255
       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       256
       334
        
       				method: "POST",

     

       257
       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       262
       340
        
       				}),

     

       263
       341
        
       			});

     

       264
       342
        
       

     

       265
       265
       -
       			// Login

     

       266
       266
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       343
       343
       +
       			// Duplicate registration

     

       344
       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       267
       345
        
       				method: "POST",

     

       268
       346
        
       				headers: { "Content-Type": "application/json" },

     

       269
       347
        
       				body: JSON.stringify({

     

       270
       348
        
       					email: TEST_USER.email,

     

       271
       349
        
       					password: hashedPassword,

     

       350
       350
       +
       					name: TEST_USER.name,

     

       272
       351
        
       				}),

     

       273
       352
        
       			});

     

       274
       353
        
       

     

       275
       275
       -
       			expect(response.status).toBe(200);

     

       354
       354
       +
       			expect(response.status).toBe(409);

     

       276
       355
        
       			const data = await response.json();

     

       277
       277
       -
       			expect(data.user).toBeDefined();

     

       278
       278
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       279
       279
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       356
       356
       +
       			expect(data.error).toBe("Email already registered");

     

       280
       357
        
       		});

     

       281
       358
        
       

     

       282
       282
       -
       		serverTest("should reject login with invalid credentials", async () => {

     

       283
       283
       -
       			// Register user first

     

       359
       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       284
       360
        
       			const hashedPassword = await clientHashPassword(

     

       285
       285
       -
       				TEST_USER.email,

     

       286
       286
       -
       				TEST_USER.password,

     

       361
       361
       +
       				"ratelimit@example.com",

     

       362
       362
       +
       				"password",

     

       287
       363
        
       			);

     

       364
       364
       +
       

     

       365
       365
       +
       			// First registration succeeds

     

       288
       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       289
       367
        
       				method: "POST",

     

       290
       368
        
       				headers: { "Content-Type": "application/json" },

     

       291
       369
        
       				body: JSON.stringify({

     

       292
       292
       -
       					email: TEST_USER.email,

     

       370
       370
       +
       					email: "ratelimit@example.com",

     

       293
       371
        
       					password: hashedPassword,

     

       294
       372
        
       				}),

     

       295
       373
        
       			});

     

       296
       374
        
       

     

       297
       297
       -
       			// Login with wrong password

     

       298
       298
       -
       			const wrongPassword = await clientHashPassword(

     

       299
       299
       -
       				TEST_USER.email,

     

       300
       300
       -
       				"WrongPassword123!",

     

       301
       301
       -
       			);

     

       302
       302
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       303
       303
       -
       				method: "POST",

     

       304
       304
       -
       				headers: { "Content-Type": "application/json" },

     

       305
       305
       -
       				body: JSON.stringify({

     

       306
       306
       -
       					email: TEST_USER.email,

     

       307
       307
       -
       					password: wrongPassword,

     

       308
       308
       -
       				}),

     

       309
       309
       -
       			});

     

       310
       310
       -
       

     

       311
       311
       -
       			expect(response.status).toBe(401);

     

       312
       312
       -
       			const data = await response.json();

     

       313
       313
       -
       			expect(data.error).toBe("Invalid email or password");

     

       314
       314
       -
       		});

     

       315
       315
       -
       

     

       316
       316
       -
       		serverTest("should reject login with missing fields", async () => {

     

       317
       317
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       318
       318
       -
       				method: "POST",

     

       319
       319
       -
       				headers: { "Content-Type": "application/json" },

     

       320
       320
       -
       				body: JSON.stringify({

     

       321
       321
       -
       					email: TEST_USER.email,

     

       322
       322
       -
       				}),

     

       323
       323
       -
       			});

     

       324
       324
       -
       

     

       325
       325
       -
       			expect(response.status).toBe(400);

     

       326
       326
       -
       			const data = await response.json();

     

       327
       327
       -
       			expect(data.error).toBe("Email and password required");

     

       328
       328
       -
       		});

     

       329
       329
       -
       

     

       330
       330
       -
       		serverTest("should enforce rate limiting on login attempts", async () => {

     

       331
       331
       -
       			const hashedPassword = await clientHashPassword(

     

       332
       332
       -
       				TEST_USER.email,

     

       333
       333
       -
       				TEST_USER.password,

     

       334
       334
       -
       			);

     

       335
       335
       -
       

     

       336
       336
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       375
       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       337
       377
        
       			let rateLimitHit = false;

     

       338
       338
       -
       			for (let i = 0; i < 11; i++) {

     

       339
       339
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       378
       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       340
       380
        
       					method: "POST",

     

       341
       381
        
       					headers: { "Content-Type": "application/json" },

     

       342
       382
        
       					body: JSON.stringify({

     

       343
       343
       -
       						email: TEST_USER.email,

     

       383
       383
       +
       						email: "ratelimit@example.com",

     

       344
       384
        
       						password: hashedPassword,

     

       345
       385
        
       					}),

     

       346
       386
        
       				});

     
···

       356
       396
        
       		});

     

       357
       397
        
       	});

     

       358
       398
        
       

     

       359
       359
       -
       	describe("POST /api/auth/logout", () => {

     

       360
       360
       -
       		serverTest("should logout successfully", async () => {

     

       399
       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       361
       401
        
       			// Register and login

     

       362
       362
       -
       			const hashedPassword = await clientHashPassword(

     

       363
       363
       -
       				TEST_USER.email,

     

       364
       364
       -
       				TEST_USER.password,

     

       365
       365
       -
       			);

     

       366
       366
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       367
       367
       -
       				method: "POST",

     

       368
       368
       -
       				headers: { "Content-Type": "application/json" },

     

       369
       369
       -
       				body: JSON.stringify({

     

       370
       370
       -
       					email: TEST_USER.email,

     

       371
       371
       -
       					password: hashedPassword,

     

       372
       372
       -
       				}),

     

       373
       373
       -
       			});

     

       374
       374
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       375
       375
       -
       

     

       376
       376
       -
       			// Logout

     

       377
       377
       -
       			const response = await authRequest(

     

       378
       378
       -
       				`${BASE_URL}/api/auth/logout`,

     

       379
       379
       -
       				sessionCookie,

     

       380
       380
       -
       				{

     

       381
       381
       -
       					method: "POST",

     

       382
       382
       -
       				},

     

       383
       383
       -
       			);

     

       384
       384
       -
       

     

       385
       385
       -
       			expect(response.status).toBe(200);

     

       386
       386
       -
       			const data = await response.json();

     

       387
       387
       -
       			expect(data.success).toBe(true);

     

       388
       388
       -
       

     

       389
       389
       -
       			// Verify cookie is cleared

     

       390
       390
       -
       			const setCookie = response.headers.get("set-cookie");

     

       391
       391
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       392
       392
       -
       		});

     

       393
       393
       -
       

     

       394
       394
       -
       		serverTest("should logout even without valid session", async () => {

     

       395
       395
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       396
       396
       -
       				method: "POST",

     

       397
       397
       -
       			});

     

       398
       398
       -
       

     

       399
       399
       -
       			expect(response.status).toBe(200);

     

       400
       400
       -
       			const data = await response.json();

     

       401
       401
       -
       			expect(data.success).toBe(true);

     

       402
       402
       -
       		});

     

       403
       403
       -
       	});

     

       404
       404
       -
       

     

       405
       405
       -
       	describe("GET /api/auth/me", () => {

     

       406
       406
       -
       		serverTest(

     

       407
       407
       -
       			"should return current user info when authenticated",

     

       408
       408
       -
       			async () => {

     

       409
       409
       -
       				// Register user

     

       410
       410
       -
       				const hashedPassword = await clientHashPassword(

     

       411
       411
       -
       					TEST_USER.email,

     

       412
       412
       -
       					TEST_USER.password,

     

       413
       413
       -
       				);

     

       414
       414
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       415
       415
       -
       					method: "POST",

     

       416
       416
       -
       					headers: { "Content-Type": "application/json" },

     

       417
       417
       -
       					body: JSON.stringify({

     

       418
       418
       -
       						email: TEST_USER.email,

     

       419
       419
       -
       						password: hashedPassword,

     

       420
       420
       -
       						name: TEST_USER.name,

     

       421
       421
       -
       					}),

     

       422
       422
       -
       				});

     

       423
       423
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       -
       

     

       425
       425
       -
       				// Get current user

     

       426
       426
       -
       				const response = await authRequest(

     

       427
       427
       -
       					`${BASE_URL}/api/auth/me`,

     

       428
       428
       -
       					sessionCookie,

     

       429
       429
       -
       				);

     

       430
       430
       -
       

     

       431
       431
       -
       				expect(response.status).toBe(200);

     

       432
       432
       -
       				const data = await response.json();

     

       433
       433
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       434
       434
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       435
       435
       -
       				expect(data.role).toBeDefined();

     

       436
       436
       -
       			},

     

       437
       437
       -
       		);

     

       438
       438
       -
       

     

       439
       439
       -
       		serverTest("should return 401 when not authenticated", async () => {

     

       440
       440
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       441
       441
       -
       

     

       442
       442
       -
       			expect(response.status).toBe(401);

     

       443
       443
       -
       			const data = await response.json();

     

       444
       444
       -
       			expect(data.error).toBe("Not authenticated");

     

       445
       445
       -
       		});

     

       446
       446
       -
       

     

       447
       447
       -
       		serverTest("should return 401 with invalid session", async () => {

     

       448
       448
       -
       			const response = await authRequest(

     

       449
       449
       -
       				`${BASE_URL}/api/auth/me`,

     

       450
       450
       -
       				"invalid-session",

     

       451
       451
       -
       			);

     

       452
       452
       -
       

     

       453
       453
       -
       			expect(response.status).toBe(401);

     

       454
       454
       -
       			const data = await response.json();

     

       455
       455
       -
       			expect(data.error).toBe("Invalid session");

     

       456
       456
       -
       		});

     

       457
       457
       -
       	});

     

       458
       458
       -
       });

     

       459
       459
       -
       

     

       460
       460
       -
       describe("API Endpoints - Session Management", () => {

     

       461
       461
       -
       	describe("GET /api/sessions", () => {

     

       462
       462
       -
       		serverTest("should return user sessions", async () => {

     

       463
       463
       -
       			// Register user

     

       464
       464
       -
       			const hashedPassword = await clientHashPassword(

     

       465
       465
       -
       				TEST_USER.email,

     

       466
       466
       -
       				TEST_USER.password,

     

       467
       467
       -
       			);

     

       468
       468
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       469
       469
       -
       				method: "POST",

     

       470
       470
       -
       				headers: { "Content-Type": "application/json" },

     

       471
       471
       -
       				body: JSON.stringify({

     

       472
       472
       -
       					email: TEST_USER.email,

     

       473
       473
       -
       					password: hashedPassword,

     

       474
       474
       -
       				}),

     

       475
       475
       -
       			});

     

       476
       476
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       477
       477
       -
       

     

       478
       478
       -
       			// Get sessions

     

       479
       479
       -
       			const response = await authRequest(

     

       480
       480
       -
       				`${BASE_URL}/api/sessions`,

     

       481
       481
       -
       				sessionCookie,

     

       482
       482
       -
       			);

     

       483
       483
       -
       

     

       484
       484
       -
       			expect(response.status).toBe(200);

     

       485
       485
       -
       			const data = await response.json();

     

       486
       486
       -
       			expect(data.sessions).toBeDefined();

     

       487
       487
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       488
       488
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       489
       489
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       490
       490
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       491
       491
       -
       		});

     

       492
       492
       -
       

     

       493
       493
       -
       		serverTest("should require authentication", async () => {

     

       494
       494
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       495
       495
       -
       

     

       496
       496
       -
       			expect(response.status).toBe(401);

     

       497
       497
       -
       		});

     

       498
       498
       -
       	});

     

       499
       499
       -
       

     

       500
       500
       -
       	describe("DELETE /api/sessions", () => {

     

       501
       501
       -
       		serverTest("should delete specific session", async () => {

     

       502
       502
       -
       			// Register user and create multiple sessions

     

       503
       503
       -
       			const hashedPassword = await clientHashPassword(

     

       504
       504
       -
       				TEST_USER.email,

     

       505
       505
       -
       				TEST_USER.password,

     

       506
       506
       -
       			);

     

       507
       507
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       508
       508
       -
       				method: "POST",

     

       509
       509
       -
       				headers: { "Content-Type": "application/json" },

     

       510
       510
       -
       				body: JSON.stringify({

     

       511
       511
       -
       					email: TEST_USER.email,

     

       512
       512
       -
       					password: hashedPassword,

     

       513
       513
       -
       				}),

     

       514
       514
       -
       			});

     

       515
       515
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       516
       516
       -
       

     

       517
       517
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       518
       518
       -
       				method: "POST",

     

       519
       519
       -
       				headers: { "Content-Type": "application/json" },

     

       520
       520
       -
       				body: JSON.stringify({

     

       521
       521
       -
       					email: TEST_USER.email,

     

       522
       522
       -
       					password: hashedPassword,

     

       523
       523
       -
       				}),

     

       524
       524
       -
       			});

     

       525
       525
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       526
       526
       -
       

     

       527
       527
       -
       			// Get sessions list

     

       528
       528
       -
       			const sessionsResponse = await authRequest(

     

       529
       529
       -
       				`${BASE_URL}/api/sessions`,

     

       530
       530
       -
       				session1Cookie,

     

       531
       531
       -
       			);

     

       532
       532
       -
       			const sessionsData = await sessionsResponse.json();

     

       533
       533
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       534
       534
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       535
       535
       -
       			)?.id;

     

       536
       536
       -
       

     

       537
       537
       -
       			// Delete session 2

     

       538
       538
       -
       			const response = await authRequest(

     

       539
       539
       -
       				`${BASE_URL}/api/sessions`,

     

       540
       540
       -
       				session1Cookie,

     

       541
       541
       -
       				{

     

       542
       542
       -
       					method: "DELETE",

     

       543
       543
       -
       					headers: { "Content-Type": "application/json" },

     

       544
       544
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       545
       545
       -
       				},

     

       546
       546
       -
       			);

     

       547
       547
       -
       

     

       548
       548
       -
       			expect(response.status).toBe(200);

     

       549
       549
       -
       			const data = await response.json();

     

       550
       550
       -
       			expect(data.success).toBe(true);

     

       551
       551
       -
       

     

       552
       552
       -
       			// Verify session 2 is deleted

     

       553
       553
       -
       			const verifyResponse = await authRequest(

     

       554
       554
       -
       				`${BASE_URL}/api/auth/me`,

     

       555
       555
       -
       				session2Cookie,

     

       556
       556
       -
       			);

     

       557
       557
       -
       			expect(verifyResponse.status).toBe(401);

     

       558
       558
       -
       		});

     

       559
       559
       -
       

     

       560
       560
       -
       		serverTest("should not delete another user's session", async () => {

     

       561
       561
       -
       			// Register two users

     

       562
       562
       -
       			const hashedPassword1 = await clientHashPassword(

     

       563
       563
       -
       				TEST_USER.email,

     

       564
       564
       -
       				TEST_USER.password,

     

       565
       565
       -
       			);

     

       566
       566
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       567
       567
       -
       				method: "POST",

     

       568
       568
       -
       				headers: { "Content-Type": "application/json" },

     

       569
       569
       -
       				body: JSON.stringify({

     

       570
       570
       -
       					email: TEST_USER.email,

     

       571
       571
       -
       					password: hashedPassword1,

     

       572
       572
       -
       				}),

     

       573
       573
       -
       			});

     

       574
       574
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       575
       575
       -
       

     

       576
       576
       -
       			const hashedPassword2 = await clientHashPassword(

     

       577
       577
       -
       				TEST_USER_2.email,

     

       578
       578
       -
       				TEST_USER_2.password,

     

       579
       579
       -
       			);

     

       580
       580
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       581
       581
       -
       				method: "POST",

     

       582
       582
       -
       				headers: { "Content-Type": "application/json" },

     

       583
       583
       -
       				body: JSON.stringify({

     

       584
       584
       -
       					email: TEST_USER_2.email,

     

       585
       585
       -
       					password: hashedPassword2,

     

       586
       586
       -
       				}),

     

       587
       587
       -
       			});

     

       588
       588
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       589
       589
       -
       

     

       590
       590
       -
       			// Try to delete user2's session using user1's credentials

     

       591
       591
       -
       			const response = await authRequest(

     

       592
       592
       -
       				`${BASE_URL}/api/sessions`,

     

       593
       593
       -
       				user1Cookie,

     

       594
       594
       -
       				{

     

       595
       595
       -
       					method: "DELETE",

     

       596
       596
       -
       					headers: { "Content-Type": "application/json" },

     

       597
       597
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       598
       598
       -
       				},

     

       599
       599
       -
       			);

     

       600
       600
       -
       

     

       601
       601
       -
       			expect(response.status).toBe(404);

     

       602
       602
       -
       		});

     

       603
       603
       -
       

     

       604
       604
       -
       		serverTest("should not delete current session", async () => {

     

       605
       605
       -
       			// Register user

     

       606
       606
       -
       			const hashedPassword = await clientHashPassword(

     

       607
       607
       -
       				TEST_USER.email,

     

       608
       608
       -
       				TEST_USER.password,

     

       609
       609
       -
       			);

     

       610
       610
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       611
       611
       -
       				method: "POST",

     

       612
       612
       -
       				headers: { "Content-Type": "application/json" },

     

       613
       613
       -
       				body: JSON.stringify({

     

       614
       614
       -
       					email: TEST_USER.email,

     

       615
       615
       -
       					password: hashedPassword,

     

       616
       616
       -
       				}),

     

       617
       617
       -
       			});

     

       618
       618
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       402
       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       619
       403
        
       

     

       620
       404
        
       			// Try to delete own current session

     

       621
       405
        
       			const response = await authRequest(

     
···

       637
       421
        
       

     

       638
       422
        
       describe("API Endpoints - User Management", () => {

     

       639
       423
        
       	describe("DELETE /api/user", () => {

     

       640
       640
       -
       		serverTest("should delete user account", async () => {

     

       641
       641
       -
       			// Register user

     

       642
       642
       -
       			const hashedPassword = await clientHashPassword(

     

       643
       643
       -
       				TEST_USER.email,

     

       644
       644
       -
       				TEST_USER.password,

     

       645
       645
       -
       			);

     

       646
       646
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       647
       647
       -
       				method: "POST",

     

       648
       648
       -
       				headers: { "Content-Type": "application/json" },

     

       649
       649
       -
       				body: JSON.stringify({

     

       650
       650
       -
       					email: TEST_USER.email,

     

       651
       651
       -
       					password: hashedPassword,

     

       652
       652
       -
       				}),

     

       653
       653
       -
       			});

     

       654
       654
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       424
       424
       +
       		test("should delete user account", async () => {

     

       425
       425
       +
       			// Register and login

     

       426
       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       655
       427
        
       

     

       656
       428
        
       			// Delete account

     

       657
       429
        
       			const response = await authRequest(

     
···

       662
       434
        
       				},

     

       663
       435
        
       			);

     

       664
       436
        
       

     

       665
       665
       -
       			expect(response.status).toBe(200);

     

       666
       666
       -
       			const data = await response.json();

     

       667
       667
       -
       			expect(data.success).toBe(true);

     

       437
       437
       +
       			expect(response.status).toBe(204);

     

       668
       438
        
       

     

       669
       439
        
       			// Verify user is deleted

     

       670
       440
        
       			const verifyResponse = await authRequest(

     
···

       674
       444
        
       			expect(verifyResponse.status).toBe(401);

     

       675
       445
        
       		});

     

       676
       446
        
       

     

       677
       677
       -
       		serverTest("should require authentication", async () => {

     

       447
       447
       +
       		test("should require authentication", async () => {

     

       678
       448
        
       			const response = await fetch(`${BASE_URL}/api/user`, {

     

       679
       449
        
       				method: "DELETE",

     

       680
       450
        
       			});

     
···

       684
       454
        
       	});

     

       685
       455
        
       

     

       686
       456
        
       	describe("PUT /api/user/email", () => {

     

       687
       687
       -
       		serverTest("should update user email", async () => {

     

       688
       688
       -
       			// Register user

     

       689
       689
       -
       			const hashedPassword = await clientHashPassword(

     

       690
       690
       -
       				TEST_USER.email,

     

       691
       691
       -
       				TEST_USER.password,

     

       692
       692
       -
       			);

     

       693
       693
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       694
       694
       -
       				method: "POST",

     

       695
       695
       -
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       -
       				body: JSON.stringify({

     

       697
       697
       -
       					email: TEST_USER.email,

     

       698
       698
       -
       					password: hashedPassword,

     

       699
       699
       -
       				}),

     

       700
       700
       -
       			});

     

       701
       701
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       457
       457
       +
       		test("should update user email", async () => {

     

       458
       458
       +
       			// Register and login

     

       459
       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       702
       460
        
       

     

       703
       703
       -
       			// Update email

     

       461
       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       704
       462
        
       			const newEmail = "newemail@example.com";

     

       705
       463
        
       			const response = await authRequest(

     

       706
       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       716
       474
        
       			const data = await response.json();

     

       717
       475
        
       			expect(data.success).toBe(true);

     

       718
       476
        
       

     

       477
       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       479
       +
       			const tokenData = db

     

       480
       480
       +
       				.query(

     

       481
       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       482
       +
       				)

     

       483
       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       485
       +
       				tokenData.new_email,

     

       486
       486
       +
       				tokenData.user_id,

     

       487
       487
       +
       			]);

     

       488
       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       489
       +
       				tokenData.user_id,

     

       490
       490
       +
       			]);

     

       491
       491
       +
       			db.close();

     

       492
       492
       +
       

     

       719
       493
        
       			// Verify email updated

     

       720
       494
        
       			const meResponse = await authRequest(

     

       721
       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       725
       499
        
       			expect(meData.email).toBe(newEmail);

     

       726
       500
        
       		});

     

       727
       501
        
       

     

       728
       728
       -
       		serverTest("should reject duplicate email", async () => {

     

       502
       502
       +
       		test("should reject duplicate email", async () => {

     

       729
       503
        
       			// Register two users

     

       730
       730
       -
       			const hashedPassword1 = await clientHashPassword(

     

       731
       731
       -
       				TEST_USER.email,

     

       732
       732
       -
       				TEST_USER.password,

     

       733
       733
       -
       			);

     

       734
       734
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       735
       735
       -
       				method: "POST",

     

       736
       736
       -
       				headers: { "Content-Type": "application/json" },

     

       737
       737
       -
       				body: JSON.stringify({

     

       738
       738
       -
       					email: TEST_USER.email,

     

       739
       739
       -
       					password: hashedPassword1,

     

       740
       740
       -
       				}),

     

       741
       741
       -
       			});

     

       742
       742
       -
       

     

       743
       743
       -
       			const hashedPassword2 = await clientHashPassword(

     

       744
       744
       -
       				TEST_USER_2.email,

     

       745
       745
       -
       				TEST_USER_2.password,

     

       746
       746
       -
       			);

     

       747
       747
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       748
       748
       -
       				method: "POST",

     

       749
       749
       -
       				headers: { "Content-Type": "application/json" },

     

       750
       750
       -
       				body: JSON.stringify({

     

       751
       751
       -
       					email: TEST_USER_2.email,

     

       752
       752
       -
       					password: hashedPassword2,

     

       753
       753
       -
       				}),

     

       754
       754
       -
       			});

     

       755
       755
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       504
       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       756
       506
        
       

     

       757
       507
        
       			// Try to update user2's email to user1's email

     

       758
       508
        
       			const response = await authRequest(

     
···

       765
       515
        
       				},

     

       766
       516
        
       			);

     

       767
       517
        
       

     

       768
       768
       -
       			expect(response.status).toBe(400);

     

       518
       518
       +
       			expect(response.status).toBe(409);

     

       769
       519
        
       			const data = await response.json();

     

       770
       520
        
       			expect(data.error).toBe("Email already in use");

     

       771
       521
        
       		});

     

       772
       522
        
       	});

     

       773
       523
        
       

     

       774
       524
        
       	describe("PUT /api/user/password", () => {

     

       775
       775
       -
       		serverTest("should update user password", async () => {

     

       776
       776
       -
       			// Register user

     

       777
       777
       -
       			const hashedPassword = await clientHashPassword(

     

       778
       778
       -
       				TEST_USER.email,

     

       779
       779
       -
       				TEST_USER.password,

     

       780
       780
       -
       			);

     

       781
       781
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       782
       782
       -
       				method: "POST",

     

       783
       783
       -
       				headers: { "Content-Type": "application/json" },

     

       784
       784
       -
       				body: JSON.stringify({

     

       785
       785
       -
       					email: TEST_USER.email,

     

       786
       786
       -
       					password: hashedPassword,

     

       787
       787
       -
       				}),

     

       788
       788
       -
       			});

     

       789
       789
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       525
       525
       +
       		test("should update user password", async () => {

     

       526
       526
       +
       			// Register and login

     

       527
       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       790
       528
        
       

     

       791
       529
        
       			// Update password

     

       792
       530
        
       			const newPassword = await clientHashPassword(

     
···

       819
       557
        
       			expect(loginResponse.status).toBe(200);

     

       820
       558
        
       		});

     

       821
       559
        
       

     

       822
       822
       -
       		serverTest("should reject invalid password format", async () => {

     

       823
       823
       -
       			// Register user

     

       824
       824
       -
       			const hashedPassword = await clientHashPassword(

     

       825
       825
       -
       				TEST_USER.email,

     

       826
       826
       -
       				TEST_USER.password,

     

       827
       827
       -
       			);

     

       828
       828
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       829
       829
       -
       				method: "POST",

     

       830
       830
       -
       				headers: { "Content-Type": "application/json" },

     

       831
       831
       -
       				body: JSON.stringify({

     

       832
       832
       -
       					email: TEST_USER.email,

     

       833
       833
       -
       					password: hashedPassword,

     

       834
       834
       -
       				}),

     

       835
       835
       -
       			});

     

       836
       836
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       560
       560
       +
       		test("should reject invalid password format", async () => {

     

       561
       561
       +
       			// Register and login

     

       562
       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       837
       563
        
       

     

       838
       564
        
       			// Try to update with invalid format

     

       839
       565
        
       			const response = await authRequest(

     
···

       853
       579
        
       	});

     

       854
       580
        
       

     

       855
       581
        
       	describe("PUT /api/user/name", () => {

     

       856
       856
       -
       		serverTest("should update user name", async () => {

     

       857
       857
       -
       			// Register user

     

       858
       858
       -
       			const hashedPassword = await clientHashPassword(

     

       859
       859
       -
       				TEST_USER.email,

     

       860
       860
       -
       				TEST_USER.password,

     

       861
       861
       -
       			);

     

       862
       862
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       863
       863
       -
       				method: "POST",

     

       864
       864
       -
       				headers: { "Content-Type": "application/json" },

     

       865
       865
       -
       				body: JSON.stringify({

     

       866
       866
       -
       					email: TEST_USER.email,

     

       867
       867
       -
       					password: hashedPassword,

     

       868
       868
       -
       					name: TEST_USER.name,

     

       869
       869
       -
       				}),

     

       870
       870
       -
       			});

     

       871
       871
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       582
       582
       +
       		test("should update user name", async () => {

     

       583
       583
       +
       			// Register and login

     

       584
       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       872
       585
        
       

     

       873
       586
        
       			// Update name

     

       874
       587
        
       			const newName = "Updated Name";

     
···

       883
       596
        
       			);

     

       884
       597
        
       

     

       885
       598
        
       			expect(response.status).toBe(200);

     

       886
       886
       -
       			const data = await response.json();

     

       887
       887
       -
       			expect(data.success).toBe(true);

     

       888
       599
        
       

     

       889
       600
        
       			// Verify name updated

     

       890
       601
        
       			const meResponse = await authRequest(

     
···

       895
       606
        
       			expect(meData.name).toBe(newName);

     

       896
       607
        
       		});

     

       897
       608
        
       

     

       898
       898
       -
       		serverTest("should reject missing name", async () => {

     

       899
       899
       -
       			// Register user

     

       900
       900
       -
       			const hashedPassword = await clientHashPassword(

     

       901
       901
       -
       				TEST_USER.email,

     

       902
       902
       -
       				TEST_USER.password,

     

       903
       903
       -
       			);

     

       904
       904
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       905
       905
       -
       				method: "POST",

     

       906
       906
       -
       				headers: { "Content-Type": "application/json" },

     

       907
       907
       -
       				body: JSON.stringify({

     

       908
       908
       -
       					email: TEST_USER.email,

     

       909
       909
       -
       					password: hashedPassword,

     

       910
       910
       -
       				}),

     

       911
       911
       -
       			});

     

       912
       912
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       609
       609
       +
       		test("should reject missing name", async () => {

     

       610
       610
       +
       			// Register and login

     

       611
       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       913
       612
        
       

     

       914
       613
        
       			const response = await authRequest(

     

       915
       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       926
       625
        
       	});

     

       927
       626
        
       

     

       928
       627
        
       	describe("PUT /api/user/avatar", () => {

     

       929
       929
       -
       		serverTest("should update user avatar", async () => {

     

       930
       930
       -
       			// Register user

     

       931
       931
       -
       			const hashedPassword = await clientHashPassword(

     

       932
       932
       -
       				TEST_USER.email,

     

       933
       933
       -
       				TEST_USER.password,

     

       934
       934
       -
       			);

     

       935
       935
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       936
       936
       -
       				method: "POST",

     

       937
       937
       -
       				headers: { "Content-Type": "application/json" },

     

       938
       938
       -
       				body: JSON.stringify({

     

       939
       939
       -
       					email: TEST_USER.email,

     

       940
       940
       -
       					password: hashedPassword,

     

       941
       941
       -
       				}),

     

       942
       942
       -
       			});

     

       943
       943
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       628
       628
       +
       		test("should update user avatar", async () => {

     

       629
       629
       +
       			// Register and login

     

       630
       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       944
       631
        
       

     

       945
       632
        
       			// Update avatar

     

       946
       633
        
       			const newAvatar = "👨‍💻";

     
···

       969
       656
        
       	});

     

       970
       657
        
       });

     

       971
       658
        
       

     

       972
       972
       -
       describe("API Endpoints - Transcriptions", () => {

     

       973
       973
       -
       	describe("GET /api/transcriptions/health", () => {

     

       974
       974
       -
       		serverTest(

     

       975
       975
       -
       			"should return transcription service health status",

     

       976
       976
       -
       			async () => {

     

       977
       977
       -
       				const response = await fetch(`${BASE_URL}/api/transcriptions/health`);

     

       659
       659
       +
       describe("API Endpoints - Health", () => {

     

       660
       660
       +
       	describe("GET /api/health", () => {

     

       661
       661
       +
       		test("should return service health status with details", async () => {

     

       662
       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       978
       663
        
       

     

       979
       979
       -
       				expect(response.status).toBe(200);

     

       980
       980
       -
       				const data = await response.json();

     

       981
       981
       -
       				expect(data).toHaveProperty("available");

     

       982
       982
       -
       				expect(typeof data.available).toBe("boolean");

     

       983
       983
       -
       			},

     

       984
       984
       -
       		);

     

       664
       664
       +
       			expect(response.status).toBe(200);

     

       665
       665
       +
       			const data = await response.json();

     

       666
       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       672
       +
       		});

     

       985
       673
        
       	});

     

       674
       674
       +
       });

     

       986
       675
        
       

     

       676
       676
       +
       describe("API Endpoints - Transcriptions", () => {

     

       987
       677
        
       	describe("GET /api/transcriptions", () => {

     

       988
       988
       -
       		serverTest("should return user transcriptions", async () => {

     

       989
       989
       -
       			// Register user

     

       990
       990
       -
       			const hashedPassword = await clientHashPassword(

     

       991
       991
       -
       				TEST_USER.email,

     

       992
       992
       -
       				TEST_USER.password,

     

       993
       993
       -
       			);

     

       994
       994
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       995
       995
       -
       				method: "POST",

     

       996
       996
       -
       				headers: { "Content-Type": "application/json" },

     

       997
       997
       -
       				body: JSON.stringify({

     

       998
       998
       -
       					email: TEST_USER.email,

     

       999
       999
       -
       					password: hashedPassword,

     

       1000
       1000
       -
       				}),

     

       1001
       1001
       -
       			});

     

       1002
       1002
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       678
       678
       +
       		test("should return user transcriptions", async () => {

     

       679
       679
       +
       			// Register and login

     

       680
       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       681
       +
       

     

       682
       682
       +
       			// Add subscription

     

       683
       683
       +
       			addSubscription(TEST_USER.email);

     

       1003
       684
        
       

     

       1004
       685
        
       			// Get transcriptions

     

       1005
       686
        
       			const response = await authRequest(

     
···

       1013
       694
        
       			expect(Array.isArray(data.jobs)).toBe(true);

     

       1014
       695
        
       		});

     

       1015
       696
        
       

     

       1016
       1016
       -
       		serverTest("should require authentication", async () => {

     

       697
       697
       +
       		test("should require authentication", async () => {

     

       1017
       698
        
       			const response = await fetch(`${BASE_URL}/api/transcriptions`);

     

       1018
       699
        
       

     

       1019
       700
        
       			expect(response.status).toBe(401);

     
···

       1021
       702
        
       	});

     

       1022
       703
        
       

     

       1023
       704
        
       	describe("POST /api/transcriptions", () => {

     

       1024
       1024
       -
       		serverTest("should upload audio file and start transcription", async () => {

     

       1025
       1025
       -
       			// Register user

     

       1026
       1026
       -
       			const hashedPassword = await clientHashPassword(

     

       1027
       1027
       -
       				TEST_USER.email,

     

       1028
       1028
       -
       				TEST_USER.password,

     

       1029
       1029
       -
       			);

     

       1030
       1030
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1031
       1031
       -
       				method: "POST",

     

       1032
       1032
       -
       				headers: { "Content-Type": "application/json" },

     

       1033
       1033
       -
       				body: JSON.stringify({

     

       1034
       1034
       -
       					email: TEST_USER.email,

     

       1035
       1035
       -
       					password: hashedPassword,

     

       1036
       1036
       -
       				}),

     

       1037
       1037
       -
       			});

     

       1038
       1038
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       705
       705
       +
       		test("should upload audio file and start transcription", async () => {

     

       706
       706
       +
       			// Register and login

     

       707
       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       708
       +
       

     

       709
       709
       +
       			// Add subscription

     

       710
       710
       +
       			addSubscription(TEST_USER.email);

     

       1039
       711
        
       

     

       1040
       712
        
       			// Create a test audio file

     

       1041
       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1053
       725
        
       				},

     

       1054
       726
        
       			);

     

       1055
       727
        
       

     

       1056
       1056
       -
       			expect(response.status).toBe(200);

     

       728
       728
       +
       			expect(response.status).toBe(201);

     

       1057
       729
        
       			const data = await response.json();

     

       1058
       730
        
       			expect(data.id).toBeDefined();

     

       1059
       731
        
       			expect(data.message).toContain("Upload successful");

     

       1060
       732
        
       		});

     

       1061
       733
        
       

     

       1062
       1062
       -
       		serverTest("should reject non-audio files", async () => {

     

       1063
       1063
       -
       			// Register user

     

       1064
       1064
       -
       			const hashedPassword = await clientHashPassword(

     

       1065
       1065
       -
       				TEST_USER.email,

     

       1066
       1066
       -
       				TEST_USER.password,

     

       1067
       1067
       -
       			);

     

       1068
       1068
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1069
       1069
       -
       				method: "POST",

     

       1070
       1070
       -
       				headers: { "Content-Type": "application/json" },

     

       1071
       1071
       -
       				body: JSON.stringify({

     

       1072
       1072
       -
       					email: TEST_USER.email,

     

       1073
       1073
       -
       					password: hashedPassword,

     

       1074
       1074
       -
       				}),

     

       1075
       1075
       -
       			});

     

       1076
       1076
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       734
       734
       +
       		test("should reject non-audio files", async () => {

     

       735
       735
       +
       			// Register and login

     

       736
       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       737
       +
       

     

       738
       738
       +
       			// Add subscription

     

       739
       739
       +
       			addSubscription(TEST_USER.email);

     

       1077
       740
        
       

     

       1078
       741
        
       			// Try to upload non-audio file

     

       1079
       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1092
       755
        
       			expect(response.status).toBe(400);

     

       1093
       756
        
       		});

     

       1094
       757
        
       

     

       1095
       1095
       -
       		serverTest("should reject files exceeding size limit", async () => {

     

       1096
       1096
       -
       			// Register user

     

       1097
       1097
       -
       			const hashedPassword = await clientHashPassword(

     

       1098
       1098
       -
       				TEST_USER.email,

     

       1099
       1099
       -
       				TEST_USER.password,

     

       1100
       1100
       -
       			);

     

       1101
       1101
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1102
       1102
       -
       				method: "POST",

     

       1103
       1103
       -
       				headers: { "Content-Type": "application/json" },

     

       1104
       1104
       -
       				body: JSON.stringify({

     

       1105
       1105
       -
       					email: TEST_USER.email,

     

       1106
       1106
       -
       					password: hashedPassword,

     

       1107
       1107
       -
       				}),

     

       1108
       1108
       -
       			});

     

       1109
       1109
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       758
       758
       +
       		test("should reject files exceeding size limit", async () => {

     

       759
       759
       +
       			// Register and login

     

       760
       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       761
       +
       

     

       762
       762
       +
       			// Add subscription

     

       763
       763
       +
       			addSubscription(TEST_USER.email);

     

       1110
       764
        
       

     

       1111
       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       1112
       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1129
       783
        
       			expect(data.error).toContain("File size must be less than");

     

       1130
       784
        
       		});

     

       1131
       785
        
       

     

       1132
       1132
       -
       		serverTest("should require authentication", async () => {

     

       786
       786
       +
       		test("should require authentication", async () => {

     

       1133
       787
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     

       1134
       788
        
       			const formData = new FormData();

     

       1135
       789
        
       			formData.append("audio", audioBlob, "test.mp3");

     
···

       1150
       804
        
       	let userId: number;

     

       1151
       805
        
       

     

       1152
       806
        
       	beforeEach(async () => {

     

       1153
       1153
       -
       		if (!serverAvailable) return;

     

       1154
       1154
       -
       

     

       1155
       807
        
       		// Create admin user

     

       1156
       1156
       -
       		const adminHash = await clientHashPassword(

     

       1157
       1157
       -
       			TEST_ADMIN.email,

     

       1158
       1158
       -
       			TEST_ADMIN.password,

     

       1159
       1159
       -
       		);

     

       1160
       1160
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1161
       1161
       -
       			method: "POST",

     

       1162
       1162
       -
       			headers: { "Content-Type": "application/json" },

     

       1163
       1163
       -
       			body: JSON.stringify({

     

       1164
       1164
       -
       				email: TEST_ADMIN.email,

     

       1165
       1165
       -
       				password: adminHash,

     

       1166
       1166
       -
       				name: TEST_ADMIN.name,

     

       1167
       1167
       -
       			}),

     

       1168
       1168
       -
       		});

     

       1169
       1169
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       808
       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       1170
       809
        
       

     

       1171
       810
        
       		// Manually set admin role in database

     

       811
       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       1172
       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1173
       813
        
       			TEST_ADMIN.email,

     

       1174
       814
        
       		]);

     

       1175
       815
        
       

     

       1176
       816
        
       		// Create regular user

     

       1177
       1177
       -
       		const userHash = await clientHashPassword(

     

       1178
       1178
       -
       			TEST_USER.email,

     

       1179
       1179
       -
       			TEST_USER.password,

     

       1180
       1180
       -
       		);

     

       1181
       1181
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1182
       1182
       -
       			method: "POST",

     

       1183
       1183
       -
       			headers: { "Content-Type": "application/json" },

     

       1184
       1184
       -
       			body: JSON.stringify({

     

       1185
       1185
       -
       				email: TEST_USER.email,

     

       1186
       1186
       -
       				password: userHash,

     

       1187
       1187
       -
       				name: TEST_USER.name,

     

       1188
       1188
       -
       			}),

     

       1189
       1189
       -
       		});

     

       1190
       1190
       -
       		userCookie = extractSessionCookie(userResponse);

     

       817
       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       1191
       818
        
       

     

       1192
       819
        
       		// Get user ID

     

       1193
       820
        
       		const userIdResult = db

     

       1194
       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1195
       822
        
       			.get(TEST_USER.email);

     

       1196
       823
        
       		userId = userIdResult?.id;

     

       824
       824
       +
       

     

       825
       825
       +
       		db.close();

     

       1197
       826
        
       	});

     

       1198
       827
        
       

     

       1199
       828
        
       	describe("GET /api/admin/users", () => {

     

       1200
       1200
       -
       		serverTest("should return all users for admin", async () => {

     

       829
       829
       +
       		test("should return all users for admin", async () => {

     

       1201
       830
        
       			const response = await authRequest(

     

       1202
       831
        
       				`${BASE_URL}/api/admin/users`,

     

       1203
       832
        
       				adminCookie,

     
···

       1209
       838
        
       			expect(data.length).toBeGreaterThan(0);

     

       1210
       839
        
       		});

     

       1211
       840
        
       

     

       1212
       1212
       -
       		serverTest("should reject non-admin users", async () => {

     

       841
       841
       +
       		test("should reject non-admin users", async () => {

     

       1213
       842
        
       			const response = await authRequest(

     

       1214
       843
        
       				`${BASE_URL}/api/admin/users`,

     

       1215
       844
        
       				userCookie,

     
···

       1218
       847
        
       			expect(response.status).toBe(403);

     

       1219
       848
        
       		});

     

       1220
       849
        
       

     

       1221
       1221
       -
       		serverTest("should require authentication", async () => {

     

       850
       850
       +
       		test("should require authentication", async () => {

     

       1222
       851
        
       			const response = await fetch(`${BASE_URL}/api/admin/users`);

     

       1223
       852
        
       

     

       1224
       853
        
       			expect(response.status).toBe(401);

     
···

       1226
       855
        
       	});

     

       1227
       856
        
       

     

       1228
       857
        
       	describe("GET /api/admin/transcriptions", () => {

     

       1229
       1229
       -
       		serverTest("should return all transcriptions for admin", async () => {

     

       858
       858
       +
       		test("should return all transcriptions for admin", async () => {

     

       1230
       859
        
       			const response = await authRequest(

     

       1231
       860
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1232
       861
        
       				adminCookie,

     
···

       1237
       866
        
       			expect(Array.isArray(data)).toBe(true);

     

       1238
       867
        
       		});

     

       1239
       868
        
       

     

       1240
       1240
       -
       		serverTest("should reject non-admin users", async () => {

     

       869
       869
       +
       		test("should reject non-admin users", async () => {

     

       1241
       870
        
       			const response = await authRequest(

     

       1242
       871
        
       				`${BASE_URL}/api/admin/transcriptions`,

     

       1243
       872
        
       				userCookie,

     
···

       1248
       877
        
       	});

     

       1249
       878
        
       

     

       1250
       879
        
       	describe("DELETE /api/admin/users/:id", () => {

     

       1251
       1251
       -
       		serverTest("should delete user as admin", async () => {

     

       880
       880
       +
       		test("should delete user as admin", async () => {

     

       1252
       881
        
       			const response = await authRequest(

     

       1253
       882
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1254
       883
        
       				adminCookie,

     
···

       1257
       886
        
       				},

     

       1258
       887
        
       			);

     

       1259
       888
        
       

     

       1260
       1260
       -
       			expect(response.status).toBe(200);

     

       1261
       1261
       -
       			const data = await response.json();

     

       1262
       1262
       -
       			expect(data.success).toBe(true);

     

       889
       889
       +
       			expect(response.status).toBe(204);

     

       1263
       890
        
       

     

       1264
       891
        
       			// Verify user is deleted

     

       1265
       892
        
       			const verifyResponse = await authRequest(

     
···

       1269
       896
        
       			expect(verifyResponse.status).toBe(401);

     

       1270
       897
        
       		});

     

       1271
       898
        
       

     

       1272
       1272
       -
       		serverTest("should reject non-admin users", async () => {

     

       899
       899
       +
       		test("should reject non-admin users", async () => {

     

       1273
       900
        
       			const response = await authRequest(

     

       1274
       901
        
       				`${BASE_URL}/api/admin/users/${userId}`,

     

       1275
       902
        
       				userCookie,

     
···

       1283
       910
        
       	});

     

       1284
       911
        
       

     

       1285
       912
        
       	describe("PUT /api/admin/users/:id/role", () => {

     

       1286
       1286
       -
       		serverTest("should update user role as admin", async () => {

     

       913
       913
       +
       		test("should update user role as admin", async () => {

     

       1287
       914
        
       			const response = await authRequest(

     

       1288
       915
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1289
       916
        
       				adminCookie,

     
···

       1295
       922
        
       			);

     

       1296
       923
        
       

     

       1297
       924
        
       			expect(response.status).toBe(200);

     

       1298
       1298
       -
       			const data = await response.json();

     

       1299
       1299
       -
       			expect(data.success).toBe(true);

     

       1300
       925
        
       

     

       1301
       926
        
       			// Verify role updated

     

       1302
       927
        
       			const meResponse = await authRequest(

     
···

       1307
       932
        
       			expect(meData.role).toBe("admin");

     

       1308
       933
        
       		});

     

       1309
       934
        
       

     

       1310
       1310
       -
       		serverTest("should reject invalid roles", async () => {

     

       935
       935
       +
       		test("should reject invalid roles", async () => {

     

       1311
       936
        
       			const response = await authRequest(

     

       1312
       937
        
       				`${BASE_URL}/api/admin/users/${userId}/role`,

     

       1313
       938
        
       				adminCookie,

     
···

       1323
       948
        
       	});

     

       1324
       949
        
       

     

       1325
       950
        
       	describe("GET /api/admin/users/:id/details", () => {

     

       1326
       1326
       -
       		serverTest("should return user details for admin", async () => {

     

       951
       951
       +
       		test("should return user details for admin", async () => {

     

       1327
       952
        
       			const response = await authRequest(

     

       1328
       953
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1329
       954
        
       				adminCookie,

     
···

       1337
       962
        
       			expect(data).toHaveProperty("sessions");

     

       1338
       963
        
       		});

     

       1339
       964
        
       

     

       1340
       1340
       -
       		serverTest("should reject non-admin users", async () => {

     

       965
       965
       +
       		test("should reject non-admin users", async () => {

     

       1341
       966
        
       			const response = await authRequest(

     

       1342
       967
        
       				`${BASE_URL}/api/admin/users/${userId}/details`,

     

       1343
       968
        
       				userCookie,

     
···

       1348
       973
        
       	});

     

       1349
       974
        
       

     

       1350
       975
        
       	describe("PUT /api/admin/users/:id/name", () => {

     

       1351
       1351
       -
       		serverTest("should update user name as admin", async () => {

     

       976
       976
       +
       		test("should update user name as admin", async () => {

     

       1352
       977
        
       			const newName = "Admin Updated Name";

     

       1353
       978
        
       			const response = await authRequest(

     

       1354
       979
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     
···

       1365
       990
        
       			expect(data.success).toBe(true);

     

       1366
       991
        
       		});

     

       1367
       992
        
       

     

       1368
       1368
       -
       		serverTest("should reject empty names", async () => {

     

       993
       993
       +
       		test("should reject empty names", async () => {

     

       1369
       994
        
       			const response = await authRequest(

     

       1370
       995
        
       				`${BASE_URL}/api/admin/users/${userId}/name`,

     

       1371
       996
        
       				adminCookie,

     
···

       1381
       1006
        
       	});

     

       1382
       1007
        
       

     

       1383
       1008
        
       	describe("PUT /api/admin/users/:id/email", () => {

     

       1384
       1384
       -
       		serverTest("should update user email as admin", async () => {

     

       1009
       1009
       +
       		test("should update user email as admin", async () => {

     

       1385
       1010
        
       			const newEmail = "newemail@admin.com";

     

       1386
       1011
        
       			const response = await authRequest(

     

       1387
       1012
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     
···

       1398
       1023
        
       			expect(data.success).toBe(true);

     

       1399
       1024
        
       		});

     

       1400
       1025
        
       

     

       1401
       1401
       -
       		serverTest("should reject duplicate emails", async () => {

     

       1026
       1026
       +
       		test("should reject duplicate emails", async () => {

     

       1402
       1027
        
       			const response = await authRequest(

     

       1403
       1028
        
       				`${BASE_URL}/api/admin/users/${userId}/email`,

     

       1404
       1029
        
       				adminCookie,

     
···

       1409
       1034
        
       				},

     

       1410
       1035
        
       			);

     

       1411
       1036
        
       

     

       1412
       1412
       -
       			expect(response.status).toBe(400);

     

       1037
       1037
       +
       			expect(response.status).toBe(409);

     

       1413
       1038
        
       			const data = await response.json();

     

       1414
       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1415
       1040
        
       		});

     

       1416
       1041
        
       	});

     

       1417
       1042
        
       

     

       1418
       1043
        
       	describe("GET /api/admin/users/:id/sessions", () => {

     

       1419
       1419
       -
       		serverTest("should return user sessions as admin", async () => {

     

       1044
       1044
       +
       		test("should return user sessions as admin", async () => {

     

       1420
       1045
        
       			const response = await authRequest(

     

       1421
       1046
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1422
       1047
        
       				adminCookie,

     
···

       1429
       1054
        
       	});

     

       1430
       1055
        
       

     

       1431
       1056
        
       	describe("DELETE /api/admin/users/:id/sessions", () => {

     

       1432
       1432
       -
       		serverTest("should delete all user sessions as admin", async () => {

     

       1057
       1057
       +
       		test("should delete all user sessions as admin", async () => {

     

       1433
       1058
        
       			const response = await authRequest(

     

       1434
       1059
        
       				`${BASE_URL}/api/admin/users/${userId}/sessions`,

     

       1435
       1060
        
       				adminCookie,

     
···

       1438
       1063
        
       				},

     

       1439
       1064
        
       			);

     

       1440
       1065
        
       

     

       1441
       1441
       -
       			expect(response.status).toBe(200);

     

       1442
       1442
       -
       			const data = await response.json();

     

       1443
       1443
       -
       			expect(data.success).toBe(true);

     

       1066
       1066
       +
       			expect(response.status).toBe(204);

     

       1444
       1067
        
       

     

       1445
       1068
        
       			// Verify sessions are deleted

     

       1446
       1069
        
       			const verifyResponse = await authRequest(

     
···

       1456
       1079
        
       	let sessionCookie: string;

     

       1457
       1080
        
       

     

       1458
       1081
        
       	beforeEach(async () => {

     

       1459
       1459
       -
       		if (!serverAvailable) return;

     

       1460
       1460
       -
       

     

       1461
       1461
       -
       		// Register user

     

       1462
       1462
       -
       		const hashedPassword = await clientHashPassword(

     

       1463
       1463
       -
       			TEST_USER.email,

     

       1464
       1464
       -
       			TEST_USER.password,

     

       1465
       1465
       -
       		);

     

       1466
       1466
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1467
       1467
       -
       			method: "POST",

     

       1468
       1468
       -
       			headers: { "Content-Type": "application/json" },

     

       1469
       1469
       -
       			body: JSON.stringify({

     

       1470
       1470
       -
       				email: TEST_USER.email,

     

       1471
       1471
       -
       				password: hashedPassword,

     

       1472
       1472
       -
       			}),

     

       1473
       1473
       -
       		});

     

       1474
       1474
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1082
       1082
       +
       		// Register and login

     

       1083
       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       1475
       1084
        
       	});

     

       1476
       1085
        
       

     

       1477
       1086
        
       	describe("GET /api/passkeys", () => {

     

       1478
       1478
       -
       		serverTest("should return user passkeys", async () => {

     

       1087
       1087
       +
       		test("should return user passkeys", async () => {

     

       1479
       1088
        
       			const response = await authRequest(

     

       1480
       1089
        
       				`${BASE_URL}/api/passkeys`,

     

       1481
       1090
        
       				sessionCookie,

     
···

       1487
       1096
        
       			expect(Array.isArray(data.passkeys)).toBe(true);

     

       1488
       1097
        
       		});

     

       1489
       1098
        
       

     

       1490
       1490
       -
       		serverTest("should require authentication", async () => {

     

       1099
       1099
       +
       		test("should require authentication", async () => {

     

       1491
       1100
        
       			const response = await fetch(`${BASE_URL}/api/passkeys`);

     

       1492
       1101
        
       

     

       1493
       1102
        
       			expect(response.status).toBe(401);

     
···

       1495
       1104
        
       	});

     

       1496
       1105
        
       

     

       1497
       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1498
       1498
       -
       		serverTest(

     

       1499
       1499
       -
       			"should return registration options for authenticated user",

     

       1500
       1500
       -
       			async () => {

     

       1501
       1501
       -
       				const response = await authRequest(

     

       1502
       1502
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1503
       1503
       -
       					sessionCookie,

     

       1504
       1504
       -
       					{

     

       1505
       1505
       -
       						method: "POST",

     

       1506
       1506
       -
       					},

     

       1507
       1507
       -
       				);

     

       1107
       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       1108
       +
       			const response = await authRequest(

     

       1109
       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       1110
       +
       				sessionCookie,

     

       1111
       1111
       +
       				{

     

       1112
       1112
       +
       					method: "POST",

     

       1113
       1113
       +
       				},

     

       1114
       1114
       +
       			);

     

       1508
       1115
        
       

     

       1509
       1509
       -
       				expect(response.status).toBe(200);

     

       1510
       1510
       -
       				const data = await response.json();

     

       1511
       1511
       -
       				expect(data).toHaveProperty("challenge");

     

       1512
       1512
       -
       				expect(data).toHaveProperty("rp");

     

       1513
       1513
       -
       				expect(data).toHaveProperty("user");

     

       1514
       1514
       -
       			},

     

       1515
       1515
       -
       		);

     

       1116
       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       1117
       +
       			const data = await response.json();

     

       1118
       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       1121
       +
       		});

     

       1516
       1122
        
       

     

       1517
       1517
       -
       		serverTest("should require authentication", async () => {

     

       1123
       1123
       +
       		test("should require authentication", async () => {

     

       1518
       1124
        
       			const response = await fetch(

     

       1519
       1125
        
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1520
       1126
        
       				{

     
···

       1527
       1133
        
       	});

     

       1528
       1134
        
       

     

       1529
       1135
        
       	describe("POST /api/passkeys/authenticate/options", () => {

     

       1530
       1530
       -
       		serverTest("should return authentication options for email", async () => {

     

       1136
       1136
       +
       		test("should return authentication options for email", async () => {

     

       1531
       1137
        
       			const response = await fetch(

     

       1532
       1138
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1533
       1139
        
       				{

     
···

       1542
       1148
        
       			expect(data).toHaveProperty("challenge");

     

       1543
       1149
        
       		});

     

       1544
       1150
        
       

     

       1545
       1545
       -
       		serverTest("should handle non-existent email", async () => {

     

       1151
       1151
       +
       		test("should handle non-existent email", async () => {

     

       1546
       1152
        
       			const response = await fetch(

     

       1547
       1153
        
       				`${BASE_URL}/api/passkeys/authenticate/options`,

     

       1548
       1154
        
       				{

+1980 -424

src/index.ts

···

       2
       2
        
       import {

     

       3
       3
        
       	authenticateUser,

     

       4
       4
        
       	cleanupExpiredSessions,

     

       5
       5
       +
       	consumeEmailChangeToken,

     

       6
       6
       +
       	consumePasswordResetToken,

     

       7
       7
       +
       	createEmailChangeToken,

     

       8
       8
       +
       	createEmailVerificationToken,

     

       9
       9
       +
       	createPasswordResetToken,

     

       5
       10
        
       	createSession,

     

       6
       11
        
       	createUser,

     

       7
       12
        
       	deleteAllUserSessions,

     
···

       17
       22
        
       	getUserByEmail,

     

       18
       23
        
       	getUserBySession,

     

       19
       24
        
       	getUserSessionsForUser,

     

       25
       25
       +
       	getVerificationCodeSentAt,

     

       26
       26
       +
       	isEmailVerified,

     

       20
       27
        
       	type UserRole,

     

       21
       28
        
       	updateUserAvatar,

     

       22
       29
        
       	updateUserEmail,

     
···

       24
       31
        
       	updateUserName,

     

       25
       32
        
       	updateUserPassword,

     

       26
       33
        
       	updateUserRole,

     

       34
       34
       +
       	verifyEmailChangeToken,

     

       35
       35
       +
       	verifyEmailCode,

     

       36
       36
       +
       	verifyEmailToken,

     

       37
       37
       +
       	verifyPasswordResetToken,

     

       27
       38
        
       } from "./lib/auth";

     

       28
       39
        
       import {

     

       29
       40
        
       	addToWaitlist,

     
···

       37
       48
        
       	getClassById,

     

       38
       49
        
       	getClassesForUser,

     

       39
       50
        
       	getClassMembers,

     

       51
       51
       +
       	getClassSections,

     

       52
       52
       +
       	getMeetingById,

     

       40
       53
        
       	getMeetingTimesForClass,

     

       41
       54
        
       	getTranscriptionsForClass,

     

       55
       55
       +
       	getUserSection,

     

       42
       56
        
       	isUserEnrolledInClass,

     

       43
       57
        
       	joinClass,

     

       44
       58
        
       	removeUserFromClass,

     

       45
       59
        
       	searchClassesByCourseCode,

     

       46
       60
        
       	toggleClassArchive,

     

       47
       61
        
       	updateMeetingTime,

     

       62
       62
       +
       	createClassSection,

     

       48
       63
        
       } from "./lib/classes";

     

       64
       64
       +
       import { sendEmail } from "./lib/email";

     

       65
       65
       +
       import {

     

       66
       66
       +
       	emailChangeTemplate,

     

       67
       67
       +
       	passwordResetTemplate,

     

       68
       68
       +
       	verifyEmailTemplate,

     

       69
       69
       +
       } from "./lib/email-templates";

     

       49
       70
        
       import { AuthErrors, handleError, ValidationErrors } from "./lib/errors";

     

       50
       71
        
       import {

     

       51
       72
        
       	hasActiveSubscription,

     
···

       62
       83
        
       	verifyAndAuthenticatePasskey,

     

       63
       84
        
       	verifyAndCreatePasskey,

     

       64
       85
        
       } from "./lib/passkey";

     

       65
       65
       -
       import { enforceRateLimit } from "./lib/rate-limit";

     

       86
       86
       +
       import { clearRateLimit, enforceRateLimit } from "./lib/rate-limit";

     

       66
       87
        
       import { getTranscriptVTT } from "./lib/transcript-storage";

     

       67
       88
        
       import {

     

       68
       89
        
       	MAX_FILE_SIZE,

     
···

       70
       91
        
       	type TranscriptionUpdate,

     

       71
       92
        
       	WhisperServiceManager,

     

       72
       93
        
       } from "./lib/transcription";

     

       94
       94
       +
       import {

     

       95
       95
       +
       	findMatchingMeetingTime,

     

       96
       96
       +
       	getDayName,

     

       97
       97
       +
       } from "./lib/audio-metadata";

     

       98
       98
       +
       import {

     

       99
       99
       +
       	checkAutoSubmit,

     

       100
       100
       +
       	deletePendingRecording,

     

       101
       101
       +
       	getEnrolledUserCount,

     

       102
       102
       +
       	getPendingRecordings,

     

       103
       103
       +
       	getUserVoteForMeeting,

     

       104
       104
       +
       	markAsAutoSubmitted,

     

       105
       105
       +
       	removeVote,

     

       106
       106
       +
       	voteForRecording,

     

       107
       107
       +
       } from "./lib/voting";

     

       108
       108
       +
       import {

     

       109
       109
       +
       	validateClassId,

     

       110
       110
       +
       	validateCourseCode,

     

       111
       111
       +
       	validateCourseName,

     

       112
       112
       +
       	validateEmail,

     

       113
       113
       +
       	validateName,

     

       114
       114
       +
       	validatePasswordHash,

     

       115
       115
       +
       	validateSemester,

     

       116
       116
       +
       	validateYear,

     

       117
       117
       +
       } from "./lib/validation";

     

       73
       118
        
       import adminHTML from "./pages/admin.html";

     

       74
       119
        
       import checkoutHTML from "./pages/checkout.html";

     

       75
       120
        
       import classHTML from "./pages/class.html";

     

       76
       121
        
       import classesHTML from "./pages/classes.html";

     

       77
       122
        
       import indexHTML from "./pages/index.html";

     

       123
       123
       +
       import resetPasswordHTML from "./pages/reset-password.html";

     

       78
       124
        
       import settingsHTML from "./pages/settings.html";

     

       79
       125
        
       import transcribeHTML from "./pages/transcribe.html";

     

       80
       126
        
       

     

       127
       127
       +
       // Validate required environment variables at startup

     

       128
       128
       +
       function validateEnvVars() {

     

       129
       129
       +
       	const required = [

     

       130
       130
       +
       		"POLAR_ORGANIZATION_ID",

     

       131
       131
       +
       		"POLAR_PRODUCT_ID",

     

       132
       132
       +
       		"POLAR_SUCCESS_URL",

     

       133
       133
       +
       		"POLAR_WEBHOOK_SECRET",

     

       134
       134
       +
       		"MAILCHANNELS_API_KEY",

     

       135
       135
       +
       		"DKIM_PRIVATE_KEY",

     

       136
       136
       +
       		"LLM_API_KEY",

     

       137
       137
       +
       		"LLM_API_BASE_URL",

     

       138
       138
       +
       		"LLM_MODEL",

     

       139
       139
       +
       	];

     

       140
       140
       +
       

     

       141
       141
       +
       	const missing = required.filter((key) => !process.env[key]);

     

       142
       142
       +
       

     

       143
       143
       +
       	if (missing.length > 0) {

     

       144
       144
       +
       		console.error(

     

       145
       145
       +
       			`[Startup] Missing required environment variables: ${missing.join(", ")}`,

     

       146
       146
       +
       		);

     

       147
       147
       +
       		console.error("[Startup] Please check your .env file");

     

       148
       148
       +
       		process.exit(1);

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	// Validate ORIGIN is set for production

     

       152
       152
       +
       	if (!process.env.ORIGIN) {

     

       153
       153
       +
       		console.warn(

     

       154
       154
       +
       			"[Startup] ORIGIN not set, defaulting to http://localhost:3000",

     

       155
       155
       +
       		);

     

       156
       156
       +
       		console.warn("[Startup] Set ORIGIN in production for correct email links");

     

       157
       157
       +
       	}

     

       158
       158
       +
       

     

       159
       159
       +
       	console.log("[Startup] Environment variable validation passed");

     

       160
       160
       +
       }

     

       161
       161
       +
       

     

       162
       162
       +
       validateEnvVars();

     

       163
       163
       +
       

     

       81
       164
        
       // Environment variables

     

       82
       165
        
       const WHISPER_SERVICE_URL =

     

       83
       166
        
       	process.env.WHISPER_SERVICE_URL || "http://localhost:8000";

     
···

       97
       180
        
       	transcriptionEvents,

     

       98
       181
        
       );

     

       99
       182
        
       

     

       100
       100
       -
       // Clean up expired sessions every hour

     

       101
       101
       -
       setInterval(cleanupExpiredSessions, 60 * 60 * 1000);

     

       183
       183
       +
       // Clean up expired sessions every 15 minutes

     

       184
       184
       +
       const sessionCleanupInterval = setInterval(

     

       185
       185
       +
       	cleanupExpiredSessions,

     

       186
       186
       +
       	15 * 60 * 1000,

     

       187
       187
       +
       );

     

       102
       188
        
       

     

       103
       189
        
       // Helper function to sync user subscriptions from Polar

     

       104
       190
        
       async function syncUserSubscriptionsFromPolar(

     

       105
       191
        
       	userId: number,

     

       106
       192
        
       	email: string,

     

       107
       193
        
       ): Promise<void> {

     

       194
       194
       +
       	// Skip Polar sync in test mode

     

       195
       195
       +
       	if (

     

       196
       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       198
       +
       	) {

     

       199
       199
       +
       		return;

     

       200
       200
       +
       	}

     

       201
       201
       +
       

     

       108
       202
        
       	try {

     

       109
       203
        
       		const { polar } = await import("./lib/polar");

     

       110
       204
        
       

     

       111
       111
       -
       		// Search for customer by email

     

       205
       205
       +
       		// Search for customer by email (validated at startup)

     

       112
       206
        
       		const customers = await polar.customers.list({

     

       113
       113
       -
       			organizationId: process.env.POLAR_ORGANIZATION_ID,

     

       207
       207
       +
       			organizationId: process.env.POLAR_ORGANIZATION_ID as string,

     

       114
       208
        
       			query: email,

     

       115
       209
        
       		});

     

       116
       210
        
       

     
···

       126
       220
        
       			customerId: customer.id,

     

       127
       221
        
       		});

     

       128
       222
        
       

     

       129
       129
       -
       		if (!subscriptions.result.items || subscriptions.result.items.length === 0) {

     

       223
       223
       +
       		if (

     

       224
       224
       +
       			!subscriptions.result.items ||

     

       225
       225
       +
       			subscriptions.result.items.length === 0

     

       226
       226
       +
       		) {

     

       130
       227
        
       			console.log(`[Sync] No subscriptions found for customer ${customer.id}`);

     

       131
       228
        
       			return;

     

       132
       229
        
       		}

     

       133
       230
        
       

     

       134
       134
       -
       		// Update each subscription in the database

     

       135
       135
       -
       		for (const subscription of subscriptions.result.items) {

     

       231
       231
       +
       		// Filter to only active/trialing/past_due subscriptions (not canceled/expired)

     

       232
       232
       +
       		const currentSubscriptions = subscriptions.result.items.filter(

     

       233
       233
       +
       			(sub) =>

     

       234
       234
       +
       				sub.status === "active" ||

     

       235
       235
       +
       				sub.status === "trialing" ||

     

       236
       236
       +
       				sub.status === "past_due",

     

       237
       237
       +
       		);

     

       238
       238
       +
       

     

       239
       239
       +
       		if (currentSubscriptions.length === 0) {

     

       240
       240
       +
       			console.log(

     

       241
       241
       +
       				`[Sync] No current subscriptions found for customer ${customer.id}`,

     

       242
       242
       +
       			);

     

       243
       243
       +
       			return;

     

       244
       244
       +
       		}

     

       245
       245
       +
       

     

       246
       246
       +
       		// Update each current subscription in the database

     

       247
       247
       +
       		for (const subscription of currentSubscriptions) {

     

       136
       248
        
       			db.run(

     

       137
       249
        
       				`INSERT INTO subscriptions (id, user_id, customer_id, status, current_period_start, current_period_end, cancel_at_period_end, canceled_at, updated_at)

     

       138
       250
        
       				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

     
···

       169
       281
        
       		}

     

       170
       282
        
       

     

       171
       283
        
       		console.log(

     

       172
       172
       -
       			`[Sync] Linked ${subscriptions.result.items.length} subscription(s) to user ${userId} (${email})`,

     

       284
       284
       +
       			`[Sync] Linked ${currentSubscriptions.length} current subscription(s) to user ${userId} (${email})`,

     

       173
       285
        
       		);

     

       174
       286
        
       	} catch (error) {

     

       175
       287
        
       		console.error(

     
···

       179
       291
        
       		// Don't throw - registration should succeed even if sync fails

     

       180
       292
        
       	}

     

       181
       293
        
       }

     

       182
       182
       -
       

     

       183
       294
        
       

     

       184
       295
        
       // Sync with Whisper DB on startup

     

       185
       296
        
       try {

     
···

       193
       304
        
       }

     

       194
       305
        
       

     

       195
       306
        
       // Periodic sync every 5 minutes as backup (SSE handles real-time updates)

     

       196
       196
       -
       setInterval(

     

       307
       307
       +
       const syncInterval = setInterval(

     

       197
       308
        
       	async () => {

     

       198
       309
        
       		try {

     

       199
       310
        
       			await whisperService.syncWithWhisper();

     
···

       207
       318
        
       	5 * 60 * 1000,

     

       208
       319
        
       );

     

       209
       320
        
       

     

       210
       210
       -
       // Clean up stale files daily

     

       211
       211
       -
       setInterval(() => whisperService.cleanupStaleFiles(), 24 * 60 * 60 * 1000);

     

       321
       321
       +
       // Clean up stale files hourly

     

       322
       322
       +
       const fileCleanupInterval = setInterval(

     

       323
       323
       +
       	() => whisperService.cleanupStaleFiles(),

     

       324
       324
       +
       	60 * 60 * 1000, // 1 hour

     

       325
       325
       +
       );

     

       212
       326
        
       

     

       213
       327
        
       const server = Bun.serve({

     

       214
       214
       -
       	port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000,

     

       328
       328
       +
       	port:

     

       329
       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       330
       +
       			? 3001

     

       331
       331
       +
       			: process.env.PORT

     

       332
       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       333
       +
       				: 3000,

     

       215
       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       216
       335
        
       	routes: {

     

       217
       336
        
       		"/": indexHTML,

     

       218
       337
        
       		"/admin": adminHTML,

     

       219
       338
        
       		"/checkout": checkoutHTML,

     

       220
       339
        
       		"/settings": settingsHTML,

     

       340
       340
       +
       		"/reset-password": resetPasswordHTML,

     

       221
       341
        
       		"/transcribe": transcribeHTML,

     

       222
       342
        
       		"/classes": classesHTML,

     

       223
       343
        
       		"/classes/*": classHTML,

     
···

       231
       351
        
       				try {

     

       232
       352
        
       					// Rate limiting

     

       233
       353
        
       					const rateLimitError = enforceRateLimit(req, "register", {

     

       234
       234
       -
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       354
       354
       +
       						ip: { max: 5, windowSeconds: 30 * 60 },

     

       235
       355
        
       					});

     

       236
       356
        
       					if (rateLimitError) return rateLimitError;

     

       237
       357
        
       

     
···

       243
       363
        
       							{ status: 400 },

     

       244
       364
        
       						);

     

       245
       365
        
       					}

     

       246
       246
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       247
       247
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       366
       366
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       367
       367
       +
       					const passwordValidation = validatePasswordHash(password);

     

       368
       368
       +
       					if (!passwordValidation.valid) {

     

       248
       369
        
       						return Response.json(

     

       249
       249
       -
       							{ error: "Invalid password format" },

     

       370
       370
       +
       							{ error: passwordValidation.error },

     

       250
       371
        
       							{ status: 400 },

     

       251
       372
        
       						);

     

       252
       373
        
       					}

     

       253
       374
        
       					const user = await createUser(email, password, name);

     

       254
       254
       -
       					

     

       255
       255
       -
       					// Attempt to sync existing Polar subscriptions

     

       375
       375
       +
       

     

       376
       376
       +
       					// Send verification email - MUST succeed for registration to complete

     

       377
       377
       +
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       378
       378
       +
       

     

       379
       379
       +
       					try {

     

       380
       380
       +
       						await sendEmail({

     

       381
       381
       +
       							to: user.email,

     

       382
       382
       +
       							subject: "Verify your email - Thistle",

     

       383
       383
       +
       							html: verifyEmailTemplate({

     

       384
       384
       +
       								name: user.name,

     

       385
       385
       +
       								code,

     

       386
       386
       +
       								token,

     

       387
       387
       +
       							}),

     

       388
       388
       +
       						});

     

       389
       389
       +
       					} catch (err) {

     

       390
       390
       +
       						console.error("[Email] Failed to send verification email:", err);

     

       391
       391
       +
       						// Rollback user creation - direct DB delete since user was just created

     

       392
       392
       +
       						db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [

     

       393
       393
       +
       							user.id,

     

       394
       394
       +
       						]);

     

       395
       395
       +
       						db.run("DELETE FROM sessions WHERE user_id = ?", [user.id]);

     

       396
       396
       +
       						db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       397
       397
       +
       						return Response.json(

     

       398
       398
       +
       							{

     

       399
       399
       +
       								error:

     

       400
       400
       +
       									"Failed to send verification email. Please try again later.",

     

       401
       401
       +
       							},

     

       402
       402
       +
       							{ status: 500 },

     

       403
       403
       +
       						);

     

       404
       404
       +
       					}

     

       405
       405
       +
       

     

       406
       406
       +
       					// Attempt to sync existing Polar subscriptions (after email succeeds)

     

       256
       407
        
       					syncUserSubscriptionsFromPolar(user.id, user.email).catch(() => {

     

       257
       408
        
       						// Silent fail - don't block registration

     

       258
       409
        
       					});

     

       259
       259
       -
       					

     

       410
       410
       +
       

     

       411
       411
       +
       					// Clear rate limits on successful registration

     

       260
       412
        
       					const ipAddress =

     

       261
       413
        
       						req.headers.get("x-forwarded-for") ??

     

       262
       414
        
       						req.headers.get("x-real-ip") ??

     

       263
       415
        
       						"unknown";

     

       264
       264
       -
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       265
       265
       -
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       416
       416
       +
       					clearRateLimit("register", email, ipAddress);

     

       417
       417
       +
       

     

       418
       418
       +
       					// Return success but indicate email verification is needed

     

       419
       419
       +
       					// Don't create session yet - they need to verify first

     

       266
       420
        
       					return Response.json(

     

       267
       267
       -
       						{ user: { id: user.id, email: user.email } },

     

       268
       421
        
       						{

     

       269
       269
       -
       							headers: {

     

       270
       270
       -
       								"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       271
       271
       -
       							},

     

       422
       422
       +
       							user: { id: user.id, email: user.email },

     

       423
       423
       +
       							email_verification_required: true,

     

       424
       424
       +
       							verification_code_sent_at: sentAt,

     

       272
       425
        
       						},

     

       426
       426
       +
       						{ status: 201 },

     

       273
       427
        
       					);

     

       274
       428
        
       				} catch (err: unknown) {

     

       275
       429
        
       					const error = err as { message?: string };

     

       276
       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       277
       431
        
       						return Response.json(

     

       278
       432
        
       							{ error: "Email already registered" },

     

       279
       279
       -
       							{ status: 400 },

     

       433
       433
       +
       							{ status: 409 },

     

       280
       434
        
       						);

     

       281
       435
        
       					}

     

       436
       436
       +
       					console.error("[Auth] Registration error:", err);

     

       282
       437
        
       					return Response.json(

     

       283
       438
        
       						{ error: "Registration failed" },

     

       284
       439
        
       						{ status: 500 },

     
···

       300
       455
        
       

     

       301
       456
        
       					// Rate limiting: Per IP and per account

     

       302
       457
        
       					const rateLimitError = enforceRateLimit(req, "login", {

     

       303
       303
       -
       						ip: { max: 10, windowSeconds: 15 * 60 },

     

       304
       304
       -
       						account: { max: 5, windowSeconds: 15 * 60, email },

     

       458
       458
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       459
       459
       +
       						account: { max: 5, windowSeconds: 5 * 60, email },

     

       305
       460
        
       					});

     

       306
       461
        
       					if (rateLimitError) return rateLimitError;

     

       307
       462
        
       

     

       308
       308
       -
       					// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       309
       309
       -
       					if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       463
       463
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       464
       464
       +
       					const passwordValidation = validatePasswordHash(password);

     

       465
       465
       +
       					if (!passwordValidation.valid) {

     

       310
       466
        
       						return Response.json(

     

       311
       311
       -
       							{ error: "Invalid password format" },

     

       467
       467
       +
       							{ error: passwordValidation.error },

     

       312
       468
        
       							{ status: 400 },

     

       313
       469
        
       						);

     

       314
       470
        
       					}

     
···

       319
       475
        
       							{ status: 401 },

     

       320
       476
        
       						);

     

       321
       477
        
       					}

     

       478
       478
       +
       

     

       479
       479
       +
       					// Clear rate limits on successful authentication

     

       322
       480
        
       					const ipAddress =

     

       323
       481
        
       						req.headers.get("x-forwarded-for") ??

     

       324
       482
        
       						req.headers.get("x-real-ip") ??

     

       325
       483
        
       						"unknown";

     

       484
       484
       +
       					clearRateLimit("login", email, ipAddress);

     

       485
       485
       +
       

     

       486
       486
       +
       					// Check if email is verified

     

       487
       487
       +
       					if (!isEmailVerified(user.id)) {

     

       488
       488
       +
       						let codeSentAt = getVerificationCodeSentAt(user.id);

     

       489
       489
       +
       

     

       490
       490
       +
       						// If no verification code exists, auto-send one

     

       491
       491
       +
       						if (!codeSentAt) {

     

       492
       492
       +
       							const { code, token, sentAt } = createEmailVerificationToken(

     

       493
       493
       +
       								user.id,

     

       494
       494
       +
       							);

     

       495
       495
       +
       							codeSentAt = sentAt;

     

       496
       496
       +
       

     

       497
       497
       +
       							try {

     

       498
       498
       +
       								await sendEmail({

     

       499
       499
       +
       									to: user.email,

     

       500
       500
       +
       									subject: "Verify your email - Thistle",

     

       501
       501
       +
       									html: verifyEmailTemplate({

     

       502
       502
       +
       										name: user.name,

     

       503
       503
       +
       										code,

     

       504
       504
       +
       										token,

     

       505
       505
       +
       									}),

     

       506
       506
       +
       								});

     

       507
       507
       +
       							} catch (err) {

     

       508
       508
       +
       								console.error(

     

       509
       509
       +
       									"[Email] Failed to send verification email on login:",

     

       510
       510
       +
       									err,

     

       511
       511
       +
       								);

     

       512
       512
       +
       								// Don't fail login - just return null timestamp so client can try resend

     

       513
       513
       +
       								codeSentAt = null;

     

       514
       514
       +
       							}

     

       515
       515
       +
       						}

     

       516
       516
       +
       

     

       517
       517
       +
       						return Response.json(

     

       518
       518
       +
       							{

     

       519
       519
       +
       								user: { id: user.id, email: user.email },

     

       520
       520
       +
       								email_verification_required: true,

     

       521
       521
       +
       								verification_code_sent_at: codeSentAt,

     

       522
       522
       +
       							},

     

       523
       523
       +
       							{ status: 200 },

     

       524
       524
       +
       						);

     

       525
       525
       +
       					}

     

       526
       526
       +
       

     

       326
       527
        
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       327
       528
        
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       328
       529
        
       					return Response.json(

     
···

       333
       534
        
       							},

     

       334
       535
        
       						},

     

       335
       536
        
       					);

     

       336
       336
       -
       				} catch {

     

       537
       537
       +
       				} catch (error) {

     

       538
       538
       +
       					console.error("[Auth] Login error:", error);

     

       337
       539
        
       					return Response.json({ error: "Login failed" }, { status: 500 });

     

       338
       540
        
       				}

     

       339
       541
        
       			},

     

       340
       542
        
       		},

     

       543
       543
       +
       		"/api/auth/verify-email": {

     

       544
       544
       +
       			GET: async (req) => {

     

       545
       545
       +
       				try {

     

       546
       546
       +
       					const url = new URL(req.url);

     

       547
       547
       +
       					const token = url.searchParams.get("token");

     

       548
       548
       +
       

     

       549
       549
       +
       					if (!token) {

     

       550
       550
       +
       						return Response.redirect("/", 302);

     

       551
       551
       +
       					}

     

       552
       552
       +
       

     

       553
       553
       +
       					const result = verifyEmailToken(token);

     

       554
       554
       +
       

     

       555
       555
       +
       					if (!result) {

     

       556
       556
       +
       						return Response.redirect("/", 302);

     

       557
       557
       +
       					}

     

       558
       558
       +
       

     

       559
       559
       +
       					// Create session for the verified user

     

       560
       560
       +
       					const ipAddress =

     

       561
       561
       +
       						req.headers.get("x-forwarded-for") ??

     

       562
       562
       +
       						req.headers.get("x-real-ip") ??

     

       563
       563
       +
       						"unknown";

     

       564
       564
       +
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       565
       565
       +
       					const sessionId = createSession(result.userId, ipAddress, userAgent);

     

       566
       566
       +
       

     

       567
       567
       +
       					// Redirect to classes with session cookie

     

       568
       568
       +
       					return new Response(null, {

     

       569
       569
       +
       						status: 302,

     

       570
       570
       +
       						headers: {

     

       571
       571
       +
       							Location: "/classes",

     

       572
       572
       +
       							"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       573
       573
       +
       						},

     

       574
       574
       +
       					});

     

       575
       575
       +
       				} catch (error) {

     

       576
       576
       +
       					console.error("[Email] Verification error:", error);

     

       577
       577
       +
       					return Response.redirect("/", 302);

     

       578
       578
       +
       				}

     

       579
       579
       +
       			},

     

       580
       580
       +
       			POST: async (req) => {

     

       581
       581
       +
       				try {

     

       582
       582
       +
       					const body = await req.json();

     

       583
       583
       +
       					const { email, code } = body;

     

       584
       584
       +
       

     

       585
       585
       +
       					if (!email || !code) {

     

       586
       586
       +
       						return Response.json(

     

       587
       587
       +
       							{ error: "Email and verification code required" },

     

       588
       588
       +
       							{ status: 400 },

     

       589
       589
       +
       						);

     

       590
       590
       +
       					}

     

       591
       591
       +
       

     

       592
       592
       +
       					// Get user by email

     

       593
       593
       +
       					const user = getUserByEmail(email);

     

       594
       594
       +
       					if (!user) {

     

       595
       595
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       596
       596
       +
       					}

     

       597
       597
       +
       

     

       598
       598
       +
       					// Check if already verified

     

       599
       599
       +
       					if (isEmailVerified(user.id)) {

     

       600
       600
       +
       						return Response.json(

     

       601
       601
       +
       							{ error: "Email already verified" },

     

       602
       602
       +
       							{ status: 400 },

     

       603
       603
       +
       						);

     

       604
       604
       +
       					}

     

       605
       605
       +
       

     

       606
       606
       +
       					const success = verifyEmailCode(user.id, code);

     

       607
       607
       +
       

     

       608
       608
       +
       					if (!success) {

     

       609
       609
       +
       						return Response.json(

     

       610
       610
       +
       							{ error: "Invalid or expired verification code" },

     

       611
       611
       +
       							{ status: 400 },

     

       612
       612
       +
       						);

     

       613
       613
       +
       					}

     

       614
       614
       +
       

     

       615
       615
       +
       					// Create session after successful verification

     

       616
       616
       +
       					const ipAddress =

     

       617
       617
       +
       						req.headers.get("x-forwarded-for") ??

     

       618
       618
       +
       						req.headers.get("x-real-ip") ??

     

       619
       619
       +
       						"unknown";

     

       620
       620
       +
       					const userAgent = req.headers.get("user-agent") ?? "unknown";

     

       621
       621
       +
       					const sessionId = createSession(user.id, ipAddress, userAgent);

     

       622
       622
       +
       

     

       623
       623
       +
       					return Response.json(

     

       624
       624
       +
       						{

     

       625
       625
       +
       							success: true,

     

       626
       626
       +
       							message: "Email verified successfully",

     

       627
       627
       +
       							email_verified: true,

     

       628
       628
       +
       							user: { id: user.id, email: user.email },

     

       629
       629
       +
       						},

     

       630
       630
       +
       						{

     

       631
       631
       +
       							headers: {

     

       632
       632
       +
       								"Set-Cookie": `session=${sessionId}; HttpOnly; Secure; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Lax`,

     

       633
       633
       +
       							},

     

       634
       634
       +
       						},

     

       635
       635
       +
       					);

     

       636
       636
       +
       				} catch (error) {

     

       637
       637
       +
       					return handleError(error);

     

       638
       638
       +
       				}

     

       639
       639
       +
       			},

     

       640
       640
       +
       		},

     

       641
       641
       +
       		"/api/auth/resend-verification": {

     

       642
       642
       +
       			POST: async (req) => {

     

       643
       643
       +
       				try {

     

       644
       644
       +
       					const user = requireAuth(req);

     

       645
       645
       +
       

     

       646
       646
       +
       					// Rate limiting

     

       647
       647
       +
       					const rateLimitError = enforceRateLimit(req, "resend-verification", {

     

       648
       648
       +
       						account: { max: 3, windowSeconds: 60 * 60, email: user.email },

     

       649
       649
       +
       					});

     

       650
       650
       +
       					if (rateLimitError) return rateLimitError;

     

       651
       651
       +
       

     

       652
       652
       +
       					// Check if already verified

     

       653
       653
       +
       					if (isEmailVerified(user.id)) {

     

       654
       654
       +
       						return Response.json(

     

       655
       655
       +
       							{ error: "Email already verified" },

     

       656
       656
       +
       							{ status: 400 },

     

       657
       657
       +
       						);

     

       658
       658
       +
       					}

     

       659
       659
       +
       

     

       660
       660
       +
       					// Generate new code and send email

     

       661
       661
       +
       					const { code, token } = createEmailVerificationToken(user.id);

     

       662
       662
       +
       

     

       663
       663
       +
       					await sendEmail({

     

       664
       664
       +
       						to: user.email,

     

       665
       665
       +
       						subject: "Verify your email - Thistle",

     

       666
       666
       +
       						html: verifyEmailTemplate({

     

       667
       667
       +
       							name: user.name,

     

       668
       668
       +
       							code,

     

       669
       669
       +
       							token,

     

       670
       670
       +
       						}),

     

       671
       671
       +
       					});

     

       672
       672
       +
       

     

       673
       673
       +
       					return Response.json({

     

       674
       674
       +
       						success: true,

     

       675
       675
       +
       						message: "Verification email sent",

     

       676
       676
       +
       					});

     

       677
       677
       +
       				} catch (error) {

     

       678
       678
       +
       					return handleError(error);

     

       679
       679
       +
       				}

     

       680
       680
       +
       			},

     

       681
       681
       +
       		},

     

       682
       682
       +
       		"/api/auth/resend-verification-code": {

     

       683
       683
       +
       			POST: async (req) => {

     

       684
       684
       +
       				try {

     

       685
       685
       +
       					const body = await req.json();

     

       686
       686
       +
       					const { email } = body;

     

       687
       687
       +
       

     

       688
       688
       +
       					if (!email) {

     

       689
       689
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       690
       690
       +
       					}

     

       691
       691
       +
       

     

       692
       692
       +
       					// Rate limiting by email

     

       693
       693
       +
       					const rateLimitError = enforceRateLimit(

     

       694
       694
       +
       						req,

     

       695
       695
       +
       						"resend-verification-code",

     

       696
       696
       +
       						{

     

       697
       697
       +
       							account: { max: 3, windowSeconds: 5 * 60, email },

     

       698
       698
       +
       						},

     

       699
       699
       +
       					);

     

       700
       700
       +
       					if (rateLimitError) return rateLimitError;

     

       701
       701
       +
       

     

       702
       702
       +
       					// Get user by email

     

       703
       703
       +
       					const user = getUserByEmail(email);

     

       704
       704
       +
       					if (!user) {

     

       705
       705
       +
       						// Don't reveal if user exists

     

       706
       706
       +
       						return Response.json({

     

       707
       707
       +
       							success: true,

     

       708
       708
       +
       							message:

     

       709
       709
       +
       								"If an account exists with that email, a verification code has been sent",

     

       710
       710
       +
       						});

     

       711
       711
       +
       					}

     

       712
       712
       +
       

     

       713
       713
       +
       					// Check if already verified

     

       714
       714
       +
       					if (isEmailVerified(user.id)) {

     

       715
       715
       +
       						return Response.json(

     

       716
       716
       +
       							{ error: "Email already verified" },

     

       717
       717
       +
       							{ status: 400 },

     

       718
       718
       +
       						);

     

       719
       719
       +
       					}

     

       720
       720
       +
       

     

       721
       721
       +
       					// Generate new code and send email

     

       722
       722
       +
       					const { code, token, sentAt } = createEmailVerificationToken(user.id);

     

       723
       723
       +
       

     

       724
       724
       +
       					await sendEmail({

     

       725
       725
       +
       						to: user.email,

     

       726
       726
       +
       						subject: "Verify your email - Thistle",

     

       727
       727
       +
       						html: verifyEmailTemplate({

     

       728
       728
       +
       							name: user.name,

     

       729
       729
       +
       							code,

     

       730
       730
       +
       							token,

     

       731
       731
       +
       						}),

     

       732
       732
       +
       					});

     

       733
       733
       +
       

     

       734
       734
       +
       					return Response.json({

     

       735
       735
       +
       						success: true,

     

       736
       736
       +
       						message: "Verification code sent",

     

       737
       737
       +
       						verification_code_sent_at: sentAt,

     

       738
       738
       +
       					});

     

       739
       739
       +
       				} catch (error) {

     

       740
       740
       +
       					return handleError(error);

     

       741
       741
       +
       				}

     

       742
       742
       +
       			},

     

       743
       743
       +
       		},

     

       744
       744
       +
       		"/api/auth/forgot-password": {

     

       745
       745
       +
       			POST: async (req) => {

     

       746
       746
       +
       				try {

     

       747
       747
       +
       					// Rate limiting

     

       748
       748
       +
       					const rateLimitError = enforceRateLimit(req, "forgot-password", {

     

       749
       749
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       750
       750
       +
       					});

     

       751
       751
       +
       					if (rateLimitError) return rateLimitError;

     

       752
       752
       +
       

     

       753
       753
       +
       					const body = await req.json();

     

       754
       754
       +
       					const { email } = body;

     

       755
       755
       +
       

     

       756
       756
       +
       					if (!email) {

     

       757
       757
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       758
       758
       +
       					}

     

       759
       759
       +
       

     

       760
       760
       +
       					// Always return success to prevent email enumeration

     

       761
       761
       +
       					const user = getUserByEmail(email);

     

       762
       762
       +
       					if (user) {

     

       763
       763
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       764
       764
       +
       						const resetToken = createPasswordResetToken(user.id);

     

       765
       765
       +
       						const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       766
       766
       +
       

     

       767
       767
       +
       						await sendEmail({

     

       768
       768
       +
       							to: user.email,

     

       769
       769
       +
       							subject: "Reset your password - Thistle",

     

       770
       770
       +
       							html: passwordResetTemplate({

     

       771
       771
       +
       								name: user.name,

     

       772
       772
       +
       								resetLink,

     

       773
       773
       +
       							}),

     

       774
       774
       +
       						}).catch((err) => {

     

       775
       775
       +
       							console.error("[Email] Failed to send password reset:", err);

     

       776
       776
       +
       						});

     

       777
       777
       +
       					}

     

       778
       778
       +
       

     

       779
       779
       +
       					return Response.json({

     

       780
       780
       +
       						success: true,

     

       781
       781
       +
       						message:

     

       782
       782
       +
       							"If an account exists with that email, a password reset link has been sent",

     

       783
       783
       +
       					});

     

       784
       784
       +
       				} catch (error) {

     

       785
       785
       +
       					console.error("[Email] Forgot password error:", error);

     

       786
       786
       +
       					return Response.json(

     

       787
       787
       +
       						{ error: "Failed to process request" },

     

       788
       788
       +
       						{ status: 500 },

     

       789
       789
       +
       					);

     

       790
       790
       +
       				}

     

       791
       791
       +
       			},

     

       792
       792
       +
       		},

     

       793
       793
       +
       		"/api/auth/reset-password": {

     

       794
       794
       +
       			GET: async (req) => {

     

       795
       795
       +
       				try {

     

       796
       796
       +
       					const url = new URL(req.url);

     

       797
       797
       +
       					const token = url.searchParams.get("token");

     

       798
       798
       +
       

     

       799
       799
       +
       					if (!token) {

     

       800
       800
       +
       						return Response.json({ error: "Token required" }, { status: 400 });

     

       801
       801
       +
       					}

     

       802
       802
       +
       

     

       803
       803
       +
       					const userId = verifyPasswordResetToken(token);

     

       804
       804
       +
       					if (!userId) {

     

       805
       805
       +
       						return Response.json(

     

       806
       806
       +
       							{ error: "Invalid or expired reset token" },

     

       807
       807
       +
       							{ status: 400 },

     

       808
       808
       +
       						);

     

       809
       809
       +
       					}

     

       810
       810
       +
       

     

       811
       811
       +
       					// Get user's email for client-side password hashing

     

       812
       812
       +
       					const user = db

     

       813
       813
       +
       						.query<{ email: string }, [number]>(

     

       814
       814
       +
       							"SELECT email FROM users WHERE id = ?",

     

       815
       815
       +
       						)

     

       816
       816
       +
       						.get(userId);

     

       817
       817
       +
       

     

       818
       818
       +
       					if (!user) {

     

       819
       819
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       820
       820
       +
       					}

     

       821
       821
       +
       

     

       822
       822
       +
       					return Response.json({ email: user.email });

     

       823
       823
       +
       				} catch (error) {

     

       824
       824
       +
       					console.error("[Email] Get reset token info error:", error);

     

       825
       825
       +
       					return Response.json(

     

       826
       826
       +
       						{ error: "Failed to verify token" },

     

       827
       827
       +
       						{ status: 500 },

     

       828
       828
       +
       					);

     

       829
       829
       +
       				}

     

       830
       830
       +
       			},

     

       831
       831
       +
       			POST: async (req) => {

     

       832
       832
       +
       				try {

     

       833
       833
       +
       					const body = await req.json();

     

       834
       834
       +
       					const { token, password } = body;

     

       835
       835
       +
       

     

       836
       836
       +
       					if (!token || !password) {

     

       837
       837
       +
       						return Response.json(

     

       838
       838
       +
       							{ error: "Token and password required" },

     

       839
       839
       +
       							{ status: 400 },

     

       840
       840
       +
       						);

     

       841
       841
       +
       					}

     

       842
       842
       +
       

     

       843
       843
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       844
       844
       +
       					const passwordValidation = validatePasswordHash(password);

     

       845
       845
       +
       					if (!passwordValidation.valid) {

     

       846
       846
       +
       						return Response.json(

     

       847
       847
       +
       							{ error: passwordValidation.error },

     

       848
       848
       +
       							{ status: 400 },

     

       849
       849
       +
       						);

     

       850
       850
       +
       					}

     

       851
       851
       +
       

     

       852
       852
       +
       					const userId = verifyPasswordResetToken(token);

     

       853
       853
       +
       					if (!userId) {

     

       854
       854
       +
       						return Response.json(

     

       855
       855
       +
       							{ error: "Invalid or expired reset token" },

     

       856
       856
       +
       							{ status: 400 },

     

       857
       857
       +
       						);

     

       858
       858
       +
       					}

     

       859
       859
       +
       

     

       860
       860
       +
       					// Update password and consume token

     

       861
       861
       +
       					await updateUserPassword(userId, password);

     

       862
       862
       +
       					consumePasswordResetToken(token);

     

       863
       863
       +
       

     

       864
       864
       +
       					return Response.json({

     

       865
       865
       +
       						success: true,

     

       866
       866
       +
       						message: "Password reset successfully",

     

       867
       867
       +
       					});

     

       868
       868
       +
       				} catch (error) {

     

       869
       869
       +
       					console.error("[Email] Reset password error:", error);

     

       870
       870
       +
       					return Response.json(

     

       871
       871
       +
       						{ error: "Failed to reset password" },

     

       872
       872
       +
       						{ status: 500 },

     

       873
       873
       +
       					);

     

       874
       874
       +
       				}

     

       875
       875
       +
       			},

     

       876
       876
       +
       		},

     

       341
       877
        
       		"/api/auth/logout": {

     

       342
       878
        
       			POST: async (req) => {

     

       343
       879
        
       				const sessionId = getSessionFromRequest(req);

     
···

       357
       893
        
       		},

     

       358
       894
        
       		"/api/auth/me": {

     

       359
       895
        
       			GET: (req) => {

     

       360
       360
       -
       				const sessionId = getSessionFromRequest(req);

     

       361
       361
       -
       				if (!sessionId) {

     

       362
       362
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       363
       363
       -
       				}

     

       364
       364
       -
       				const user = getUserBySession(sessionId);

     

       365
       365
       -
       				if (!user) {

     

       366
       366
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       367
       367
       -
       				}

     

       896
       896
       +
       				try {

     

       897
       897
       +
       					const user = requireAuth(req);

     

       368
       898
        
       

     

       369
       369
       -
       				// Check subscription status

     

       370
       370
       -
       				const subscription = db

     

       371
       371
       -
       					.query<{ status: string }, [number]>(

     

       372
       372
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       373
       373
       -
       					)

     

       374
       374
       -
       					.get(user.id);

     

       899
       899
       +
       					// Check subscription status

     

       900
       900
       +
       					const subscription = db

     

       901
       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       903
       +
       						)

     

       904
       904
       +
       						.get(user.id);

     

       375
       905
        
       

     

       376
       376
       -
       				return Response.json({

     

       377
       377
       -
       					email: user.email,

     

       378
       378
       -
       					name: user.name,

     

       379
       379
       -
       					avatar: user.avatar,

     

       380
       380
       -
       					created_at: user.created_at,

     

       381
       381
       -
       					role: user.role,

     

       382
       382
       -
       					has_subscription: !!subscription,

     

       383
       383
       -
       				});

     

       906
       906
       +
       					// Get notification preferences

     

       907
       907
       +
       					const prefs = db

     

       908
       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       910
       +
       						)

     

       911
       911
       +
       						.get(user.id);

     

       912
       912
       +
       

     

       913
       913
       +
       					return Response.json({

     

       914
       914
       +
       						email: user.email,

     

       915
       915
       +
       						name: user.name,

     

       916
       916
       +
       						avatar: user.avatar,

     

       917
       917
       +
       						created_at: user.created_at,

     

       918
       918
       +
       						role: user.role,

     

       919
       919
       +
       						has_subscription: !!subscription,

     

       920
       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       921
       +
       						email_notifications_enabled:

     

       922
       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       923
       +
       					});

     

       924
       924
       +
       				} catch (err) {

     

       925
       925
       +
       					return handleError(err);

     

       926
       926
       +
       				}

     

       384
       927
        
       			},

     

       385
       928
        
       		},

     

       386
       929
        
       		"/api/passkeys/register/options": {

     

       387
       930
        
       			POST: async (req) => {

     

       388
       931
        
       				try {

     

       389
       932
        
       					const user = requireAuth(req);

     

       933
       933
       +
       

     

       934
       934
       +
       					const rateLimitError = enforceRateLimit(

     

       935
       935
       +
       						req,

     

       936
       936
       +
       						"passkey-register-options",

     

       937
       937
       +
       						{

     

       938
       938
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       939
       939
       +
       						},

     

       940
       940
       +
       					);

     

       941
       941
       +
       					if (rateLimitError) return rateLimitError;

     

       942
       942
       +
       

     

       390
       943
        
       					const options = await createRegistrationOptions(user);

     

       391
       944
        
       					return Response.json(options);

     

       392
       945
        
       				} catch (err) {

     
···

       398
       951
        
       			POST: async (req) => {

     

       399
       952
        
       				try {

     

       400
       953
        
       					const _user = requireAuth(req);

     

       954
       954
       +
       

     

       955
       955
       +
       					const rateLimitError = enforceRateLimit(

     

       956
       956
       +
       						req,

     

       957
       957
       +
       						"passkey-register-verify",

     

       958
       958
       +
       						{

     

       959
       959
       +
       							ip: { max: 10, windowSeconds: 5 * 60 },

     

       960
       960
       +
       						},

     

       961
       961
       +
       					);

     

       962
       962
       +
       					if (rateLimitError) return rateLimitError;

     

       963
       963
       +
       

     

       401
       964
        
       					const body = await req.json();

     

       402
       965
        
       					const { response: credentialResponse, challenge, name } = body;

     

       403
       966
        
       

     
···

       423
       986
        
       		"/api/passkeys/authenticate/options": {

     

       424
       987
        
       			POST: async (req) => {

     

       425
       988
        
       				try {

     

       989
       989
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-options", {

     

       990
       990
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       991
       991
       +
       					});

     

       992
       992
       +
       					if (rateLimitError) return rateLimitError;

     

       993
       993
       +
       

     

       426
       994
        
       					const body = await req.json();

     

       427
       995
        
       					const { email } = body;

     

       428
       996
        
       

     
···

       436
       1004
        
       		"/api/passkeys/authenticate/verify": {

     

       437
       1005
        
       			POST: async (req) => {

     

       438
       1006
        
       				try {

     

       1007
       1007
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-verify", {

     

       1008
       1008
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1009
       1009
       +
       					});

     

       1010
       1010
       +
       					if (rateLimitError) return rateLimitError;

     

       1011
       1011
       +
       

     

       439
       1012
        
       					const body = await req.json();

     

       440
       1013
        
       					const { response: credentialResponse, challenge } = body;

     

       441
       1014
        
       

     
···

       501
       1074
        
       			PUT: async (req) => {

     

       502
       1075
        
       				try {

     

       503
       1076
        
       					const user = requireAuth(req);

     

       1077
       1077
       +
       

     

       1078
       1078
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-update", {

     

       1079
       1079
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1080
       1080
       +
       					});

     

       1081
       1081
       +
       					if (rateLimitError) return rateLimitError;

     

       1082
       1082
       +
       

     

       504
       1083
        
       					const body = await req.json();

     

       505
       1084
        
       					const { name } = body;

     

       506
       1085
        
       					const passkeyId = req.params.id;

     
···

       510
       1089
        
       					}

     

       511
       1090
        
       

     

       512
       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       513
       513
       -
       					return Response.json({ success: true });

     

       1092
       1092
       +
       					return new Response(null, { status: 204 });

     

       514
       1093
        
       				} catch (err) {

     

       515
       1094
        
       					return handleError(err);

     

       516
       1095
        
       				}

     
···

       518
       1097
        
       			DELETE: async (req) => {

     

       519
       1098
        
       				try {

     

       520
       1099
        
       					const user = requireAuth(req);

     

       1100
       1100
       +
       

     

       1101
       1101
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-delete", {

     

       1102
       1102
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1103
       1103
       +
       					});

     

       1104
       1104
       +
       					if (rateLimitError) return rateLimitError;

     

       1105
       1105
       +
       

     

       521
       1106
        
       					const passkeyId = req.params.id;

     

       522
       1107
        
       					deletePasskey(passkeyId, user.id);

     

       523
       523
       -
       					return Response.json({ success: true });

     

       1108
       1108
       +
       					return new Response(null, { status: 204 });

     

       524
       1109
        
       				} catch (err) {

     

       525
       1110
        
       					return handleError(err);

     

       526
       1111
        
       				}

     
···

       528
       1113
        
       		},

     

       529
       1114
        
       		"/api/sessions": {

     

       530
       1115
        
       			GET: (req) => {

     

       531
       531
       -
       				const sessionId = getSessionFromRequest(req);

     

       532
       532
       -
       				if (!sessionId) {

     

       533
       533
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1116
       1116
       +
       				try {

     

       1117
       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       1118
       +
       					if (!sessionId) {

     

       1119
       1119
       +
       						return Response.json(

     

       1120
       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       1121
       +
       							{ status: 401 },

     

       1122
       1122
       +
       						);

     

       1123
       1123
       +
       					}

     

       1124
       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       1125
       +
       					if (!user) {

     

       1126
       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       1127
       +
       					}

     

       1128
       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       1129
       +
       					return Response.json({

     

       1130
       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       1131
       +
       							id: s.id,

     

       1132
       1132
       +
       							ip_address: s.ip_address,

     

       1133
       1133
       +
       							user_agent: s.user_agent,

     

       1134
       1134
       +
       							created_at: s.created_at,

     

       1135
       1135
       +
       							expires_at: s.expires_at,

     

       1136
       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       1137
       +
       						})),

     

       1138
       1138
       +
       					});

     

       1139
       1139
       +
       				} catch (err) {

     

       1140
       1140
       +
       					return handleError(err);

     

       534
       1141
        
       				}

     

       535
       535
       -
       				const user = getUserBySession(sessionId);

     

       536
       536
       -
       				if (!user) {

     

       537
       537
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       538
       538
       -
       				}

     

       539
       539
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       540
       540
       -
       				return Response.json({

     

       541
       541
       -
       					sessions: sessions.map((s) => ({

     

       542
       542
       -
       						id: s.id,

     

       543
       543
       -
       						ip_address: s.ip_address,

     

       544
       544
       -
       						user_agent: s.user_agent,

     

       545
       545
       -
       						created_at: s.created_at,

     

       546
       546
       -
       						expires_at: s.expires_at,

     

       547
       547
       -
       						is_current: s.id === sessionId,

     

       548
       548
       -
       					})),

     

       549
       549
       -
       				});

     

       550
       1142
        
       			},

     

       551
       1143
        
       			DELETE: async (req) => {

     

       552
       552
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       553
       553
       -
       				if (!currentSessionId) {

     

       554
       554
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1144
       1144
       +
       				try {

     

       1145
       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       1146
       +
       					if (!currentSessionId) {

     

       1147
       1147
       +
       						return Response.json(

     

       1148
       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       1149
       +
       							{ status: 401 },

     

       1150
       1150
       +
       						);

     

       1151
       1151
       +
       					}

     

       1152
       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       1153
       +
       					if (!user) {

     

       1154
       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       1155
       +
       					}

     

       1156
       1156
       +
       

     

       1157
       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       1159
       +
       					});

     

       1160
       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1161
       1161
       +
       

     

       1162
       1162
       +
       					const body = await req.json();

     

       1163
       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       1164
       +
       					if (!targetSessionId) {

     

       1165
       1165
       +
       						return Response.json(

     

       1166
       1166
       +
       							{ error: "Session ID required" },

     

       1167
       1167
       +
       							{ status: 400 },

     

       1168
       1168
       +
       						);

     

       1169
       1169
       +
       					}

     

       1170
       1170
       +
       					// Prevent deleting current session

     

       1171
       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       1172
       +
       						return Response.json(

     

       1173
       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       1174
       +
       							{ status: 400 },

     

       1175
       1175
       +
       						);

     

       1176
       1176
       +
       					}

     

       1177
       1177
       +
       					// Verify the session belongs to the user

     

       1178
       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       1181
       +
       					}

     

       1182
       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       1184
       +
       				} catch (err) {

     

       1185
       1185
       +
       					return handleError(err);

     

       555
       1186
        
       				}

     

       556
       556
       -
       				const user = getUserBySession(currentSessionId);

     

       557
       557
       -
       				if (!user) {

     

       558
       558
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       559
       559
       -
       				}

     

       560
       560
       -
       				const body = await req.json();

     

       561
       561
       -
       				const targetSessionId = body.sessionId;

     

       562
       562
       -
       				if (!targetSessionId) {

     

       563
       563
       -
       					return Response.json(

     

       564
       564
       -
       						{ error: "Session ID required" },

     

       565
       565
       -
       						{ status: 400 },

     

       566
       566
       -
       					);

     

       567
       567
       -
       				}

     

       568
       568
       -
       				// Prevent deleting current session

     

       569
       569
       -
       				if (targetSessionId === currentSessionId) {

     

       570
       570
       -
       					return Response.json(

     

       571
       571
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       572
       572
       -
       						{ status: 400 },

     

       573
       573
       -
       					);

     

       574
       574
       -
       				}

     

       575
       575
       -
       				// Verify the session belongs to the user

     

       576
       576
       -
       				const targetSession = getSession(targetSessionId);

     

       577
       577
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       578
       578
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       579
       579
       -
       				}

     

       580
       580
       -
       				deleteSession(targetSessionId);

     

       581
       581
       -
       				return Response.json({ success: true });

     

       582
       1187
        
       			},

     

       583
       1188
        
       		},

     

       584
       1189
        
       		"/api/user": {

     

       585
       1190
        
       			DELETE: async (req) => {

     

       586
       586
       -
       				const sessionId = getSessionFromRequest(req);

     

       587
       587
       -
       				if (!sessionId) {

     

       588
       588
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       589
       589
       -
       				}

     

       590
       590
       -
       				const user = getUserBySession(sessionId);

     

       591
       591
       -
       				if (!user) {

     

       592
       592
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       593
       593
       -
       				}

     

       1191
       1191
       +
       				try {

     

       1192
       1192
       +
       					const user = requireAuth(req);

     

       594
       1193
        
       

     

       595
       595
       -
       				// Rate limiting

     

       596
       596
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       597
       597
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       598
       598
       -
       				});

     

       599
       599
       -
       				if (rateLimitError) return rateLimitError;

     

       1194
       1194
       +
       					// Rate limiting

     

       1195
       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       1197
       +
       					});

     

       1198
       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       600
       1199
        
       

     

       601
       601
       -
       				await deleteUser(user.id);

     

       602
       602
       -
       				return Response.json(

     

       603
       603
       -
       					{ success: true },

     

       604
       604
       -
       					{

     

       1200
       1200
       +
       					await deleteUser(user.id);

     

       1201
       1201
       +
       					return new Response(null, {

     

       1202
       1202
       +
       						status: 204,

     

       605
       1203
        
       						headers: {

     

       606
       1204
        
       							"Set-Cookie":

     

       607
       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       608
       1206
        
       						},

     

       609
       609
       -
       					},

     

       610
       610
       -
       				);

     

       1207
       1207
       +
       					});

     

       1208
       1208
       +
       				} catch (err) {

     

       1209
       1209
       +
       					return handleError(err);

     

       1210
       1210
       +
       				}

     

       611
       1211
        
       			},

     

       612
       1212
        
       		},

     

       613
       1213
        
       		"/api/user/email": {

     

       614
       1214
        
       			PUT: async (req) => {

     

       615
       615
       -
       				const sessionId = getSessionFromRequest(req);

     

       616
       616
       -
       				if (!sessionId) {

     

       617
       617
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       618
       618
       -
       				}

     

       619
       619
       -
       				const user = getUserBySession(sessionId);

     

       620
       620
       -
       				if (!user) {

     

       621
       621
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       622
       622
       -
       				}

     

       1215
       1215
       +
       				try {

     

       1216
       1216
       +
       					const user = requireAuth(req);

     

       1217
       1217
       +
       

     

       1218
       1218
       +
       					// Rate limiting

     

       1219
       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       1221
       +
       					});

     

       1222
       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       1223
       1223
       +
       

     

       1224
       1224
       +
       					const body = await req.json();

     

       1225
       1225
       +
       					const { email } = body;

     

       1226
       1226
       +
       					if (!email) {

     

       1227
       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       1228
       +
       					}

     

       1229
       1229
       +
       

     

       1230
       1230
       +
       					// Check if email is already in use

     

       1231
       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       1232
       +
       					if (existingUser) {

     

       1233
       1233
       +
       						return Response.json(

     

       1234
       1234
       +
       							{ error: "Email already in use" },

     

       1235
       1235
       +
       							{ status: 409 },

     

       1236
       1236
       +
       						);

     

       1237
       1237
       +
       					}

     

       1238
       1238
       +
       

     

       1239
       1239
       +
       					try {

     

       1240
       1240
       +
       						// Create email change token

     

       1241
       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1242
       1242
       +
       

     

       1243
       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       623
       1246
        
       

     

       624
       624
       -
       				// Rate limiting

     

       625
       625
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       626
       626
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       627
       627
       -
       				});

     

       628
       628
       -
       				if (rateLimitError) return rateLimitError;

     

       1247
       1247
       +
       						await sendEmail({

     

       1248
       1248
       +
       							to: user.email,

     

       1249
       1249
       +
       							subject: "Verify your email change",

     

       1250
       1250
       +
       							html: emailChangeTemplate({

     

       1251
       1251
       +
       								name: user.name,

     

       1252
       1252
       +
       								currentEmail: user.email,

     

       1253
       1253
       +
       								newEmail: email,

     

       1254
       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       1255
       +
       							}),

     

       1256
       1256
       +
       						});

     

       629
       1257
        
       

     

       630
       630
       -
       				const body = await req.json();

     

       631
       631
       -
       				const { email } = body;

     

       632
       632
       -
       				if (!email) {

     

       633
       633
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1258
       1258
       +
       						return Response.json({

     

       1259
       1259
       +
       							success: true,

     

       1260
       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       1261
       +
       							pendingEmail: email,

     

       1262
       1262
       +
       						});

     

       1263
       1263
       +
       					} catch (error) {

     

       1264
       1264
       +
       						console.error(

     

       1265
       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       1266
       +
       							error,

     

       1267
       1267
       +
       						);

     

       1268
       1268
       +
       						return Response.json(

     

       1269
       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       1270
       +
       							{ status: 500 },

     

       1271
       1271
       +
       						);

     

       1272
       1272
       +
       					}

     

       1273
       1273
       +
       				} catch (err) {

     

       1274
       1274
       +
       					return handleError(err);

     

       634
       1275
        
       				}

     

       1276
       1276
       +
       			},

     

       1277
       1277
       +
       		},

     

       1278
       1278
       +
       		"/api/user/email/verify": {

     

       1279
       1279
       +
       			GET: async (req) => {

     

       635
       1280
        
       				try {

     

       636
       636
       -
       					updateUserEmail(user.id, email);

     

       637
       637
       -
       					return Response.json({ success: true });

     

       638
       638
       -
       				} catch (err: unknown) {

     

       639
       639
       -
       					const error = err as { message?: string };

     

       640
       640
       -
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       641
       641
       -
       						return Response.json(

     

       642
       642
       -
       							{ error: "Email already in use" },

     

       643
       643
       -
       							{ status: 400 },

     

       1281
       1281
       +
       					const url = new URL(req.url);

     

       1282
       1282
       +
       					const token = url.searchParams.get("token");

     

       1283
       1283
       +
       

     

       1284
       1284
       +
       					if (!token) {

     

       1285
       1285
       +
       						return Response.redirect(

     

       1286
       1286
       +
       							"/settings?tab=account&error=invalid-token",

     

       1287
       1287
       +
       							302,

     

       1288
       1288
       +
       						);

     

       1289
       1289
       +
       					}

     

       1290
       1290
       +
       

     

       1291
       1291
       +
       					const result = verifyEmailChangeToken(token);

     

       1292
       1292
       +
       

     

       1293
       1293
       +
       					if (!result) {

     

       1294
       1294
       +
       						return Response.redirect(

     

       1295
       1295
       +
       							"/settings?tab=account&error=expired-token",

     

       1296
       1296
       +
       							302,

     

       644
       1297
        
       						);

     

       645
       1298
        
       					}

     

       646
       646
       -
       					return Response.json(

     

       647
       647
       -
       						{ error: "Failed to update email" },

     

       648
       648
       -
       						{ status: 500 },

     

       1299
       1299
       +
       

     

       1300
       1300
       +
       					// Update the user's email

     

       1301
       1301
       +
       					updateUserEmail(result.userId, result.newEmail);

     

       1302
       1302
       +
       

     

       1303
       1303
       +
       					// Consume the token

     

       1304
       1304
       +
       					consumeEmailChangeToken(token);

     

       1305
       1305
       +
       

     

       1306
       1306
       +
       					// Redirect to settings with success message

     

       1307
       1307
       +
       					return Response.redirect(

     

       1308
       1308
       +
       						"/settings?tab=account&success=email-changed",

     

       1309
       1309
       +
       						302,

     

       1310
       1310
       +
       					);

     

       1311
       1311
       +
       				} catch (error) {

     

       1312
       1312
       +
       					console.error("[Email] Email change verification error:", error);

     

       1313
       1313
       +
       					return Response.redirect(

     

       1314
       1314
       +
       						"/settings?tab=account&error=verification-failed",

     

       1315
       1315
       +
       						302,

     

       649
       1316
        
       					);

     

       650
       1317
        
       				}

     

       651
       1318
        
       			},

     

       652
       1319
        
       		},

     

       653
       1320
        
       		"/api/user/password": {

     

       654
       1321
        
       			PUT: async (req) => {

     

       655
       655
       -
       				const sessionId = getSessionFromRequest(req);

     

       656
       656
       -
       				if (!sessionId) {

     

       657
       657
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       658
       658
       -
       				}

     

       659
       659
       -
       				const user = getUserBySession(sessionId);

     

       660
       660
       -
       				if (!user) {

     

       661
       661
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       662
       662
       -
       				}

     

       1322
       1322
       +
       				try {

     

       1323
       1323
       +
       					const user = requireAuth(req);

     

       663
       1324
        
       

     

       664
       664
       -
       				// Rate limiting

     

       665
       665
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       666
       666
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       667
       667
       -
       				});

     

       668
       668
       -
       				if (rateLimitError) return rateLimitError;

     

       1325
       1325
       +
       					// Rate limiting

     

       1326
       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       1328
       +
       					});

     

       1329
       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       669
       1330
        
       

     

       670
       670
       -
       				const body = await req.json();

     

       671
       671
       -
       				const { password } = body;

     

       672
       672
       -
       				if (!password) {

     

       673
       673
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       674
       674
       -
       				}

     

       675
       675
       -
       				// Password is client-side hashed (PBKDF2), should be 64 char hex

     

       676
       676
       -
       				if (password.length !== 64 || !/^[0-9a-f]+$/.test(password)) {

     

       677
       677
       -
       					return Response.json(

     

       678
       678
       -
       						{ error: "Invalid password format" },

     

       679
       679
       -
       						{ status: 400 },

     

       680
       680
       -
       					);

     

       681
       681
       -
       				}

     

       682
       682
       -
       				try {

     

       683
       683
       -
       					await updateUserPassword(user.id, password);

     

       684
       684
       -
       					return Response.json({ success: true });

     

       685
       685
       -
       				} catch {

     

       686
       686
       -
       					return Response.json(

     

       687
       687
       -
       						{ error: "Failed to update password" },

     

       688
       688
       -
       						{ status: 500 },

     

       689
       689
       -
       					);

     

       1331
       1331
       +
       					const body = await req.json();

     

       1332
       1332
       +
       					const { password } = body;

     

       1333
       1333
       +
       					if (!password) {

     

       1334
       1334
       +
       						return Response.json(

     

       1335
       1335
       +
       							{ error: "Password required" },

     

       1336
       1336
       +
       							{ status: 400 },

     

       1337
       1337
       +
       						);

     

       1338
       1338
       +
       					}

     

       1339
       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       1342
       +
       						return Response.json(

     

       1343
       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       1344
       +
       							{ status: 400 },

     

       1345
       1345
       +
       						);

     

       1346
       1346
       +
       					}

     

       1347
       1347
       +
       					try {

     

       1348
       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       1349
       +
       						return Response.json({ success: true });

     

       1350
       1350
       +
       					} catch {

     

       1351
       1351
       +
       						return Response.json(

     

       1352
       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       1353
       +
       							{ status: 500 },

     

       1354
       1354
       +
       						);

     

       1355
       1355
       +
       					}

     

       1356
       1356
       +
       				} catch (err) {

     

       1357
       1357
       +
       					return handleError(err);

     

       690
       1358
        
       				}

     

       691
       1359
        
       			},

     

       692
       1360
        
       		},

     

       693
       1361
        
       		"/api/user/name": {

     

       694
       1362
        
       			PUT: async (req) => {

     

       695
       695
       -
       				const sessionId = getSessionFromRequest(req);

     

       696
       696
       -
       				if (!sessionId) {

     

       697
       697
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       698
       698
       -
       				}

     

       699
       699
       -
       				const user = getUserBySession(sessionId);

     

       700
       700
       -
       				if (!user) {

     

       701
       701
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       702
       702
       -
       				}

     

       703
       703
       -
       				const body = await req.json();

     

       704
       704
       -
       				const { name } = body;

     

       705
       705
       -
       				if (!name) {

     

       706
       706
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       707
       707
       -
       				}

     

       708
       1363
        
       				try {

     

       709
       709
       -
       					updateUserName(user.id, name);

     

       710
       710
       -
       					return Response.json({ success: true });

     

       711
       711
       -
       				} catch {

     

       712
       712
       -
       					return Response.json(

     

       713
       713
       -
       						{ error: "Failed to update name" },

     

       714
       714
       -
       						{ status: 500 },

     

       715
       715
       -
       					);

     

       1364
       1364
       +
       					const user = requireAuth(req);

     

       1365
       1365
       +
       

     

       1366
       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       1368
       +
       					});

     

       1369
       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1370
       1370
       +
       

     

       1371
       1371
       +
       					const body = await req.json();

     

       1372
       1372
       +
       					const { name } = body;

     

       1373
       1373
       +
       					if (!name) {

     

       1374
       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       1375
       +
       					}

     

       1376
       1376
       +
       					try {

     

       1377
       1377
       +
       						updateUserName(user.id, name);

     

       1378
       1378
       +
       						return Response.json({ success: true });

     

       1379
       1379
       +
       					} catch {

     

       1380
       1380
       +
       						return Response.json(

     

       1381
       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       1382
       +
       							{ status: 500 },

     

       1383
       1383
       +
       						);

     

       1384
       1384
       +
       					}

     

       1385
       1385
       +
       				} catch (err) {

     

       1386
       1386
       +
       					return handleError(err);

     

       716
       1387
        
       				}

     

       717
       1388
        
       			},

     

       718
       1389
        
       		},

     

       719
       1390
        
       		"/api/user/avatar": {

     

       720
       1391
        
       			PUT: async (req) => {

     

       721
       721
       -
       				const sessionId = getSessionFromRequest(req);

     

       722
       722
       -
       				if (!sessionId) {

     

       723
       723
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       724
       724
       -
       				}

     

       725
       725
       -
       				const user = getUserBySession(sessionId);

     

       726
       726
       -
       				if (!user) {

     

       727
       727
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       728
       728
       -
       				}

     

       729
       729
       -
       				const body = await req.json();

     

       730
       730
       -
       				const { avatar } = body;

     

       731
       731
       -
       				if (!avatar) {

     

       732
       732
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       733
       733
       -
       				}

     

       734
       1392
        
       				try {

     

       735
       735
       -
       					updateUserAvatar(user.id, avatar);

     

       736
       736
       -
       					return Response.json({ success: true });

     

       737
       737
       -
       				} catch {

     

       738
       738
       -
       					return Response.json(

     

       739
       739
       -
       						{ error: "Failed to update avatar" },

     

       740
       740
       -
       						{ status: 500 },

     

       741
       741
       -
       					);

     

       1393
       1393
       +
       					const user = requireAuth(req);

     

       1394
       1394
       +
       

     

       1395
       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       1397
       +
       					});

     

       1398
       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1399
       1399
       +
       

     

       1400
       1400
       +
       					const body = await req.json();

     

       1401
       1401
       +
       					const { avatar } = body;

     

       1402
       1402
       +
       					if (!avatar) {

     

       1403
       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       1404
       +
       					}

     

       1405
       1405
       +
       					try {

     

       1406
       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       1407
       +
       						return Response.json({ success: true });

     

       1408
       1408
       +
       					} catch {

     

       1409
       1409
       +
       						return Response.json(

     

       1410
       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       1411
       +
       							{ status: 500 },

     

       1412
       1412
       +
       						);

     

       1413
       1413
       +
       					}

     

       1414
       1414
       +
       				} catch (err) {

     

       1415
       1415
       +
       					return handleError(err);

     

       742
       1416
        
       				}

     

       743
       1417
        
       			},

     

       744
       1418
        
       		},

     

       745
       745
       -
       		"/api/billing/checkout": {

     

       746
       746
       -
       			POST: async (req) => {

     

       747
       747
       -
       				const sessionId = getSessionFromRequest(req);

     

       748
       748
       -
       				if (!sessionId) {

     

       749
       749
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       750
       750
       -
       				}

     

       751
       751
       -
       				const user = getUserBySession(sessionId);

     

       752
       752
       -
       				if (!user) {

     

       753
       753
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       754
       754
       -
       				}

     

       1419
       1419
       +
       		"/api/user/notifications": {

     

       1420
       1420
       +
       			PUT: async (req) => {

     

       1421
       1421
       +
       				try {

     

       1422
       1422
       +
       					const user = requireAuth(req);

     

       755
       1423
        
       

     

       756
       756
       -
       				try {

     

       757
       757
       -
       					const { polar } = await import("./lib/polar");

     

       1424
       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       1426
       +
       					});

     

       1427
       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       758
       1428
        
       

     

       759
       759
       -
       					const productId = process.env.POLAR_PRODUCT_ID;

     

       760
       760
       -
       					if (!productId) {

     

       1429
       1429
       +
       					const body = await req.json();

     

       1430
       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       761
       1432
        
       						return Response.json(

     

       762
       762
       -
       							{ error: "Product not configured" },

     

       763
       763
       -
       							{ status: 500 },

     

       1433
       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       1434
       +
       							{ status: 400 },

     

       764
       1435
        
       						);

     

       765
       1436
        
       					}

     

       766
       766
       -
       

     

       767
       767
       -
       					const successUrl = process.env.POLAR_SUCCESS_URL;

     

       768
       768
       -
       					if (!successUrl) {

     

       1437
       1437
       +
       					try {

     

       1438
       1438
       +
       						db.run(

     

       1439
       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       1441
       +
       						);

     

       1442
       1442
       +
       						return Response.json({ success: true });

     

       1443
       1443
       +
       					} catch {

     

       769
       1444
        
       						return Response.json(

     

       770
       770
       -
       							{ error: "Success URL not configured" },

     

       1445
       1445
       +
       							{ error: "Failed to update notification settings" },

     

       771
       1446
        
       							{ status: 500 },

     

       772
       1447
        
       						);

     

       773
       1448
        
       					}

     

       1449
       1449
       +
       				} catch (err) {

     

       1450
       1450
       +
       					return handleError(err);

     

       1451
       1451
       +
       				}

     

       1452
       1452
       +
       			},

     

       1453
       1453
       +
       		},

     

       1454
       1454
       +
       		"/api/billing/checkout": {

     

       1455
       1455
       +
       			POST: async (req) => {

     

       1456
       1456
       +
       				try {

     

       1457
       1457
       +
       					const user = requireAuth(req);

     

       1458
       1458
       +
       

     

       1459
       1459
       +
       					const { polar } = await import("./lib/polar");

     

       1460
       1460
       +
       

     

       1461
       1461
       +
       					// Validated at startup

     

       1462
       1462
       +
       					const productId = process.env.POLAR_PRODUCT_ID as string;

     

       1463
       1463
       +
       					const successUrl =

     

       1464
       1464
       +
       						process.env.POLAR_SUCCESS_URL || "http://localhost:3000";

     

       774
       1465
        
       

     

       775
       1466
        
       					const checkout = await polar.checkouts.create({

     

       776
       1467
        
       						products: [productId],

     
···

       783
       1474
        
       					});

     

       784
       1475
        
       

     

       785
       1476
        
       					return Response.json({ url: checkout.url });

     

       786
       786
       -
       				} catch (error) {

     

       787
       787
       -
       					console.error("Failed to create checkout:", error);

     

       788
       788
       -
       					return Response.json(

     

       789
       789
       -
       						{ error: "Failed to create checkout session" },

     

       790
       790
       -
       						{ status: 500 },

     

       791
       791
       -
       					);

     

       1477
       1477
       +
       				} catch (err) {

     

       1478
       1478
       +
       					return handleError(err);

     

       792
       1479
        
       				}

     

       793
       1480
        
       			},

     

       794
       1481
        
       		},

     

       795
       1482
        
       		"/api/billing/subscription": {

     

       796
       1483
        
       			GET: async (req) => {

     

       797
       797
       -
       				const sessionId = getSessionFromRequest(req);

     

       798
       798
       -
       				if (!sessionId) {

     

       799
       799
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       800
       800
       -
       				}

     

       801
       801
       -
       				const user = getUserBySession(sessionId);

     

       802
       802
       -
       				if (!user) {

     

       803
       803
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       804
       804
       -
       				}

     

       805
       805
       -
       

     

       806
       1484
        
       				try {

     

       1485
       1485
       +
       					const user = requireAuth(req);

     

       1486
       1486
       +
       

     

       807
       1487
        
       					// Get subscription from database

     

       808
       1488
        
       					const subscription = db

     

       809
       1489
        
       						.query<

     
···

       826
       1506
        
       					}

     

       827
       1507
        
       

     

       828
       1508
        
       					return Response.json({ subscription });

     

       829
       829
       -
       				} catch (error) {

     

       830
       830
       -
       					console.error("Failed to fetch subscription:", error);

     

       831
       831
       -
       					return Response.json(

     

       832
       832
       -
       						{ error: "Failed to fetch subscription" },

     

       833
       833
       -
       						{ status: 500 },

     

       834
       834
       -
       					);

     

       1509
       1509
       +
       				} catch (err) {

     

       1510
       1510
       +
       					return handleError(err);

     

       835
       1511
        
       				}

     

       836
       1512
        
       			},

     

       837
       1513
        
       		},

     

       838
       1514
        
       		"/api/billing/portal": {

     

       839
       1515
        
       			POST: async (req) => {

     

       840
       840
       -
       				const sessionId = getSessionFromRequest(req);

     

       841
       841
       -
       				if (!sessionId) {

     

       842
       842
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       843
       843
       -
       				}

     

       844
       844
       -
       				const user = getUserBySession(sessionId);

     

       845
       845
       -
       				if (!user) {

     

       846
       846
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       847
       847
       -
       				}

     

       1516
       1516
       +
       				try {

     

       1517
       1517
       +
       					const user = requireAuth(req);

     

       848
       1518
        
       

     

       849
       849
       -
       				try {

     

       850
       1519
        
       					const { polar } = await import("./lib/polar");

     

       851
       1520
        
       

     

       852
       1521
        
       					// Get subscription to find customer ID

     
···

       874
       1543
        
       					});

     

       875
       1544
        
       

     

       876
       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       877
       877
       -
       				} catch (error) {

     

       878
       878
       -
       					console.error("Failed to create portal session:", error);

     

       879
       879
       -
       					return Response.json(

     

       880
       880
       -
       						{ error: "Failed to create portal session" },

     

       881
       881
       -
       						{ status: 500 },

     

       882
       882
       -
       					);

     

       1546
       1546
       +
       				} catch (err) {

     

       1547
       1547
       +
       					return handleError(err);

     

       883
       1548
        
       				}

     

       884
       1549
        
       			},

     

       885
       1550
        
       		},

     

       886
       1551
        
       		"/api/webhooks/polar": {

     

       887
       1552
        
       			POST: async (req) => {

     

       888
       888
       -
       				try {

     

       889
       889
       -
       					const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       1553
       1553
       +
       				const { validateEvent } = await import("@polar-sh/sdk/webhooks");

     

       890
       1554
        
       

     

       891
       891
       -
       					// Get raw body as string

     

       892
       892
       -
       					const rawBody = await req.text();

     

       893
       893
       -
       					const headers = Object.fromEntries(req.headers.entries());

     

       894
       894
       -
       

     

       895
       895
       -
       					// Validate webhook signature

     

       896
       896
       -
       					const webhookSecret = process.env.POLAR_WEBHOOK_SECRET;

     

       897
       897
       -
       					if (!webhookSecret) {

     

       898
       898
       -
       						console.error("[Webhook] POLAR_WEBHOOK_SECRET not configured");

     

       899
       899
       -
       						return Response.json(

     

       900
       900
       -
       							{ error: "Webhook secret not configured" },

     

       901
       901
       -
       							{ status: 500 },

     

       902
       902
       -
       						);

     

       903
       903
       -
       					}

     

       1555
       1555
       +
       				// Get raw body as string

     

       1556
       1556
       +
       				const rawBody = await req.text();

     

       1557
       1557
       +
       				const headers = Object.fromEntries(req.headers.entries());

     

       904
       1558
        
       

     

       905
       905
       -
       					const event = validateEvent(rawBody, headers, webhookSecret);

     

       1559
       1559
       +
       				// Validate webhook signature (validated at startup)

     

       1560
       1560
       +
       				const webhookSecret = process.env.POLAR_WEBHOOK_SECRET as string;

     

       1561
       1561
       +
       				let event: ReturnType<typeof validateEvent>;

     

       1562
       1562
       +
       				try {

     

       1563
       1563
       +
       					event = validateEvent(rawBody, headers, webhookSecret);

     

       1564
       1564
       +
       				} catch (error) {

     

       1565
       1565
       +
       					// Validation failed - log but return generic response

     

       1566
       1566
       +
       					console.error("[Webhook] Signature validation failed:", error);

     

       1567
       1567
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       1568
       1568
       +
       				}

     

       906
       1569
        
       

     

       907
       907
       -
       					console.log(`[Webhook] Received event: ${event.type}`);

     

       1570
       1570
       +
       				console.log(`[Webhook] Received event: ${event.type}`);

     

       908
       1571
        
       

     

       909
       909
       -
       					// Handle different event types

     

       1572
       1572
       +
       				// Handle different event types

     

       1573
       1573
       +
       				try {

     

       910
       1574
        
       					switch (event.type) {

     

       911
       1575
        
       						case "subscription.updated": {

     

       912
       1576
        
       							const { id, status, customerId, metadata } = event.data;

     
···

       967
       1631
        
       

     

       968
       1632
        
       					return Response.json({ received: true });

     

       969
       1633
        
       				} catch (error) {

     

       970
       970
       -
       					console.error("[Webhook] Error processing webhook:", error);

     

       971
       971
       -
       					return Response.json(

     

       972
       972
       -
       						{ error: "Webhook processing failed" },

     

       973
       973
       -
       						{ status: 400 },

     

       974
       974
       -
       					);

     

       1634
       1634
       +
       					// Processing failed - log with detail but return generic response

     

       1635
       1635
       +
       					console.error("[Webhook] Event processing failed:", error);

     

       1636
       1636
       +
       					return Response.json({ error: "Invalid webhook" }, { status: 400 });

     

       975
       1637
        
       				}

     

       976
       1638
        
       			},

     

       977
       1639
        
       		},

     
···

       982
       1644
        
       					const transcriptionId = req.params.id;

     

       983
       1645
        
       					// Verify ownership

     

       984
       1646
        
       					const transcription = db

     

       985
       985
       -
       						.query<{ id: string; user_id: number; class_id: string | null; status: string }, [string]>(

     

       1647
       1647
       +
       						.query<

     

       1648
       1648
       +
       							{

     

       1649
       1649
       +
       								id: string;

     

       1650
       1650
       +
       								user_id: number;

     

       1651
       1651
       +
       								class_id: string | null;

     

       1652
       1652
       +
       								status: string;

     

       1653
       1653
       +
       							},

     

       1654
       1654
       +
       							[string]

     

       1655
       1655
       +
       						>(

     

       986
       1656
        
       							"SELECT id, user_id, class_id, status FROM transcriptions WHERE id = ?",

     

       987
       1657
        
       						)

     

       988
       1658
        
       						.get(transcriptionId);

     

       989
       989
       -
       					

     

       1659
       1659
       +
       

     

       990
       1660
        
       					if (!transcription) {

     

       991
       1661
        
       						return Response.json(

     

       992
       1662
        
       							{ error: "Transcription not found" },

     
···

       1001
       1671
        
       

     

       1002
       1672
        
       					// If transcription belongs to a class, check enrollment

     

       1003
       1673
        
       					if (transcription.class_id) {

     

       1004
       1004
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       1674
       1674
       +
       						isClassMember = isUserEnrolledInClass(

     

       1675
       1675
       +
       							user.id,

     

       1676
       1676
       +
       							transcription.class_id,

     

       1677
       1677
       +
       						);

     

       1005
       1678
        
       					}

     

       1006
       1679
        
       

     

       1007
       1680
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1008
       1681
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1009
       1009
       -
       						return Response.json(

     

       1010
       1010
       -
       							{ error: "Transcription not found" },

     

       1011
       1011
       -
       							{ status: 404 },

     

       1012
       1012
       -
       						);

     

       1682
       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1013
       1683
        
       					}

     

       1014
       1684
        
       

     

       1015
       1685
        
       					// Require subscription only if accessing own transcription (not class)

     

       1016
       1016
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       1686
       1686
       +
       					if (

     

       1687
       1687
       +
       						isOwner &&

     

       1688
       1688
       +
       						!transcription.class_id &&

     

       1689
       1689
       +
       						!isAdmin &&

     

       1690
       1690
       +
       						!hasActiveSubscription(user.id)

     

       1691
       1691
       +
       					) {

     

       1017
       1692
        
       						throw AuthErrors.subscriptionRequired();

     

       1018
       1693
        
       					}

     

       1019
       1694
        
       					// Event-driven SSE stream with reconnection support

     

       1020
       1695
        
       					const stream = new ReadableStream({

     

       1021
       1696
        
       						async start(controller) {

     

       1697
       1697
       +
       							// Track this stream for graceful shutdown

     

       1698
       1698
       +
       							activeSSEStreams.add(controller);

     

       1699
       1699
       +
       

     

       1022
       1700
        
       							const encoder = new TextEncoder();

     

       1023
       1701
        
       							let isClosed = false;

     

       1024
       1702
        
       							let lastEventId = Math.floor(Date.now() / 1000);

     
···

       1069
       1747
        
       								current?.status === "failed"

     

       1070
       1748
        
       							) {

     

       1071
       1749
        
       								isClosed = true;

     

       1750
       1750
       +
       								activeSSEStreams.delete(controller);

     

       1072
       1751
        
       								controller.close();

     

       1073
       1752
        
       								return;

     

       1074
       1753
        
       							}

     
···

       1099
       1778
        
       									isClosed = true;

     

       1100
       1779
        
       									clearInterval(heartbeatInterval);

     

       1101
       1780
        
       									transcriptionEvents.off(transcriptionId, updateHandler);

     

       1781
       1781
       +
       									activeSSEStreams.delete(controller);

     

       1102
       1782
        
       									controller.close();

     

       1103
       1783
        
       								}

     

       1104
       1784
        
       							};

     
···

       1108
       1788
        
       								isClosed = true;

     

       1109
       1789
        
       								clearInterval(heartbeatInterval);

     

       1110
       1790
        
       								transcriptionEvents.off(transcriptionId, updateHandler);

     

       1791
       1791
       +
       								activeSSEStreams.delete(controller);

     

       1111
       1792
        
       							};

     

       1112
       1793
        
       						},

     

       1113
       1794
        
       					});

     
···

       1123
       1804
        
       				}

     

       1124
       1805
        
       			},

     

       1125
       1806
        
       		},

     

       1126
       1126
       -
       		"/api/transcriptions/health": {

     

       1807
       1807
       +
       		"/api/health": {

     

       1127
       1808
        
       			GET: async () => {

     

       1128
       1128
       -
       				const isHealthy = await whisperService.checkHealth();

     

       1129
       1129
       -
       				return Response.json({ available: isHealthy });

     

       1809
       1809
       +
       				const health = {

     

       1810
       1810
       +
       					status: "healthy",

     

       1811
       1811
       +
       					timestamp: new Date().toISOString(),

     

       1812
       1812
       +
       					services: {

     

       1813
       1813
       +
       						database: false,

     

       1814
       1814
       +
       						whisper: false,

     

       1815
       1815
       +
       						storage: false,

     

       1816
       1816
       +
       					},

     

       1817
       1817
       +
       					details: {} as Record<string, unknown>,

     

       1818
       1818
       +
       				};

     

       1819
       1819
       +
       

     

       1820
       1820
       +
       				// Check database

     

       1821
       1821
       +
       				try {

     

       1822
       1822
       +
       					db.query("SELECT 1").get();

     

       1823
       1823
       +
       					health.services.database = true;

     

       1824
       1824
       +
       				} catch (error) {

     

       1825
       1825
       +
       					health.status = "unhealthy";

     

       1826
       1826
       +
       					health.details.databaseError =

     

       1827
       1827
       +
       						error instanceof Error ? error.message : String(error);

     

       1828
       1828
       +
       				}

     

       1829
       1829
       +
       

     

       1830
       1830
       +
       				// Check Whisper service

     

       1831
       1831
       +
       				try {

     

       1832
       1832
       +
       					const whisperHealthy = await whisperService.checkHealth();

     

       1833
       1833
       +
       					health.services.whisper = whisperHealthy;

     

       1834
       1834
       +
       					if (!whisperHealthy) {

     

       1835
       1835
       +
       						health.status = "degraded";

     

       1836
       1836
       +
       						health.details.whisperNote = "Whisper service unavailable";

     

       1837
       1837
       +
       					}

     

       1838
       1838
       +
       				} catch (error) {

     

       1839
       1839
       +
       					health.status = "degraded";

     

       1840
       1840
       +
       					health.details.whisperError =

     

       1841
       1841
       +
       						error instanceof Error ? error.message : String(error);

     

       1842
       1842
       +
       				}

     

       1843
       1843
       +
       

     

       1844
       1844
       +
       				// Check storage (uploads and transcripts directories)

     

       1845
       1845
       +
       				try {

     

       1846
       1846
       +
       					const fs = await import("node:fs/promises");

     

       1847
       1847
       +
       					const uploadsExists = await fs

     

       1848
       1848
       +
       						.access("./uploads")

     

       1849
       1849
       +
       						.then(() => true)

     

       1850
       1850
       +
       						.catch(() => false);

     

       1851
       1851
       +
       					const transcriptsExists = await fs

     

       1852
       1852
       +
       						.access("./transcripts")

     

       1853
       1853
       +
       						.then(() => true)

     

       1854
       1854
       +
       						.catch(() => false);

     

       1855
       1855
       +
       					health.services.storage = uploadsExists && transcriptsExists;

     

       1856
       1856
       +
       					if (!health.services.storage) {

     

       1857
       1857
       +
       						health.status = "unhealthy";

     

       1858
       1858
       +
       						health.details.storageNote = `Missing directories: ${[

     

       1859
       1859
       +
       							!uploadsExists && "uploads",

     

       1860
       1860
       +
       							!transcriptsExists && "transcripts",

     

       1861
       1861
       +
       						]

     

       1862
       1862
       +
       							.filter(Boolean)

     

       1863
       1863
       +
       							.join(", ")}`;

     

       1864
       1864
       +
       					}

     

       1865
       1865
       +
       				} catch (error) {

     

       1866
       1866
       +
       					health.status = "unhealthy";

     

       1867
       1867
       +
       					health.details.storageError =

     

       1868
       1868
       +
       						error instanceof Error ? error.message : String(error);

     

       1869
       1869
       +
       				}

     

       1870
       1870
       +
       

     

       1871
       1871
       +
       				const statusCode = health.status === "healthy" ? 200 : 503;

     

       1872
       1872
       +
       				return Response.json(health, { status: statusCode });

     

       1130
       1873
        
       			},

     

       1131
       1874
        
       		},

     

       1132
       1875
        
       		"/api/transcriptions/:id": {

     
···

       1168
       1911
        
       

     

       1169
       1912
        
       					// If transcription belongs to a class, check enrollment

     

       1170
       1913
        
       					if (transcription.class_id) {

     

       1171
       1171
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       1914
       1914
       +
       						isClassMember = isUserEnrolledInClass(

     

       1915
       1915
       +
       							user.id,

     

       1916
       1916
       +
       							transcription.class_id,

     

       1917
       1917
       +
       						);

     

       1172
       1918
        
       					}

     

       1173
       1919
        
       

     

       1174
       1920
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1175
       1921
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1176
       1176
       -
       						return Response.json(

     

       1177
       1177
       -
       							{ error: "Transcription not found" },

     

       1178
       1178
       -
       							{ status: 404 },

     

       1179
       1179
       -
       						);

     

       1922
       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1180
       1923
        
       					}

     

       1181
       1924
        
       

     

       1182
       1925
        
       					// Require subscription only if accessing own transcription (not class)

     

       1183
       1183
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       1926
       1926
       +
       					if (

     

       1927
       1927
       +
       						isOwner &&

     

       1928
       1928
       +
       						!transcription.class_id &&

     

       1929
       1929
       +
       						!isAdmin &&

     

       1930
       1930
       +
       						!hasActiveSubscription(user.id)

     

       1931
       1931
       +
       					) {

     

       1184
       1932
        
       						throw AuthErrors.subscriptionRequired();

     

       1185
       1933
        
       					}

     

       1186
       1934
        
       

     

       1187
       1935
        
       					if (transcription.status !== "completed") {

     

       1188
       1936
        
       						return Response.json(

     

       1189
       1937
        
       							{ error: "Transcription not completed yet" },

     

       1190
       1190
       -
       							{ status: 400 },

     

       1938
       1938
       +
       							{ status: 409 },

     

       1191
       1939
        
       						);

     

       1192
       1940
        
       					}

     

       1193
       1941
        
       

     
···

       1268
       2016
        
       

     

       1269
       2017
        
       					// If transcription belongs to a class, check enrollment

     

       1270
       2018
        
       					if (transcription.class_id) {

     

       1271
       1271
       -
       						isClassMember = isUserEnrolledInClass(user.id, transcription.class_id);

     

       2019
       2019
       +
       						isClassMember = isUserEnrolledInClass(

     

       2020
       2020
       +
       							user.id,

     

       2021
       2021
       +
       							transcription.class_id,

     

       2022
       2022
       +
       						);

     

       1272
       2023
        
       					}

     

       1273
       2024
        
       

     

       1274
       2025
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1275
       2026
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1276
       1276
       -
       						return Response.json(

     

       1277
       1277
       -
       							{ error: "Transcription not found" },

     

       1278
       1278
       -
       							{ status: 404 },

     

       1279
       1279
       -
       						);

     

       2027
       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1280
       2028
        
       					}

     

       1281
       2029
        
       

     

       1282
       2030
        
       					// Require subscription only if accessing own transcription (not class)

     

       1283
       1283
       -
       					if (isOwner && !transcription.class_id && !isAdmin && !hasActiveSubscription(user.id)) {

     

       2031
       2031
       +
       					if (

     

       2032
       2032
       +
       						isOwner &&

     

       2033
       2033
       +
       						!transcription.class_id &&

     

       2034
       2034
       +
       						!isAdmin &&

     

       2035
       2035
       +
       						!hasActiveSubscription(user.id)

     

       2036
       2036
       +
       					) {

     

       1284
       2037
        
       						throw AuthErrors.subscriptionRequired();

     

       1285
       2038
        
       					}

     

       1286
       2039
        
       

     
···

       1343
       2096
        
       				}

     

       1344
       2097
        
       			},

     

       1345
       2098
        
       		},

     

       1346
       1346
       -
       		"/api/transcriptions": {

     

       2099
       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       2100
       +
       			POST: async (req) => {

     

       2101
       2101
       +
       				try {

     

       2102
       2102
       +
       					const user = requireAuth(req);

     

       2103
       2103
       +
       

     

       2104
       2104
       +
       					const formData = await req.formData();

     

       2105
       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       2108
       +
       						| string

     

       2109
       2109
       +
       						| null;

     

       2110
       2110
       +
       

     

       2111
       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       2113
       +
       

     

       2114
       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       2117
       +
       						return Response.json(

     

       2118
       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       2119
       +
       							{ status: 403 },

     

       2120
       2120
       +
       						);

     

       2121
       2121
       +
       					}

     

       2122
       2122
       +
       

     

       2123
       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       2124
       +
       

     

       2125
       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       2126
       +
       					if (fileTimestampStr) {

     

       2127
       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       2130
       +
       							console.log(

     

       2131
       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       2132
       +
       							);

     

       2133
       2133
       +
       						}

     

       2134
       2134
       +
       					}

     

       2135
       2135
       +
       

     

       2136
       2136
       +
       					if (!creationDate) {

     

       2137
       2137
       +
       						return Response.json({

     

       2138
       2138
       +
       							detected: false,

     

       2139
       2139
       +
       							meeting_time_id: null,

     

       2140
       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       2141
       +
       						});

     

       2142
       2142
       +
       					}

     

       2143
       2143
       +
       

     

       2144
       2144
       +
       					// Get meeting times for this class

     

       2145
       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       2146
       +
       

     

       2147
       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       2148
       +
       						return Response.json({

     

       2149
       2149
       +
       							detected: false,

     

       2150
       2150
       +
       							meeting_time_id: null,

     

       2151
       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       2152
       +
       						});

     

       2153
       2153
       +
       					}

     

       2154
       2154
       +
       

     

       2155
       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       2157
       +
       						creationDate,

     

       2158
       2158
       +
       						meetingTimes,

     

       2159
       2159
       +
       					);

     

       2160
       2160
       +
       

     

       2161
       2161
       +
       					if (matchedId) {

     

       2162
       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       2163
       +
       						return Response.json({

     

       2164
       2164
       +
       							detected: true,

     

       2165
       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       2166
       +
       							day: dayName,

     

       2167
       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       2168
       +
       						});

     

       2169
       2169
       +
       					}

     

       2170
       2170
       +
       

     

       2171
       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       2172
       +
       					return Response.json({

     

       2173
       2173
       +
       						detected: false,

     

       2174
       2174
       +
       						meeting_time_id: null,

     

       2175
       2175
       +
       						day: dayName,

     

       2176
       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       2178
       +
       					});

     

       2179
       2179
       +
       				} catch (error) {

     

       2180
       2180
       +
       					return handleError(error);

     

       2181
       2181
       +
       				}

     

       2182
       2182
       +
       			},

     

       2183
       2183
       +
       		},

     

       2184
       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       2185
       +
       			PATCH: async (req) => {

     

       2186
       2186
       +
       				try {

     

       2187
       2187
       +
       					const user = requireAuth(req);

     

       2188
       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       2189
       +
       

     

       2190
       2190
       +
       					const body = await req.json();

     

       2191
       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       2192
       +
       					const sectionId = body.section_id;

     

       2193
       2193
       +
       

     

       2194
       2194
       +
       					if (!meetingTimeId) {

     

       2195
       2195
       +
       						return Response.json(

     

       2196
       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       2197
       +
       							{ status: 400 },

     

       2198
       2198
       +
       						);

     

       2199
       2199
       +
       					}

     

       2200
       2200
       +
       

     

       2201
       2201
       +
       					// Verify transcription ownership

     

       2202
       2202
       +
       					const transcription = db

     

       2203
       2203
       +
       						.query<

     

       2204
       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       2205
       +
       							[string]

     

       2206
       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       2207
       +
       						.get(transcriptionId);

     

       2208
       2208
       +
       

     

       2209
       2209
       +
       					if (!transcription) {

     

       2210
       2210
       +
       						return Response.json(

     

       2211
       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       2212
       +
       							{ status: 404 },

     

       2213
       2213
       +
       						);

     

       2214
       2214
       +
       					}

     

       2215
       2215
       +
       

     

       2216
       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       2218
       +
       					}

     

       2219
       2219
       +
       

     

       2220
       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       2221
       +
       					if (transcription.class_id) {

     

       2222
       2222
       +
       						const meetingTime = db

     

       2223
       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       2225
       +
       							)

     

       2226
       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       2227
       +
       

     

       2228
       2228
       +
       						if (!meetingTime) {

     

       2229
       2229
       +
       							return Response.json(

     

       2230
       2230
       +
       								{

     

       2231
       2231
       +
       									error:

     

       2232
       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       2233
       +
       								},

     

       2234
       2234
       +
       								{ status: 400 },

     

       2235
       2235
       +
       							);

     

       2236
       2236
       +
       						}

     

       2237
       2237
       +
       					}

     

       2238
       2238
       +
       

     

       2239
       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       2241
       +
       						db.run(

     

       2242
       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       2244
       +
       						);

     

       2245
       2245
       +
       					} else {

     

       2246
       2246
       +
       						db.run(

     

       2247
       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       2249
       +
       						);

     

       2250
       2250
       +
       					}

     

       2251
       2251
       +
       

     

       2252
       2252
       +
       					return Response.json({

     

       2253
       2253
       +
       						success: true,

     

       2254
       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       2255
       +
       					});

     

       2256
       2256
       +
       				} catch (error) {

     

       2257
       2257
       +
       					return handleError(error);

     

       2258
       2258
       +
       				}

     

       2259
       2259
       +
       			},

     

       2260
       2260
       +
       		},

     

       2261
       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       1347
       2262
        
       			GET: async (req) => {

     

       1348
       2263
        
       				try {

     

       1349
       1349
       -
       					const user = requireSubscription(req);

     

       2264
       2264
       +
       					const user = requireAuth(req);

     

       2265
       2265
       +
       					const classId = req.params.classId;

     

       2266
       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       1350
       2267
        
       

     

       1351
       1351
       -
       					const transcriptions = db

     

       2268
       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       2271
       +
       						return Response.json(

     

       2272
       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       2273
       +
       							{ status: 403 },

     

       2274
       2274
       +
       						);

     

       2275
       2275
       +
       					}

     

       2276
       2276
       +
       

     

       2277
       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       2278
       +
       					const url = new URL(req.url);

     

       2279
       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       2280
       +
       					const sectionFilter =

     

       2281
       2281
       +
       						sectionParam !== null

     

       2282
       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       2283
       +
       							: user.role === "admin"

     

       2284
       2284
       +
       								? null

     

       2285
       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
       2286
       +
       

     

       2287
       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       2288
       +
       						classId,

     

       2289
       2289
       +
       						meetingTimeId,

     

       2290
       2290
       +
       						sectionFilter,

     

       2291
       2291
       +
       					);

     

       2292
       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       2294
       +
       						user.id,

     

       2295
       2295
       +
       						classId,

     

       2296
       2296
       +
       						meetingTimeId,

     

       2297
       2297
       +
       					);

     

       2298
       2298
       +
       

     

       2299
       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       2301
       +
       						classId,

     

       2302
       2302
       +
       						meetingTimeId,

     

       2303
       2303
       +
       						sectionFilter,

     

       2304
       2304
       +
       					);

     

       2305
       2305
       +
       

     

       2306
       2306
       +
       					return Response.json({

     

       2307
       2307
       +
       						recordings,

     

       2308
       2308
       +
       						total_users: totalUsers,

     

       2309
       2309
       +
       						user_vote: userVote,

     

       2310
       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       2311
       +
       						winning_recording_id: winningId,

     

       2312
       2312
       +
       					});

     

       2313
       2313
       +
       				} catch (error) {

     

       2314
       2314
       +
       					return handleError(error);

     

       2315
       2315
       +
       				}

     

       2316
       2316
       +
       			},

     

       2317
       2317
       +
       		},

     

       2318
       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       2319
       +
       			POST: async (req) => {

     

       2320
       2320
       +
       				try {

     

       2321
       2321
       +
       					const user = requireAuth(req);

     

       2322
       2322
       +
       					const recordingId = req.params.id;

     

       2323
       2323
       +
       

     

       2324
       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       2325
       +
       					const recording = db

     

       1352
       2326
        
       						.query<

     

       1353
       1353
       -
       							{

     

       1354
       1354
       -
       								id: string;

     

       1355
       1355
       -
       								filename: string;

     

       1356
       1356
       -
       								original_filename: string;

     

       1357
       1357
       -
       								class_id: string | null;

     

       1358
       1358
       -
       								status: string;

     

       1359
       1359
       -
       								progress: number;

     

       1360
       1360
       -
       								created_at: number;

     

       1361
       1361
       -
       							},

     

       1362
       1362
       -
       							[number]

     

       2327
       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       2328
       +
       							[string]

     

       1363
       2329
        
       						>(

     

       1364
       1364
       -
       							"SELECT id, filename, original_filename, class_id, status, progress, created_at FROM transcriptions WHERE user_id = ? ORDER BY created_at DESC",

     

       2330
       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       1365
       2331
        
       						)

     

       1366
       1366
       -
       						.all(user.id);

     

       2332
       2332
       +
       						.get(recordingId);

     

       2333
       2333
       +
       

     

       2334
       2334
       +
       					if (!recording) {

     

       2335
       2335
       +
       						return Response.json(

     

       2336
       2336
       +
       							{ error: "Recording not found" },

     

       2337
       2337
       +
       							{ status: 404 },

     

       2338
       2338
       +
       						);

     

       2339
       2339
       +
       					}

     

       2340
       2340
       +
       

     

       2341
       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       2342
       +
       						return Response.json(

     

       2343
       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       2344
       +
       							{ status: 400 },

     

       2345
       2345
       +
       						);

     

       2346
       2346
       +
       					}

     

       2347
       2347
       +
       

     

       2348
       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       2350
       +
       						return Response.json(

     

       2351
       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       2352
       +
       							{ status: 403 },

     

       2353
       2353
       +
       						);

     

       2354
       2354
       +
       					}

     

       2355
       2355
       +
       

     

       2356
       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       2358
       +
       						user.id,

     

       2359
       2359
       +
       						recording.class_id,

     

       2360
       2360
       +
       						recording.meeting_time_id,

     

       2361
       2361
       +
       					);

     

       2362
       2362
       +
       					if (existingVote) {

     

       2363
       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       2364
       +
       					}

     

       2365
       2365
       +
       

     

       2366
       2366
       +
       					// Add new vote

     

       2367
       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       2368
       +
       

     

       2369
       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       2370
       +
       					const userSection =

     

       2371
       2371
       +
       						user.role === "admin"

     

       2372
       2372
       +
       							? null

     

       2373
       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       2374
       +
       

     

       2375
       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       2377
       +
       						recording.class_id,

     

       2378
       2378
       +
       						recording.meeting_time_id,

     

       2379
       2379
       +
       						userSection,

     

       2380
       2380
       +
       					);

     

       2381
       2381
       +
       					if (winningId) {

     

       2382
       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       2383
       +
       						// Start transcription

     

       2384
       2384
       +
       						const winningRecording = db

     

       2385
       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       2387
       +
       							)

     

       2388
       2388
       +
       							.get(winningId);

     

       2389
       2389
       +
       						if (winningRecording) {

     

       2390
       2390
       +
       							whisperService.startTranscription(

     

       2391
       2391
       +
       								winningId,

     

       2392
       2392
       +
       								winningRecording.filename,

     

       2393
       2393
       +
       							);

     

       2394
       2394
       +
       						}

     

       2395
       2395
       +
       					}

     

       2396
       2396
       +
       

     

       2397
       2397
       +
       					return Response.json({

     

       2398
       2398
       +
       						success,

     

       2399
       2399
       +
       						winning_recording_id: winningId,

     

       2400
       2400
       +
       					});

     

       2401
       2401
       +
       				} catch (error) {

     

       2402
       2402
       +
       					return handleError(error);

     

       2403
       2403
       +
       				}

     

       2404
       2404
       +
       			},

     

       2405
       2405
       +
       		},

     

       2406
       2406
       +
       		"/api/recordings/:id": {

     

       2407
       2407
       +
       			DELETE: async (req) => {

     

       2408
       2408
       +
       				try {

     

       2409
       2409
       +
       					const user = requireAuth(req);

     

       2410
       2410
       +
       					const recordingId = req.params.id;

     

       2411
       2411
       +
       

     

       2412
       2412
       +
       					const success = deletePendingRecording(

     

       2413
       2413
       +
       						recordingId,

     

       2414
       2414
       +
       						user.id,

     

       2415
       2415
       +
       						user.role === "admin",

     

       2416
       2416
       +
       					);

     

       2417
       2417
       +
       

     

       2418
       2418
       +
       					if (!success) {

     

       2419
       2419
       +
       						return Response.json(

     

       2420
       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       2421
       +
       							{ status: 403 },

     

       2422
       2422
       +
       						);

     

       2423
       2423
       +
       					}

     

       2424
       2424
       +
       

     

       2425
       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       2426
       +
       				} catch (error) {

     

       2427
       2427
       +
       					return handleError(error);

     

       2428
       2428
       +
       				}

     

       2429
       2429
       +
       			},

     

       2430
       2430
       +
       		},

     

       2431
       2431
       +
       		"/api/transcriptions": {

     

       2432
       2432
       +
       			GET: async (req) => {

     

       2433
       2433
       +
       				try {

     

       2434
       2434
       +
       					const user = requireSubscription(req);

     

       2435
       2435
       +
       					const url = new URL(req.url);

     

       2436
       2436
       +
       

     

       2437
       2437
       +
       					// Parse pagination params

     

       2438
       2438
       +
       					const limit = Math.min(

     

       2439
       2439
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2440
       2440
       +
       						100,

     

       2441
       2441
       +
       					);

     

       2442
       2442
       +
       					const cursorParam = url.searchParams.get("cursor");

     

       2443
       2443
       +
       

     

       2444
       2444
       +
       					let transcriptions: Array<{

     

       2445
       2445
       +
       						id: string;

     

       2446
       2446
       +
       						filename: string;

     

       2447
       2447
       +
       						original_filename: string;

     

       2448
       2448
       +
       						class_id: string | null;

     

       2449
       2449
       +
       						status: string;

     

       2450
       2450
       +
       						progress: number;

     

       2451
       2451
       +
       						created_at: number;

     

       2452
       2452
       +
       					}>;

     

       2453
       2453
       +
       

     

       2454
       2454
       +
       					if (cursorParam) {

     

       2455
       2455
       +
       						// Decode cursor

     

       2456
       2456
       +
       						const { decodeCursor } = await import("./lib/cursor");

     

       2457
       2457
       +
       						const parts = decodeCursor(cursorParam);

     

       2458
       2458
       +
       

     

       2459
       2459
       +
       						if (parts.length !== 2) {

     

       2460
       2460
       +
       							return Response.json(

     

       2461
       2461
       +
       								{ error: "Invalid cursor format" },

     

       2462
       2462
       +
       								{ status: 400 },

     

       2463
       2463
       +
       							);

     

       2464
       2464
       +
       						}

     

       2465
       2465
       +
       

     

       2466
       2466
       +
       						const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       2467
       2467
       +
       						const id = parts[1] || "";

     

       2468
       2468
       +
       

     

       2469
       2469
       +
       						if (Number.isNaN(cursorTime) || !id) {

     

       2470
       2470
       +
       							return Response.json(

     

       2471
       2471
       +
       								{ error: "Invalid cursor format" },

     

       2472
       2472
       +
       								{ status: 400 },

     

       2473
       2473
       +
       							);

     

       2474
       2474
       +
       						}

     

       2475
       2475
       +
       

     

       2476
       2476
       +
       						transcriptions = db

     

       2477
       2477
       +
       							.query<

     

       2478
       2478
       +
       								{

     

       2479
       2479
       +
       									id: string;

     

       2480
       2480
       +
       									filename: string;

     

       2481
       2481
       +
       									original_filename: string;

     

       2482
       2482
       +
       									class_id: string | null;

     

       2483
       2483
       +
       									status: string;

     

       2484
       2484
       +
       									progress: number;

     

       2485
       2485
       +
       									created_at: number;

     

       2486
       2486
       +
       								},

     

       2487
       2487
       +
       								[number, number, string, number]

     

       2488
       2488
       +
       							>(

     

       2489
       2489
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2490
       2490
       +
       								FROM transcriptions 

     

       2491
       2491
       +
       								WHERE user_id = ? AND (created_at < ? OR (created_at = ? AND id < ?))

     

       2492
       2492
       +
       								ORDER BY created_at DESC, id DESC 

     

       2493
       2493
       +
       								LIMIT ?`,

     

       2494
       2494
       +
       							)

     

       2495
       2495
       +
       							.all(user.id, cursorTime, cursorTime, id, limit + 1);

     

       2496
       2496
       +
       					} else {

     

       2497
       2497
       +
       						transcriptions = db

     

       2498
       2498
       +
       							.query<

     

       2499
       2499
       +
       								{

     

       2500
       2500
       +
       									id: string;

     

       2501
       2501
       +
       									filename: string;

     

       2502
       2502
       +
       									original_filename: string;

     

       2503
       2503
       +
       									class_id: string | null;

     

       2504
       2504
       +
       									status: string;

     

       2505
       2505
       +
       									progress: number;

     

       2506
       2506
       +
       									created_at: number;

     

       2507
       2507
       +
       								},

     

       2508
       2508
       +
       								[number, number]

     

       2509
       2509
       +
       							>(

     

       2510
       2510
       +
       								`SELECT id, filename, original_filename, class_id, status, progress, created_at 

     

       2511
       2511
       +
       								FROM transcriptions 

     

       2512
       2512
       +
       								WHERE user_id = ? 

     

       2513
       2513
       +
       								ORDER BY created_at DESC, id DESC 

     

       2514
       2514
       +
       								LIMIT ?`,

     

       2515
       2515
       +
       							)

     

       2516
       2516
       +
       							.all(user.id, limit + 1);

     

       2517
       2517
       +
       					}

     

       2518
       2518
       +
       

     

       2519
       2519
       +
       					// Check if there are more results

     

       2520
       2520
       +
       					const hasMore = transcriptions.length > limit;

     

       2521
       2521
       +
       					if (hasMore) {

     

       2522
       2522
       +
       						transcriptions.pop(); // Remove extra item

     

       2523
       2523
       +
       					}

     

       2524
       2524
       +
       

     

       2525
       2525
       +
       					// Build next cursor

     

       2526
       2526
       +
       					let nextCursor: string | null = null;

     

       2527
       2527
       +
       					if (hasMore && transcriptions.length > 0) {

     

       2528
       2528
       +
       						const { encodeCursor } = await import("./lib/cursor");

     

       2529
       2529
       +
       						const last = transcriptions[transcriptions.length - 1];

     

       2530
       2530
       +
       						if (last) {

     

       2531
       2531
       +
       							nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       2532
       2532
       +
       						}

     

       2533
       2533
       +
       					}

     

       1367
       2534
        
       

     

       1368
       2535
        
       					// Load transcripts from files for completed jobs

     

       1369
       2536
        
       					const jobs = await Promise.all(

     
···

       1379
       2546
        
       						}),

     

       1380
       2547
        
       					);

     

       1381
       2548
        
       

     

       1382
       1382
       -
       					return Response.json({ jobs });

     

       2549
       2549
       +
       					return Response.json({

     

       2550
       2550
       +
       						jobs,

     

       2551
       2551
       +
       						pagination: {

     

       2552
       2552
       +
       							limit,

     

       2553
       2553
       +
       							hasMore,

     

       2554
       2554
       +
       							nextCursor,

     

       2555
       2555
       +
       						},

     

       2556
       2556
       +
       					});

     

       1383
       2557
        
       				} catch (error) {

     

       1384
       2558
        
       					return handleError(error);

     

       1385
       2559
        
       				}

     
···

       1388
       2562
        
       				try {

     

       1389
       2563
        
       					const user = requireSubscription(req);

     

       1390
       2564
        
       

     

       2565
       2565
       +
       					const rateLimitError = enforceRateLimit(req, "upload-transcription", {

     

       2566
       2566
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       2567
       2567
       +
       					});

     

       2568
       2568
       +
       					if (rateLimitError) return rateLimitError;

     

       2569
       2569
       +
       

     

       1391
       2570
        
       					const formData = await req.formData();

     

       1392
       2571
        
       					const file = formData.get("audio") as File;

     

       1393
       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       1394
       1394
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       2573
       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       1395
       2575
        
       						| string

     

       1396
       2576
        
       						| null;

     

       1397
       2577
        
       

     
···

       1460
       2640
        
       					const uploadDir = "./uploads";

     

       1461
       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       1462
       2642
        
       

     

       1463
       1463
       -
       					// Create database record

     

       2643
       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       2647
       +
       

     

       2648
       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       1464
       2649
        
       					db.run(

     

       1465
       1465
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       2650
       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       1466
       2651
        
       						[

     

       1467
       2652
        
       							transcriptionId,

     

       1468
       2653
        
       							user.id,

     

       1469
       2654
        
       							classId,

     

       1470
       1470
       -
       							meetingTimeId,

     

       2655
       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       2656
       +
       							sectionId,

     

       1471
       2657
        
       							filename,

     

       1472
       2658
        
       							file.name,

     

       1473
       2659
        
       							"pending",

     

       2660
       2660
       +
       							recordingDate,

     

       1474
       2661
        
       						],

     

       1475
       2662
        
       					);

     

       1476
       2663
        
       

     

       1477
       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       1478
       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       1479
       2666
        
       

     

       1480
       1480
       -
       					return Response.json({

     

       1481
       1481
       -
       						id: transcriptionId,

     

       1482
       1482
       -
       						message: "Upload successful",

     

       1483
       1483
       -
       					});

     

       2667
       2667
       +
       					return Response.json(

     

       2668
       2668
       +
       						{

     

       2669
       2669
       +
       							id: transcriptionId,

     

       2670
       2670
       +
       							message: "Upload successful",

     

       2671
       2671
       +
       						},

     

       2672
       2672
       +
       						{ status: 201 },

     

       2673
       2673
       +
       					);

     

       1484
       2674
        
       				} catch (error) {

     

       1485
       2675
        
       					return handleError(error);

     

       1486
       2676
        
       				}

     
···

       1490
       2680
        
       			GET: async (req) => {

     

       1491
       2681
        
       				try {

     

       1492
       2682
        
       					requireAdmin(req);

     

       1493
       1493
       -
       					const transcriptions = getAllTranscriptions();

     

       1494
       1494
       -
       					return Response.json(transcriptions);

     

       2683
       2683
       +
       					const url = new URL(req.url);

     

       2684
       2684
       +
       

     

       2685
       2685
       +
       					const limit = Math.min(

     

       2686
       2686
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2687
       2687
       +
       						100,

     

       2688
       2688
       +
       					);

     

       2689
       2689
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2690
       2690
       +
       

     

       2691
       2691
       +
       					const result = getAllTranscriptions(limit, cursor);

     

       2692
       2692
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       1495
       2693
        
       				} catch (error) {

     

       1496
       2694
        
       					return handleError(error);

     

       1497
       2695
        
       				}

     
···

       1501
       2699
        
       			GET: async (req) => {

     

       1502
       2700
        
       				try {

     

       1503
       2701
        
       					requireAdmin(req);

     

       1504
       1504
       -
       					const users = getAllUsersWithStats();

     

       1505
       1505
       -
       					return Response.json(users);

     

       2702
       2702
       +
       					const url = new URL(req.url);

     

       2703
       2703
       +
       

     

       2704
       2704
       +
       					const limit = Math.min(

     

       2705
       2705
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       2706
       2706
       +
       						100,

     

       2707
       2707
       +
       					);

     

       2708
       2708
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       2709
       2709
       +
       

     

       2710
       2710
       +
       					const result = getAllUsersWithStats(limit, cursor);

     

       2711
       2711
       +
       					return Response.json(result.data); // Return just the array for now, can add pagination UI later

     

       1506
       2712
        
       				} catch (error) {

     

       1507
       2713
        
       					return handleError(error);

     

       1508
       2714
        
       				}

     
···

       1536
       2742
        
       					requireAdmin(req);

     

       1537
       2743
        
       					const id = req.params.id;

     

       1538
       2744
        
       					deleteWaitlistEntry(id);

     

       1539
       1539
       -
       					return Response.json({ success: true });

     

       2745
       2745
       +
       					return new Response(null, { status: 204 });

     

       1540
       2746
        
       				} catch (error) {

     

       1541
       2747
        
       					return handleError(error);

     

       1542
       2748
        
       				}

     
···

       1548
       2754
        
       					requireAdmin(req);

     

       1549
       2755
        
       					const transcriptionId = req.params.id;

     

       1550
       2756
        
       					deleteTranscription(transcriptionId);

     

       1551
       1551
       -
       					return Response.json({ success: true });

     

       2757
       2757
       +
       					return new Response(null, { status: 204 });

     

       1552
       2758
        
       				} catch (error) {

     

       1553
       2759
        
       					return handleError(error);

     

       1554
       2760
        
       				}

     
···

       1563
       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1564
       2770
        
       					}

     

       1565
       2771
        
       					await deleteUser(userId);

     

       1566
       1566
       -
       					return Response.json({ success: true });

     

       2772
       2772
       +
       					return new Response(null, { status: 204 });

     

       1567
       2773
        
       				} catch (error) {

     

       1568
       2774
        
       					return handleError(error);

     

       1569
       2775
        
       				}

     
···

       1656
       2862
        
       						.get(userId);

     

       1657
       2863
        
       

     

       1658
       2864
        
       					if (!user) {

     

       1659
       1659
       -
       						return Response.json(

     

       1660
       1660
       -
       							{ error: "User not found" },

     

       1661
       1661
       -
       							{ status: 404 },

     

       1662
       1662
       -
       						);

     

       2865
       2865
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       1663
       2866
        
       					}

     

       1664
       2867
        
       

     

       1665
       2868
        
       					try {

     
···

       1759
       2962
        
       				}

     

       1760
       2963
        
       			},

     

       1761
       2964
        
       		},

     

       1762
       1762
       -
       		"/api/admin/users/:id/password": {

     

       1763
       1763
       -
       			PUT: async (req) => {

     

       2965
       2965
       +
       		"/api/admin/users/:id/password-reset": {

     

       2966
       2966
       +
       			POST: async (req) => {

     

       1764
       2967
        
       				try {

     

       1765
       2968
        
       					requireAdmin(req);

     

       1766
       2969
        
       					const userId = Number.parseInt(req.params.id, 10);

     
···

       1768
       2971
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       1769
       2972
        
       					}

     

       1770
       2973
        
       

     

       1771
       1771
       -
       					const body = await req.json();

     

       1772
       1772
       -
       					const { password } = body as { password: string };

     

       2974
       2974
       +
       					// Get user details

     

       2975
       2975
       +
       					const user = db

     

       2976
       2976
       +
       						.query<

     

       2977
       2977
       +
       							{ id: number; email: string; name: string | null },

     

       2978
       2978
       +
       							[number]

     

       2979
       2979
       +
       						>("SELECT id, email, name FROM users WHERE id = ?")

     

       2980
       2980
       +
       						.get(userId);

     

       1773
       2981
        
       

     

       1774
       1774
       -
       					if (!password || password.length < 8) {

     

       1775
       1775
       -
       						return Response.json(

     

       1776
       1776
       -
       							{ error: "Password must be at least 8 characters" },

     

       1777
       1777
       -
       							{ status: 400 },

     

       1778
       1778
       -
       						);

     

       2982
       2982
       +
       					if (!user) {

     

       2983
       2983
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       1779
       2984
        
       					}

     

       1780
       2985
        
       

     

       1781
       1781
       -
       					await updateUserPassword(userId, password);

     

       1782
       1782
       -
       					return Response.json({ success: true });

     

       2986
       2986
       +
       					// Create password reset token

     

       2987
       2987
       +
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       2988
       2988
       +
       					const resetToken = createPasswordResetToken(user.id);

     

       2989
       2989
       +
       					const resetLink = `${origin}/reset-password?token=${resetToken}`;

     

       2990
       2990
       +
       

     

       2991
       2991
       +
       					// Send password reset email

     

       2992
       2992
       +
       					await sendEmail({

     

       2993
       2993
       +
       						to: user.email,

     

       2994
       2994
       +
       						subject: "Reset your password - Thistle",

     

       2995
       2995
       +
       						html: passwordResetTemplate({

     

       2996
       2996
       +
       							name: user.name,

     

       2997
       2997
       +
       							resetLink,

     

       2998
       2998
       +
       						}),

     

       2999
       2999
       +
       					});

     

       3000
       3000
       +
       

     

       3001
       3001
       +
       					return Response.json({

     

       3002
       3002
       +
       						success: true,

     

       3003
       3003
       +
       						message: "Password reset email sent",

     

       3004
       3004
       +
       					});

     

       1783
       3005
        
       				} catch (error) {

     

       3006
       3006
       +
       					console.error("[Admin] Password reset error:", error);

     

       1784
       3007
        
       					return handleError(error);

     

       1785
       3008
        
       				}

     

       1786
       3009
        
       			},

     
···

       1796
       3019
        
       

     

       1797
       3020
        
       					const { passkeyId } = req.params;

     

       1798
       3021
        
       					deletePasskey(passkeyId, userId);

     

       1799
       1799
       -
       					return Response.json({ success: true });

     

       3022
       3022
       +
       					return new Response(null, { status: 204 });

     

       1800
       3023
        
       				} catch (error) {

     

       1801
       3024
        
       					return handleError(error);

     

       1802
       3025
        
       				}

     
···

       1814
       3037
        
       					const body = await req.json();

     

       1815
       3038
        
       					const { name } = body as { name: string };

     

       1816
       3039
        
       

     

       1817
       1817
       -
       					if (!name || name.trim().length === 0) {

     

       3040
       3040
       +
       					const nameValidation = validateName(name);

     

       3041
       3041
       +
       					if (!nameValidation.valid) {

     

       1818
       3042
        
       						return Response.json(

     

       1819
       1819
       -
       							{ error: "Name cannot be empty" },

     

       3043
       3043
       +
       							{ error: nameValidation.error },

     

       1820
       3044
        
       							{ status: 400 },

     

       1821
       3045
        
       						);

     

       1822
       3046
        
       					}

     
···

       1838
       3062
        
       					}

     

       1839
       3063
        
       

     

       1840
       3064
        
       					const body = await req.json();

     

       1841
       1841
       -
       					const { email } = body as { email: string };

     

       3065
       3065
       +
       					const { email, skipVerification } = body as {

     

       3066
       3066
       +
       						email: string;

     

       3067
       3067
       +
       						skipVerification?: boolean;

     

       3068
       3068
       +
       					};

     

       1842
       3069
        
       

     

       1843
       1843
       -
       					if (!email || !email.includes("@")) {

     

       3070
       3070
       +
       					const emailValidation = validateEmail(email);

     

       3071
       3071
       +
       					if (!emailValidation.valid) {

     

       1844
       3072
        
       						return Response.json(

     

       1845
       1845
       -
       							{ error: "Invalid email address" },

     

       3073
       3073
       +
       							{ error: emailValidation.error },

     

       1846
       3074
        
       							{ status: 400 },

     

       1847
       3075
        
       						);

     

       1848
       3076
        
       					}

     
···

       1857
       3085
        
       					if (existing) {

     

       1858
       3086
        
       						return Response.json(

     

       1859
       3087
        
       							{ error: "Email already in use" },

     

       1860
       1860
       -
       							{ status: 400 },

     

       3088
       3088
       +
       							{ status: 409 },

     

       1861
       3089
        
       						);

     

       1862
       3090
        
       					}

     

       1863
       3091
        
       

     

       1864
       1864
       -
       					updateUserEmailAddress(userId, email);

     

       1865
       1865
       -
       					return Response.json({ success: true });

     

       3092
       3092
       +
       					if (skipVerification) {

     

       3093
       3093
       +
       						// Admin override: change email immediately without verification

     

       3094
       3094
       +
       						updateUserEmailAddress(userId, email);

     

       3095
       3095
       +
       						return Response.json({

     

       3096
       3096
       +
       							success: true,

     

       3097
       3097
       +
       							message: "Email updated immediately (verification skipped)",

     

       3098
       3098
       +
       						});

     

       3099
       3099
       +
       					}

     

       3100
       3100
       +
       

     

       3101
       3101
       +
       					// Get user's current email

     

       3102
       3102
       +
       					const user = db

     

       3103
       3103
       +
       						.query<{ email: string; name: string | null }, [number]>(

     

       3104
       3104
       +
       							"SELECT email, name FROM users WHERE id = ?",

     

       3105
       3105
       +
       						)

     

       3106
       3106
       +
       						.get(userId);

     

       3107
       3107
       +
       

     

       3108
       3108
       +
       					if (!user) {

     

       3109
       3109
       +
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3110
       3110
       +
       					}

     

       3111
       3111
       +
       

     

       3112
       3112
       +
       					// Send verification email to user's current email

     

       3113
       3113
       +
       					try {

     

       3114
       3114
       +
       						const token = createEmailChangeToken(userId, email);

     

       3115
       3115
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       3116
       3116
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       3117
       3117
       +
       

     

       3118
       3118
       +
       						await sendEmail({

     

       3119
       3119
       +
       							to: user.email,

     

       3120
       3120
       +
       							subject: "Verify your email change",

     

       3121
       3121
       +
       							html: emailChangeTemplate({

     

       3122
       3122
       +
       								name: user.name,

     

       3123
       3123
       +
       								currentEmail: user.email,

     

       3124
       3124
       +
       								newEmail: email,

     

       3125
       3125
       +
       								verifyLink: verifyUrl,

     

       3126
       3126
       +
       							}),

     

       3127
       3127
       +
       						});

     

       3128
       3128
       +
       

     

       3129
       3129
       +
       						return Response.json({

     

       3130
       3130
       +
       							success: true,

     

       3131
       3131
       +
       							message: `Verification email sent to ${user.email}`,

     

       3132
       3132
       +
       							pendingEmail: email,

     

       3133
       3133
       +
       						});

     

       3134
       3134
       +
       					} catch (emailError) {

     

       3135
       3135
       +
       						console.error(

     

       3136
       3136
       +
       							"[Admin] Failed to send email change verification:",

     

       3137
       3137
       +
       							emailError,

     

       3138
       3138
       +
       						);

     

       3139
       3139
       +
       						return Response.json(

     

       3140
       3140
       +
       							{ error: "Failed to send verification email" },

     

       3141
       3141
       +
       							{ status: 500 },

     

       3142
       3142
       +
       						);

     

       3143
       3143
       +
       					}

     

       1866
       3144
        
       				} catch (error) {

     

       1867
       3145
        
       					return handleError(error);

     

       1868
       3146
        
       				}

     
···

       1892
       3170
        
       					}

     

       1893
       3171
        
       

     

       1894
       3172
        
       					deleteAllUserSessions(userId);

     

       1895
       1895
       -
       					return Response.json({ success: true });

     

       3173
       3173
       +
       					return new Response(null, { status: 204 });

     

       1896
       3174
        
       				} catch (error) {

     

       1897
       3175
        
       					return handleError(error);

     

       1898
       3176
        
       				}

     
···

       1917
       3195
        
       						);

     

       1918
       3196
        
       					}

     

       1919
       3197
        
       

     

       1920
       1920
       -
       					return Response.json({ success: true });

     

       3198
       3198
       +
       					return new Response(null, { status: 204 });

     

       1921
       3199
        
       				} catch (error) {

     

       1922
       3200
        
       					return handleError(error);

     

       1923
       3201
        
       				}

     
···

       1979
       3257
        
       			GET: async (req) => {

     

       1980
       3258
        
       				try {

     

       1981
       3259
        
       					const user = requireAuth(req);

     

       1982
       1982
       -
       					const classes = getClassesForUser(user.id, user.role === "admin");

     

       3260
       3260
       +
       					const url = new URL(req.url);

     

       3261
       3261
       +
       

     

       3262
       3262
       +
       					const limit = Math.min(

     

       3263
       3263
       +
       						Number.parseInt(url.searchParams.get("limit") || "50", 10),

     

       3264
       3264
       +
       						100,

     

       3265
       3265
       +
       					);

     

       3266
       3266
       +
       					const cursor = url.searchParams.get("cursor") || undefined;

     

       3267
       3267
       +
       

     

       3268
       3268
       +
       					const result = getClassesForUser(

     

       3269
       3269
       +
       						user.id,

     

       3270
       3270
       +
       						user.role === "admin",

     

       3271
       3271
       +
       						limit,

     

       3272
       3272
       +
       						cursor,

     

       3273
       3273
       +
       					);

     

       1983
       3274
        
       

     

       1984
       1984
       -
       					// Group by semester/year

     

       3275
       3275
       +
       					// Group by semester/year for all users

     

       1985
       3276
        
       					const grouped: Record<

     

       1986
       3277
        
       						string,

     

       1987
       3278
        
       						Array<{

     
···

       1995
       3286
        
       						}>

     

       1996
       3287
        
       					> = {};

     

       1997
       3288
        
       

     

       1998
       1998
       -
       					for (const cls of classes) {

     

       3289
       3289
       +
       					for (const cls of result.data) {

     

       1999
       3290
        
       						const key = `${cls.semester} ${cls.year}`;

     

       2000
       3291
        
       						if (!grouped[key]) {

     

       2001
       3292
        
       							grouped[key] = [];

     
···

       2011
       3302
        
       						});

     

       2012
       3303
        
       					}

     

       2013
       3304
        
       

     

       2014
       2014
       -
       					return Response.json({ classes: grouped });

     

       3305
       3305
       +
       					return Response.json({

     

       3306
       3306
       +
       						classes: grouped,

     

       3307
       3307
       +
       						pagination: result.pagination,

     

       3308
       3308
       +
       					});

     

       2015
       3309
        
       				} catch (error) {

     

       2016
       3310
        
       					return handleError(error);

     

       2017
       3311
        
       				}

     
···

       2029
       3323
        
       						meeting_times,

     

       2030
       3324
        
       					} = body;

     

       2031
       3325
        
       

     

       2032
       2032
       -
       					if (!course_code || !name || !professor || !semester || !year) {

     

       3326
       3326
       +
       					// Validate all required fields

     

       3327
       3327
       +
       					const courseCodeValidation = validateCourseCode(course_code);

     

       3328
       3328
       +
       					if (!courseCodeValidation.valid) {

     

       3329
       3329
       +
       						return Response.json(

     

       3330
       3330
       +
       							{ error: courseCodeValidation.error },

     

       3331
       3331
       +
       							{ status: 400 },

     

       3332
       3332
       +
       						);

     

       3333
       3333
       +
       					}

     

       3334
       3334
       +
       

     

       3335
       3335
       +
       					const nameValidation = validateCourseName(name);

     

       3336
       3336
       +
       					if (!nameValidation.valid) {

     

       3337
       3337
       +
       						return Response.json(

     

       3338
       3338
       +
       							{ error: nameValidation.error },

     

       3339
       3339
       +
       							{ status: 400 },

     

       3340
       3340
       +
       						);

     

       3341
       3341
       +
       					}

     

       3342
       3342
       +
       

     

       3343
       3343
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3344
       3344
       +
       					if (!professorValidation.valid) {

     

       3345
       3345
       +
       						return Response.json(

     

       3346
       3346
       +
       							{ error: professorValidation.error },

     

       3347
       3347
       +
       							{ status: 400 },

     

       3348
       3348
       +
       						);

     

       3349
       3349
       +
       					}

     

       3350
       3350
       +
       

     

       3351
       3351
       +
       					const semesterValidation = validateSemester(semester);

     

       3352
       3352
       +
       					if (!semesterValidation.valid) {

     

       3353
       3353
       +
       						return Response.json(

     

       3354
       3354
       +
       							{ error: semesterValidation.error },

     

       3355
       3355
       +
       							{ status: 400 },

     

       3356
       3356
       +
       						);

     

       3357
       3357
       +
       					}

     

       3358
       3358
       +
       

     

       3359
       3359
       +
       					const yearValidation = validateYear(year);

     

       3360
       3360
       +
       					if (!yearValidation.valid) {

     

       2033
       3361
        
       						return Response.json(

     

       2034
       2034
       -
       							{ error: "Missing required fields" },

     

       3362
       3362
       +
       							{ error: yearValidation.error },

     

       2035
       3363
        
       							{ status: 400 },

     

       2036
       3364
        
       						);

     

       2037
       3365
        
       					}

     
···

       2043
       3371
        
       						semester,

     

       2044
       3372
        
       						year,

     

       2045
       3373
        
       						meeting_times,

     

       3374
       3374
       +
       						sections: body.sections,

     

       2046
       3375
        
       					});

     

       2047
       3376
        
       

     

       2048
       2048
       -
       					return Response.json(newClass);

     

       3377
       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       2049
       3378
        
       				} catch (error) {

     

       2050
       3379
        
       					return handleError(error);

     

       2051
       3380
        
       				}

     
···

       2072
       3401
        
       						.all(user.id)

     

       2073
       3402
        
       						.map((row) => row.class_id);

     

       2074
       3403
        
       

     

       2075
       2075
       -
       					// Add is_enrolled flag to each class

     

       3404
       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       2076
       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       2077
       3406
        
       						...cls,

     

       2078
       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       3408
       +
       						sections: getClassSections(cls.id),

     

       2079
       3409
        
       					}));

     

       2080
       3410
        
       

     

       2081
       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       2090
       3420
        
       					const user = requireAuth(req);

     

       2091
       3421
        
       					const body = await req.json();

     

       2092
       3422
        
       					const classId = body.class_id;

     

       3423
       3423
       +
       					const sectionId = body.section_id || null;

     

       2093
       3424
        
       

     

       2094
       2094
       -
       					if (!classId || typeof classId !== "string") {

     

       3425
       3425
       +
       					const classIdValidation = validateClassId(classId);

     

       3426
       3426
       +
       					if (!classIdValidation.valid) {

     

       2095
       3427
        
       						return Response.json(

     

       2096
       2096
       -
       							{ error: "Class ID required" },

     

       3428
       3428
       +
       							{ error: classIdValidation.error },

     

       2097
       3429
        
       							{ status: 400 },

     

       2098
       3430
        
       						);

     

       2099
       3431
        
       					}

     

       2100
       3432
        
       

     

       2101
       2101
       -
       					const result = joinClass(classId, user.id);

     

       3433
       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       2102
       3434
        
       

     

       2103
       3435
        
       					if (!result.success) {

     

       2104
       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       2105
       3437
        
       					}

     

       2106
       3438
        
       

     

       2107
       2107
       -
       					return Response.json({ success: true });

     

       3439
       3439
       +
       					return new Response(null, { status: 204 });

     

       2108
       3440
        
       				} catch (error) {

     

       2109
       3441
        
       					return handleError(error);

     

       2110
       3442
        
       				}

     
···

       2126
       3458
        
       						meetingTimes,

     

       2127
       3459
        
       					} = body;

     

       2128
       3460
        
       

     

       2129
       2129
       -
       					if (!courseCode || !courseName || !professor || !semester || !year) {

     

       3461
       3461
       +
       					// Validate all required fields

     

       3462
       3462
       +
       					const courseCodeValidation = validateCourseCode(courseCode);

     

       3463
       3463
       +
       					if (!courseCodeValidation.valid) {

     

       3464
       3464
       +
       						return Response.json(

     

       3465
       3465
       +
       							{ error: courseCodeValidation.error },

     

       3466
       3466
       +
       							{ status: 400 },

     

       3467
       3467
       +
       						);

     

       3468
       3468
       +
       					}

     

       3469
       3469
       +
       

     

       3470
       3470
       +
       					const nameValidation = validateCourseName(courseName);

     

       3471
       3471
       +
       					if (!nameValidation.valid) {

     

       3472
       3472
       +
       						return Response.json(

     

       3473
       3473
       +
       							{ error: nameValidation.error },

     

       3474
       3474
       +
       							{ status: 400 },

     

       3475
       3475
       +
       						);

     

       3476
       3476
       +
       					}

     

       3477
       3477
       +
       

     

       3478
       3478
       +
       					const professorValidation = validateName(professor, "Professor name");

     

       3479
       3479
       +
       					if (!professorValidation.valid) {

     

       3480
       3480
       +
       						return Response.json(

     

       3481
       3481
       +
       							{ error: professorValidation.error },

     

       3482
       3482
       +
       							{ status: 400 },

     

       3483
       3483
       +
       						);

     

       3484
       3484
       +
       					}

     

       3485
       3485
       +
       

     

       3486
       3486
       +
       					const semesterValidation = validateSemester(semester);

     

       3487
       3487
       +
       					if (!semesterValidation.valid) {

     

       3488
       3488
       +
       						return Response.json(

     

       3489
       3489
       +
       							{ error: semesterValidation.error },

     

       3490
       3490
       +
       							{ status: 400 },

     

       3491
       3491
       +
       						);

     

       3492
       3492
       +
       					}

     

       3493
       3493
       +
       

     

       3494
       3494
       +
       					const yearValidation = validateYear(

     

       3495
       3495
       +
       						typeof year === "string" ? Number.parseInt(year, 10) : year,

     

       3496
       3496
       +
       					);

     

       3497
       3497
       +
       					if (!yearValidation.valid) {

     

       2130
       3498
        
       						return Response.json(

     

       2131
       2131
       -
       							{ error: "Missing required fields" },

     

       3499
       3499
       +
       							{ error: yearValidation.error },

     

       2132
       3500
        
       							{ status: 400 },

     

       2133
       3501
        
       						);

     

       2134
       3502
        
       					}

     
···

       2144
       3512
        
       						meetingTimes || null,

     

       2145
       3513
        
       					);

     

       2146
       3514
        
       

     

       2147
       2147
       -
       					return Response.json({ success: true, id });

     

       3515
       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       2148
       3516
        
       				} catch (error) {

     

       2149
       3517
        
       					return handleError(error);

     

       2150
       3518
        
       				}

     
···

       2171
       3539
        
       					}

     

       2172
       3540
        
       

     

       2173
       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       3542
       +
       					const sections = getClassSections(classId);

     

       2174
       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       2175
       3545
        
       

     

       2176
       3546
        
       					return Response.json({

     

       2177
       3547
        
       						class: classInfo,

     

       2178
       3548
        
       						meetingTimes,

     

       3549
       3549
       +
       						sections,

     

       3550
       3550
       +
       						userSection,

     

       2179
       3551
        
       						transcriptions,

     

       2180
       3552
        
       					});

     

       2181
       3553
        
       				} catch (error) {

     
···

       2187
       3559
        
       					requireAdmin(req);

     

       2188
       3560
        
       					const classId = req.params.id;

     

       2189
       3561
        
       

     

       3562
       3562
       +
       					// Verify class exists

     

       3563
       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       3564
       +
       					if (!existingClass) {

     

       3565
       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       3566
       +
       					}

     

       3567
       3567
       +
       

     

       2190
       3568
        
       					deleteClass(classId);

     

       2191
       2191
       -
       					return Response.json({ success: true });

     

       3569
       3569
       +
       					return new Response(null, { status: 204 });

     

       2192
       3570
        
       				} catch (error) {

     

       2193
       3571
        
       					return handleError(error);

     

       2194
       3572
        
       				}

     
···

       2209
       3587
        
       						);

     

       2210
       3588
        
       					}

     

       2211
       3589
        
       

     

       3590
       3590
       +
       					// Verify class exists

     

       3591
       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       3592
       +
       					if (!existingClass) {

     

       3593
       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
       3594
       +
       					}

     

       3595
       3595
       +
       

     

       2212
       3596
        
       					toggleClassArchive(classId, archived);

     

       2213
       2213
       -
       					return Response.json({ success: true });

     

       3597
       3597
       +
       					return new Response(null, { status: 204 });

     

       2214
       3598
        
       				} catch (error) {

     

       2215
       3599
        
       					return handleError(error);

     

       2216
       3600
        
       				}

     
···

       2239
       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       2240
       3624
        
       					}

     

       2241
       3625
        
       

     

       3626
       3626
       +
       					// Verify class exists

     

       3627
       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       3628
       +
       					if (!existingClass) {

     

       3629
       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       3630
       +
       					}

     

       3631
       3631
       +
       

     

       2242
       3632
        
       					const user = getUserByEmail(email);

     

       2243
       3633
        
       					if (!user) {

     

       2244
       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       2245
       3635
        
       					}

     

       2246
       3636
        
       

     

       2247
       3637
        
       					enrollUserInClass(user.id, classId);

     

       2248
       2248
       -
       					return Response.json({ success: true });

     

       3638
       3638
       +
       					return new Response(null, { status: 201 });

     

       2249
       3639
        
       				} catch (error) {

     

       2250
       3640
        
       					return handleError(error);

     

       2251
       3641
        
       				}

     
···

       2262
       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2263
       3653
        
       					}

     

       2264
       3654
        
       

     

       3655
       3655
       +
       					// Verify class exists

     

       3656
       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       3657
       +
       					if (!existingClass) {

     

       3658
       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       3659
       +
       					}

     

       3660
       3660
       +
       

     

       2265
       3661
        
       					removeUserFromClass(userId, classId);

     

       2266
       2266
       -
       					return Response.json({ success: true });

     

       3662
       3662
       +
       					return new Response(null, { status: 204 });

     

       2267
       3663
        
       				} catch (error) {

     

       2268
       3664
        
       					return handleError(error);

     

       2269
       3665
        
       				}

     
···

       2301
       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2302
       3698
        
       					}

     

       2303
       3699
        
       

     

       3700
       3700
       +
       					// Verify class exists

     

       3701
       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       3702
       +
       					if (!existingClass) {

     

       3703
       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       3704
       +
       					}

     

       3705
       3705
       +
       

     

       2304
       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       2305
       2305
       -
       					return Response.json(meetingTime);

     

       3707
       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       3708
       +
       				} catch (error) {

     

       3709
       3709
       +
       					return handleError(error);

     

       3710
       3710
       +
       				}

     

       3711
       3711
       +
       			},

     

       3712
       3712
       +
       		},

     

       3713
       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       3714
       +
       			POST: async (req) => {

     

       3715
       3715
       +
       				try {

     

       3716
       3716
       +
       					requireAdmin(req);

     

       3717
       3717
       +
       					const classId = req.params.id;

     

       3718
       3718
       +
       					const body = await req.json();

     

       3719
       3719
       +
       					const { section_number } = body;

     

       3720
       3720
       +
       

     

       3721
       3721
       +
       					if (!section_number) {

     

       3722
       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       3723
       +
       					}

     

       3724
       3724
       +
       

     

       3725
       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       3726
       +
       					return Response.json(section);

     

       3727
       3727
       +
       				} catch (error) {

     

       3728
       3728
       +
       					return handleError(error);

     

       3729
       3729
       +
       				}

     

       3730
       3730
       +
       			},

     

       3731
       3731
       +
       		},

     

       3732
       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       3733
       +
       			DELETE: async (req) => {

     

       3734
       3734
       +
       				try {

     

       3735
       3735
       +
       					requireAdmin(req);

     

       3736
       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       3737
       +
       

     

       3738
       3738
       +
       					// Check if any students are in this section

     

       3739
       3739
       +
       					const studentsInSection = db

     

       3740
       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       3742
       +
       						)

     

       3743
       3743
       +
       						.get(sectionId);

     

       3744
       3744
       +
       

     

       3745
       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       3746
       +
       						return Response.json(

     

       3747
       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       3748
       +
       							{ status: 400 },

     

       3749
       3749
       +
       						);

     

       3750
       3750
       +
       					}

     

       3751
       3751
       +
       

     

       3752
       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       3753
       +
       					return new Response(null, { status: 204 });

     

       2306
       3754
        
       				} catch (error) {

     

       2307
       3755
        
       					return handleError(error);

     

       2308
       3756
        
       				}

     
···

       2320
       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       2321
       3769
        
       					}

     

       2322
       3770
        
       

     

       3771
       3771
       +
       					// Verify meeting exists

     

       3772
       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       3773
       +
       					if (!existingMeeting) {

     

       3774
       3774
       +
       						return Response.json(

     

       3775
       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       3776
       +
       							{ status: 404 },

     

       3777
       3777
       +
       						);

     

       3778
       3778
       +
       					}

     

       3779
       3779
       +
       

     

       2323
       3780
        
       					updateMeetingTime(meetingId, label);

     

       2324
       2324
       -
       					return Response.json({ success: true });

     

       3781
       3781
       +
       					return new Response(null, { status: 204 });

     

       2325
       3782
        
       				} catch (error) {

     

       2326
       3783
        
       					return handleError(error);

     

       2327
       3784
        
       				}

     
···

       2331
       3788
        
       					requireAdmin(req);

     

       2332
       3789
        
       					const meetingId = req.params.id;

     

       2333
       3790
        
       

     

       3791
       3791
       +
       					// Verify meeting exists

     

       3792
       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       3793
       +
       					if (!existingMeeting) {

     

       3794
       3794
       +
       						return Response.json(

     

       3795
       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       3796
       +
       							{ status: 404 },

     

       3797
       3797
       +
       						);

     

       3798
       3798
       +
       					}

     

       3799
       3799
       +
       

     

       2334
       3800
        
       					deleteMeetingTime(meetingId);

     

       2335
       2335
       -
       					return Response.json({ success: true });

     

       3801
       3801
       +
       					return new Response(null, { status: 204 });

     

       2336
       3802
        
       				} catch (error) {

     

       2337
       3803
        
       					return handleError(error);

     

       2338
       3804
        
       				}

     
···

       2344
       3810
        
       					requireAdmin(req);

     

       2345
       3811
        
       					const transcriptId = req.params.id;

     

       2346
       3812
        
       

     

       3813
       3813
       +
       					// Check if transcription exists and get its current status

     

       3814
       3814
       +
       					const transcription = db

     

       3815
       3815
       +
       						.query<{ filename: string; status: string }, [string]>(

     

       3816
       3816
       +
       							"SELECT filename, status FROM transcriptions WHERE id = ?",

     

       3817
       3817
       +
       						)

     

       3818
       3818
       +
       						.get(transcriptId);

     

       3819
       3819
       +
       

     

       3820
       3820
       +
       					if (!transcription) {

     

       3821
       3821
       +
       						return Response.json(

     

       3822
       3822
       +
       							{ error: "Transcription not found" },

     

       3823
       3823
       +
       							{ status: 404 },

     

       3824
       3824
       +
       						);

     

       3825
       3825
       +
       					}

     

       3826
       3826
       +
       

     

       3827
       3827
       +
       					// Validate that status is appropriate for selection (e.g., 'uploading' or 'pending')

     

       3828
       3828
       +
       					const validStatuses = ["uploading", "pending", "failed"];

     

       3829
       3829
       +
       					if (!validStatuses.includes(transcription.status)) {

     

       3830
       3830
       +
       						return Response.json(

     

       3831
       3831
       +
       							{

     

       3832
       3832
       +
       								error: `Cannot select transcription with status: ${transcription.status}`,

     

       3833
       3833
       +
       							},

     

       3834
       3834
       +
       							{ status: 400 },

     

       3835
       3835
       +
       						);

     

       3836
       3836
       +
       					}

     

       3837
       3837
       +
       

     

       2347
       3838
        
       					// Update status to 'selected' and start transcription

     

       2348
       3839
        
       					db.run("UPDATE transcriptions SET status = ? WHERE id = ?", [

     

       2349
       3840
        
       						"selected",

     

       2350
       3841
        
       						transcriptId,

     

       2351
       3842
        
       					]);

     

       2352
       3843
        
       

     

       2353
       2353
       -
       					// Get filename to start transcription

     

       2354
       2354
       -
       					const transcription = db

     

       2355
       2355
       -
       						.query<{ filename: string }, [string]>(

     

       2356
       2356
       -
       							"SELECT filename FROM transcriptions WHERE id = ?",

     

       2357
       2357
       -
       						)

     

       2358
       2358
       -
       						.get(transcriptId);

     

       3844
       3844
       +
       					whisperService.startTranscription(

     

       3845
       3845
       +
       						transcriptId,

     

       3846
       3846
       +
       						transcription.filename,

     

       3847
       3847
       +
       					);

     

       2359
       3848
        
       

     

       2360
       2360
       -
       					if (transcription) {

     

       2361
       2361
       -
       						whisperService.startTranscription(

     

       2362
       2362
       -
       							transcriptId,

     

       2363
       2363
       -
       							transcription.filename,

     

       2364
       2364
       -
       						);

     

       2365
       2365
       -
       					}

     

       2366
       2366
       -
       

     

       2367
       2367
       -
       					return Response.json({ success: true });

     

       3849
       3849
       +
       					return new Response(null, { status: 204 });

     

       2368
       3850
        
       				} catch (error) {

     

       2369
       3851
        
       					return handleError(error);

     

       2370
       3852
        
       				}

     

       2371
       3853
        
       			},

     

       2372
       3854
        
       		},

     

       2373
       3855
        
       	},

     

       2374
       2374
       -
       	development: {

     

       2375
       2375
       -
       		hmr: true,

     

       2376
       2376
       -
       		console: true,

     

       3856
       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       3857
       +
       	fetch(req, server) {

     

       3858
       3858
       +
       		const response = server.fetch(req);

     

       3859
       3859
       +
       

     

       3860
       3860
       +
       		// Add security headers to all responses

     

       3861
       3861
       +
       		if (response instanceof Response) {

     

       3862
       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       3867
       +
       

     

       3868
       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       3870
       +
       			headers.set(

     

       3871
       3871
       +
       				"Content-Security-Policy",

     

       3872
       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       3873
       +
       			);

     

       3874
       3874
       +
       

     

       3875
       3875
       +
       			return new Response(response.body, {

     

       3876
       3876
       +
       				status: response.status,

     

       3877
       3877
       +
       				statusText: response.statusText,

     

       3878
       3878
       +
       				headers,

     

       3879
       3879
       +
       			});

     

       3880
       3880
       +
       		}

     

       3881
       3881
       +
       

     

       3882
       3882
       +
       		return response;

     

       2377
       3883
        
       	},

     

       2378
       3884
        
       });

     

       2379
       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

     

       3886
       3886
       +
       

     

       3887
       3887
       +
       // Track active SSE streams for graceful shutdown

     

       3888
       3888
       +
       const activeSSEStreams = new Set<ReadableStreamDefaultController>();

     

       3889
       3889
       +
       

     

       3890
       3890
       +
       // Graceful shutdown handler

     

       3891
       3891
       +
       let isShuttingDown = false;

     

       3892
       3892
       +
       

     

       3893
       3893
       +
       async function shutdown(signal: string) {

     

       3894
       3894
       +
       	if (isShuttingDown) return;

     

       3895
       3895
       +
       	isShuttingDown = true;

     

       3896
       3896
       +
       

     

       3897
       3897
       +
       	console.log(`\n${signal} received, starting graceful shutdown...`);

     

       3898
       3898
       +
       

     

       3899
       3899
       +
       	// 1. Stop accepting new requests

     

       3900
       3900
       +
       	console.log("[Shutdown] Closing server...");

     

       3901
       3901
       +
       	server.stop();

     

       3902
       3902
       +
       

     

       3903
       3903
       +
       	// 2. Close all active SSE streams (safe to kill - sync will handle reconnection)

     

       3904
       3904
       +
       	console.log(

     

       3905
       3905
       +
       		`[Shutdown] Closing ${activeSSEStreams.size} active SSE streams...`,

     

       3906
       3906
       +
       	);

     

       3907
       3907
       +
       	for (const controller of activeSSEStreams) {

     

       3908
       3908
       +
       		try {

     

       3909
       3909
       +
       			controller.close();

     

       3910
       3910
       +
       		} catch {

     

       3911
       3911
       +
       			// Already closed

     

       3912
       3912
       +
       		}

     

       3913
       3913
       +
       	}

     

       3914
       3914
       +
       	activeSSEStreams.clear();

     

       3915
       3915
       +
       

     

       3916
       3916
       +
       	// 3. Stop transcription service (closes streams to Murmur)

     

       3917
       3917
       +
       	whisperService.stop();

     

       3918
       3918
       +
       

     

       3919
       3919
       +
       	// 4. Stop cleanup intervals

     

       3920
       3920
       +
       	console.log("[Shutdown] Stopping cleanup intervals...");

     

       3921
       3921
       +
       	clearInterval(sessionCleanupInterval);

     

       3922
       3922
       +
       	clearInterval(syncInterval);

     

       3923
       3923
       +
       	clearInterval(fileCleanupInterval);

     

       3924
       3924
       +
       

     

       3925
       3925
       +
       	// 5. Close database connections

     

       3926
       3926
       +
       	console.log("[Shutdown] Closing database...");

     

       3927
       3927
       +
       	db.close();

     

       3928
       3928
       +
       

     

       3929
       3929
       +
       	console.log("[Shutdown] Complete");

     

       3930
       3930
       +
       	process.exit(0);

     

       3931
       3931
       +
       }

     

       3932
       3932
       +
       

     

       3933
       3933
       +
       // Register shutdown handlers

     

       3934
       3934
       +
       process.on("SIGTERM", () => shutdown("SIGTERM"));

     

       3935
       3935
       +
       process.on("SIGINT", () => shutdown("SIGINT"));

+136

src/lib/api-response-format.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * API Response Format Standards

     

       5
       5
       +
        *

     

       6
       6
       +
        * This test documents the standardized response formats across the API.

     

       7
       7
       +
        * All endpoints should follow these patterns for consistency.

     

       8
       8
       +
        */

     

       9
       9
       +
       

     

       10
       10
       +
       describe("API Response Format Standards", () => {

     

       11
       11
       +
       	test("success responses should include success: true", () => {

     

       12
       12
       +
       		// Success-only responses (no data returned)

     

       13
       13
       +
       		const successOnly = { success: true };

     

       14
       14
       +
       		expect(successOnly).toHaveProperty("success", true);

     

       15
       15
       +
       

     

       16
       16
       +
       		// Success with message

     

       17
       17
       +
       		const successWithMessage = {

     

       18
       18
       +
       			success: true,

     

       19
       19
       +
       			message: "Operation completed successfully",

     

       20
       20
       +
       		};

     

       21
       21
       +
       		expect(successWithMessage).toHaveProperty("success", true);

     

       22
       22
       +
       		expect(successWithMessage).toHaveProperty("message");

     

       23
       23
       +
       

     

       24
       24
       +
       		// Success with data

     

       25
       25
       +
       		const successWithData = {

     

       26
       26
       +
       			success: true,

     

       27
       27
       +
       			data: { id: 1, name: "Test" },

     

       28
       28
       +
       		};

     

       29
       29
       +
       		expect(successWithData).toHaveProperty("success", true);

     

       30
       30
       +
       		expect(successWithData).toHaveProperty("data");

     

       31
       31
       +
       	});

     

       32
       32
       +
       

     

       33
       33
       +
       	test("error responses should use error field", () => {

     

       34
       34
       +
       		const errorResponse = { error: "Something went wrong" };

     

       35
       35
       +
       		expect(errorResponse).toHaveProperty("error");

     

       36
       36
       +
       		expect(typeof errorResponse.error).toBe("string");

     

       37
       37
       +
       	});

     

       38
       38
       +
       

     

       39
       39
       +
       	test("data responses can return data directly", () => {

     

       40
       40
       +
       		// Direct data return (common pattern for GET endpoints)

     

       41
       41
       +
       		const userData = {

     

       42
       42
       +
       			user: { id: 1, email: "test@example.com" },

     

       43
       43
       +
       			has_subscription: true,

     

       44
       44
       +
       		};

     

       45
       45
       +
       		expect(userData).toHaveProperty("user");

     

       46
       46
       +
       

     

       47
       47
       +
       		// List responses

     

       48
       48
       +
       		const listData = {

     

       49
       49
       +
       			jobs: [{ id: "1" }, { id: "2" }],

     

       50
       50
       +
       			pagination: { limit: 50, hasMore: false, nextCursor: null },

     

       51
       51
       +
       		};

     

       52
       52
       +
       		expect(listData).toHaveProperty("jobs");

     

       53
       53
       +
       		expect(listData).toHaveProperty("pagination");

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("message-only responses are converted to success+message", () => {

     

       57
       57
       +
       		// OLD (deprecated): { message: "..." }

     

       58
       58
       +
       		// NEW (standard): { success: true, message: "..." }

     

       59
       59
       +
       

     

       60
       60
       +
       		const newFormat = {

     

       61
       61
       +
       			success: true,

     

       62
       62
       +
       			message: "Verification email sent",

     

       63
       63
       +
       		};

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(newFormat).toHaveProperty("success", true);

     

       66
       66
       +
       		expect(newFormat).toHaveProperty("message");

     

       67
       67
       +
       	});

     

       68
       68
       +
       });

     

       69
       69
       +
       

     

       70
       70
       +
       describe("API Response Patterns", () => {

     

       71
       71
       +
       	test("authentication responses", () => {

     

       72
       72
       +
       		// Login success

     

       73
       73
       +
       		const login = {

     

       74
       74
       +
       			user: { id: 1, email: "test@example.com" },

     

       75
       75
       +
       			email_verification_required: false,

     

       76
       76
       +
       		};

     

       77
       77
       +
       		expect(login).toHaveProperty("user");

     

       78
       78
       +
       

     

       79
       79
       +
       		// Logout success

     

       80
       80
       +
       		const logout = { success: true };

     

       81
       81
       +
       		expect(logout.success).toBe(true);

     

       82
       82
       +
       

     

       83
       83
       +
       		// Email verified

     

       84
       84
       +
       		const verified = {

     

       85
       85
       +
       			success: true,

     

       86
       86
       +
       			message: "Email verified successfully",

     

       87
       87
       +
       			email_verified: true,

     

       88
       88
       +
       			user: { id: 1, email: "test@example.com" },

     

       89
       89
       +
       		};

     

       90
       90
       +
       		expect(verified.success).toBe(true);

     

       91
       91
       +
       		expect(verified).toHaveProperty("message");

     

       92
       92
       +
       	});

     

       93
       93
       +
       

     

       94
       94
       +
       	test("CRUD operation responses", () => {

     

       95
       95
       +
       		// Create (returns created object)

     

       96
       96
       +
       		const created = {

     

       97
       97
       +
       			id: "123",

     

       98
       98
       +
       			name: "New Item",

     

       99
       99
       +
       			created_at: Date.now(),

     

       100
       100
       +
       		};

     

       101
       101
       +
       		expect(created).toHaveProperty("id");

     

       102
       102
       +
       

     

       103
       103
       +
       		// Update (returns success)

     

       104
       104
       +
       		const updated = { success: true };

     

       105
       105
       +
       		expect(updated.success).toBe(true);

     

       106
       106
       +
       

     

       107
       107
       +
       		// Delete (returns success)

     

       108
       108
       +
       		const deleted = { success: true };

     

       109
       109
       +
       		expect(deleted.success).toBe(true);

     

       110
       110
       +
       

     

       111
       111
       +
       		// Get (returns data directly)

     

       112
       112
       +
       		const fetched = {

     

       113
       113
       +
       			id: "123",

     

       114
       114
       +
       			name: "Item",

     

       115
       115
       +
       		};

     

       116
       116
       +
       		expect(fetched).toHaveProperty("id");

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("paginated list responses", () => {

     

       120
       120
       +
       		const paginatedList = {

     

       121
       121
       +
       			data: [{ id: "1" }, { id: "2" }],

     

       122
       122
       +
       			pagination: {

     

       123
       123
       +
       				limit: 50,

     

       124
       124
       +
       				hasMore: true,

     

       125
       125
       +
       				nextCursor: "MTczMjM5NjgwMHx0cmFucy0xMjM",

     

       126
       126
       +
       			},

     

       127
       127
       +
       		};

     

       128
       128
       +
       

     

       129
       129
       +
       		expect(paginatedList).toHaveProperty("data");

     

       130
       130
       +
       		expect(Array.isArray(paginatedList.data)).toBe(true);

     

       131
       131
       +
       		expect(paginatedList).toHaveProperty("pagination");

     

       132
       132
       +
       		expect(paginatedList.pagination).toHaveProperty("limit");

     

       133
       133
       +
       		expect(paginatedList.pagination).toHaveProperty("hasMore");

     

       134
       134
       +
       		expect(paginatedList.pagination).toHaveProperty("nextCursor");

     

       135
       135
       +
       	});

     

       136
       136
       +
       });

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       3
       +
       

     

       4
       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       6
       +
       

     

       7
       7
       +
       	// Clean up test file after tests

     

       8
       8
       +
       	afterAll(async () => {

     

       9
       9
       +
       		try {

     

       10
       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       11
       +
       				if (exists) {

     

       12
       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       13
       +
       				}

     

       14
       14
       +
       			});

     

       15
       15
       +
       		} catch {

     

       16
       16
       +
       			// Ignore cleanup errors

     

       17
       17
       +
       		}

     

       18
       18
       +
       	});

     

       19
       19
       +
       

     

       20
       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       24
       +
       

     

       25
       25
       +
       		// Create the file with metadata

     

       26
       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       27
       +
       

     

       28
       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       29
       +
       

     

       30
       30
       +
       		expect(date).not.toBeNull();

     

       31
       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       34
       +
       	});

     

       35
       35
       +
       

     

       36
       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       37
       +
       		// Create audio file without metadata

     

       38
       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       39
       +
       

     

       40
       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       41
       +
       

     

       42
       42
       +
       		// Should use file modification time as fallback

     

       43
       43
       +
       		expect(date).not.toBeNull();

     

       44
       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       45
       +
       		// Should be very recent (within last minute)

     

       46
       46
       +
       		const now = new Date();

     

       47
       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       49
       +
       	});

     

       50
       50
       +
       

     

       51
       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       53
       +
       		expect(date).toBeNull();

     

       54
       54
       +
       	});

     

       55
       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	findMatchingMeetingTime,

     

       4
       4
       +
       	getDayName,

     

       5
       5
       +
       	getDayOfWeek,

     

       6
       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       7
       +
       } from "./audio-metadata";

     

       8
       8
       +
       

     

       9
       9
       +
       describe("getDayOfWeek", () => {

     

       10
       10
       +
       	test("returns correct day number", () => {

     

       11
       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       14
       +
       

     

       15
       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       18
       +
       

     

       19
       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       22
       +
       	});

     

       23
       23
       +
       });

     

       24
       24
       +
       

     

       25
       25
       +
       describe("getDayName", () => {

     

       26
       26
       +
       	test("returns correct day name", () => {

     

       27
       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       34
       +
       	});

     

       35
       35
       +
       });

     

       36
       36
       +
       

     

       37
       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       38
       +
       	test("matches full day names", () => {

     

       39
       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       42
       +
       			true,

     

       43
       43
       +
       		);

     

       44
       44
       +
       	});

     

       45
       45
       +
       

     

       46
       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       50
       +
       			true,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       56
       +
       	});

     

       57
       57
       +
       

     

       58
       58
       +
       	test("is case insensitive", () => {

     

       59
       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       62
       +
       	});

     

       63
       63
       +
       

     

       64
       64
       +
       	test("does not match wrong days", () => {

     

       65
       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       68
       +
       	});

     

       69
       69
       +
       

     

       70
       70
       +
       	test("handles labels without day names", () => {

     

       71
       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       74
       +
       	});

     

       75
       75
       +
       });

     

       76
       76
       +
       

     

       77
       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       78
       +
       	const meetingTimes = [

     

       79
       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       82
       +
       	];

     

       83
       83
       +
       

     

       84
       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       87
       +
       

     

       88
       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       90
       +
       

     

       91
       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       93
       +
       	});

     

       94
       94
       +
       

     

       95
       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       96
       +
       		const abbrevMeetingTimes = [

     

       97
       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       100
       +
       		];

     

       101
       101
       +
       

     

       102
       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("returns null when no match found", () => {

     

       107
       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       109
       +
       

     

       110
       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       112
       +
       	});

     

       113
       113
       +
       

     

       114
       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       120
       +
       		const duplicateMeetingTimes = [

     

       121
       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       123
       +
       		];

     

       124
       124
       +
       

     

       125
       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       127
       +
       	});

     

       128
       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       1
       +
       import { $ } from "bun";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       6
       +
        * @param filePath Path to audio file

     

       7
       7
       +
        * @returns Date object or null if not found

     

       8
       8
       +
        */

     

       9
       9
       +
       export async function extractAudioCreationDate(

     

       10
       10
       +
       	filePath: string,

     

       11
       11
       +
       ): Promise<Date | null> {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       14
       +
       		// -v quiet: suppress verbose output

     

       15
       15
       +
       		// -print_format json: output as JSON

     

       16
       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       17
       +
       		const result =

     

       18
       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       19
       +
       

     

       20
       20
       +
       		const metadata = JSON.parse(result);

     

       21
       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       22
       +
       

     

       23
       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       24
       +
       		const dateFields = [

     

       25
       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       26
       +
       			tags.date, // Common date field

     

       27
       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       28
       +
       			tags.year, // Year field

     

       29
       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       33
       +
       		];

     

       34
       34
       +
       

     

       35
       35
       +
       		for (const dateField of dateFields) {

     

       36
       36
       +
       			if (dateField) {

     

       37
       37
       +
       				const date = new Date(dateField);

     

       38
       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       39
       +
       					console.log(

     

       40
       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       41
       +
       					);

     

       42
       42
       +
       					return date;

     

       43
       43
       +
       				}

     

       44
       44
       +
       			}

     

       45
       45
       +
       		}

     

       46
       46
       +
       

     

       47
       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       49
       +
       		console.log(

     

       50
       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		const file = Bun.file(filePath);

     

       53
       53
       +
       		const stat = await file.stat();

     

       54
       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       55
       +
       		console.log(

     

       56
       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       57
       +
       		);

     

       58
       58
       +
       		return date;

     

       59
       59
       +
       	} catch (error) {

     

       60
       60
       +
       		console.error(

     

       61
       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       63
       +
       		);

     

       64
       64
       +
       		return null;

     

       65
       65
       +
       	}

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       72
       +
       	return date.getDay();

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       /**

     

       76
       76
       +
        * Gets day name from a date

     

       77
       77
       +
        */

     

       78
       78
       +
       export function getDayName(date: Date): string {

     

       79
       79
       +
       	const days = [

     

       80
       80
       +
       		"Sunday",

     

       81
       81
       +
       		"Monday",

     

       82
       82
       +
       		"Tuesday",

     

       83
       83
       +
       		"Wednesday",

     

       84
       84
       +
       		"Thursday",

     

       85
       85
       +
       		"Friday",

     

       86
       86
       +
       		"Saturday",

     

       87
       87
       +
       	];

     

       88
       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       89
       +
       }

     

       90
       90
       +
       

     

       91
       91
       +
       /**

     

       92
       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       94
       +
        */

     

       95
       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       96
       +
       	label: string,

     

       97
       97
       +
       	dayName: string,

     

       98
       98
       +
       ): boolean {

     

       99
       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       101
       +
       

     

       102
       102
       +
       	// Check for full day name

     

       103
       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       104
       +
       		return true;

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	// Check for 3-letter abbreviations

     

       108
       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       110
       +
       		return true;

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	return false;

     

       114
       114
       +
       }

     

       115
       115
       +
       

     

       116
       116
       +
       /**

     

       117
       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       118
       +
        * @param date Date from audio metadata

     

       119
       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       121
       +
        */

     

       122
       122
       +
       export function findMatchingMeetingTime(

     

       123
       123
       +
       	date: Date,

     

       124
       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       125
       +
       ): string | null {

     

       126
       126
       +
       	const dayName = getDayName(date);

     

       127
       127
       +
       

     

       128
       128
       +
       	// Find meeting time that matches the day

     

       129
       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       131
       +
       	);

     

       132
       132
       +
       

     

       133
       133
       +
       	if (match) {

     

       134
       134
       +
       		console.log(

     

       135
       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       136
       +
       		);

     

       137
       137
       +
       		return match.id;

     

       138
       138
       +
       	}

     

       139
       139
       +
       

     

       140
       140
       +
       	console.log(

     

       141
       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       142
       +
       	);

     

       143
       143
       +
       	return null;

     

       144
       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
       130
        
       	};

     

       131
       131
        
       	expect(typeof result.count).toBe("number");

     

       132
       132
        
       });

     

       133
       133
       +
       

     

       134
       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       135
       +
       	const userId = 999;

     

       136
       136
       +
       

     

       137
       137
       +
       	// Clean up any existing sessions for this user

     

       138
       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       139
       +
       

     

       140
       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       141
       +
       	const sessionIds: string[] = [];

     

       142
       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       144
       +
       		sessionIds.push(sessionId);

     

       145
       145
       +
       	}

     

       146
       146
       +
       

     

       147
       147
       +
       	// Count total sessions for user

     

       148
       148
       +
       	const sessionCount = db

     

       149
       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       151
       +
       		)

     

       152
       152
       +
       		.get(userId);

     

       153
       153
       +
       

     

       154
       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       155
       +
       

     

       156
       156
       +
       	// First session should be deleted (oldest)

     

       157
       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       158
       +
       	expect(firstSession).toBeNull();

     

       159
       159
       +
       

     

       160
       160
       +
       	// Last session should exist (newest)

     

       161
       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       163
       +
       

     

       164
       164
       +
       	// Cleanup

     

       165
       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       166
       +
       });

+428 -67

src/lib/auth.ts

···

       1
       1
        
       import db from "../db/schema";

     

       2
       2
        
       

     

       3
       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       4
       5
        
       

     

       5
       6
        
       export type UserRole = "user" | "admin";

     

       6
       7
        
       

     
···

       30
       31
        
       ): string {

     

       31
       32
        
       	const sessionId = crypto.randomUUID();

     

       32
       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       34
       +
       

     

       35
       35
       +
       	// Check current session count for user

     

       36
       36
       +
       	const sessionCount = db

     

       37
       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       39
       +
       		)

     

       40
       40
       +
       		.get(userId);

     

       41
       41
       +
       

     

       42
       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       45
       +
       		db.run(

     

       46
       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       47
       +
       				SELECT id FROM sessions 

     

       48
       48
       +
       				WHERE user_id = ? 

     

       49
       49
       +
       				ORDER BY created_at ASC 

     

       50
       50
       +
       				LIMIT ?

     

       51
       51
       +
       			)`,

     

       52
       52
       +
       			[userId, sessionsToDelete],

     

       53
       53
       +
       		);

     

       54
       54
       +
       	}

     

       33
       55
        
       

     

       34
       56
        
       	db.run(

     

       35
       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

     
···

       190
       212
        
       

     

       191
       213
        
       	// Get user's subscription if they have one

     

       192
       214
        
       	const subscription = db

     

       193
       193
       -
       		.query<{ id: string }, [number]>(

     

       194
       194
       -
       			"SELECT id FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       215
       215
       +
       		.query<

     

       216
       216
       +
       			{ id: string; status: string; cancel_at_period_end: number },

     

       217
       217
       +
       			[number]

     

       218
       218
       +
       		>(

     

       219
       219
       +
       			"SELECT id, status, cancel_at_period_end FROM subscriptions WHERE user_id = ? ORDER BY created_at DESC LIMIT 1",

     

       195
       220
        
       		)

     

       196
       221
        
       		.get(userId);

     

       197
       222
        
       

     

       198
       198
       -
       	// Cancel subscription if it exists (soft cancel - keeps access until period end)

     

       199
       199
       -
       	if (subscription) {

     

       223
       223
       +
       	// Cancel subscription if it exists and is not already canceled or scheduled to cancel

     

       224
       224
       +
       	if (

     

       225
       225
       +
       		subscription &&

     

       226
       226
       +
       		subscription.status !== "canceled" &&

     

       227
       227
       +
       		subscription.status !== "expired" &&

     

       228
       228
       +
       		!subscription.cancel_at_period_end

     

       229
       229
       +
       	) {

     

       200
       230
        
       		try {

     

       201
       231
        
       			const { polar } = await import("./polar");

     

       202
       232
        
       			await polar.subscriptions.update({

     
···

       213
       243
        
       			);

     

       214
       244
        
       			// Continue with user deletion even if subscription cancellation fails

     

       215
       245
        
       		}

     

       246
       246
       +
       	} else if (subscription) {

     

       247
       247
       +
       		console.log(

     

       248
       248
       +
       			`[User Delete] Skipping cancellation for subscription ${subscription.id} (status: ${subscription.status}, cancel_at_period_end: ${subscription.cancel_at_period_end})`,

     

       249
       249
       +
       		);

     

       216
       250
        
       	}

     

       217
       251
        
       

     

       218
       252
        
       	// Reassign class transcriptions to ghost user (id=0)

     
···

       221
       255
        
       		"UPDATE transcriptions SET user_id = 0 WHERE user_id = ? AND class_id IS NOT NULL",

     

       222
       256
        
       		[userId],

     

       223
       257
        
       	);

     

       224
       224
       -
       	db.run(

     

       225
       225
       -
       		"DELETE FROM transcriptions WHERE user_id = ? AND class_id IS NULL",

     

       226
       226
       -
       		[userId],

     

       227
       227
       -
       	);

     

       258
       258
       +
       	db.run("DELETE FROM transcriptions WHERE user_id = ? AND class_id IS NULL", [

     

       259
       259
       +
       		userId,

     

       260
       260
       +
       	]);

     

       228
       261
        
       

     

       229
       262
        
       	// Delete user (CASCADE will handle sessions, passkeys, subscriptions, class_members)

     

       230
       263
        
       	db.run("DELETE FROM users WHERE id = ?", [userId]);

     
···

       253
       286
        
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       254
       287
        
       }

     

       255
       288
        
       

     

       289
       289
       +
       /**

     

       290
       290
       +
        * Email verification functions

     

       291
       291
       +
        */

     

       292
       292
       +
       

     

       293
       293
       +
       export function createEmailVerificationToken(userId: number): {

     

       294
       294
       +
       	code: string;

     

       295
       295
       +
       	token: string;

     

       296
       296
       +
       	sentAt: number;

     

       297
       297
       +
       } {

     

       298
       298
       +
       	// Generate a 6-digit code for user to enter

     

       299
       299
       +
       	const code = Math.floor(100000 + Math.random() * 900000).toString();

     

       300
       300
       +
       	const id = crypto.randomUUID();

     

       301
       301
       +
       	const token = crypto.randomUUID(); // Separate token for URL

     

       302
       302
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 24 * 60 * 60; // 24 hours

     

       303
       303
       +
       	const sentAt = Math.floor(Date.now() / 1000); // Timestamp when code is created

     

       304
       304
       +
       

     

       305
       305
       +
       	// Delete any existing tokens for this user

     

       306
       306
       +
       	db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       307
       307
       +
       

     

       308
       308
       +
       	// Store the code as the token field (for manual entry)

     

       309
       309
       +
       	db.run(

     

       310
       310
       +
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       311
       311
       +
       		[id, userId, code, expiresAt],

     

       312
       312
       +
       	);

     

       313
       313
       +
       

     

       314
       314
       +
       	// Store the URL token as a separate entry

     

       315
       315
       +
       	db.run(

     

       316
       316
       +
       		"INSERT INTO email_verification_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       317
       317
       +
       		[crypto.randomUUID(), userId, token, expiresAt],

     

       318
       318
       +
       	);

     

       319
       319
       +
       

     

       320
       320
       +
       	return { code, token, sentAt };

     

       321
       321
       +
       }

     

       322
       322
       +
       

     

       323
       323
       +
       export function verifyEmailToken(

     

       324
       324
       +
       	token: string,

     

       325
       325
       +
       ): { userId: number; email: string } | null {

     

       326
       326
       +
       	const now = Math.floor(Date.now() / 1000);

     

       327
       327
       +
       

     

       328
       328
       +
       	const result = db

     

       329
       329
       +
       		.query<{ user_id: number; email: string }, [string, number]>(

     

       330
       330
       +
       			`SELECT evt.user_id, u.email 

     

       331
       331
       +
              FROM email_verification_tokens evt

     

       332
       332
       +
              JOIN users u ON evt.user_id = u.id

     

       333
       333
       +
              WHERE evt.token = ? AND evt.expires_at > ?`,

     

       334
       334
       +
       		)

     

       335
       335
       +
       		.get(token, now);

     

       336
       336
       +
       

     

       337
       337
       +
       	if (!result) return null;

     

       338
       338
       +
       

     

       339
       339
       +
       	// Mark email as verified

     

       340
       340
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [result.user_id]);

     

       341
       341
       +
       

     

       342
       342
       +
       	// Delete the token (one-time use)

     

       343
       343
       +
       	db.run("DELETE FROM email_verification_tokens WHERE token = ?", [token]);

     

       344
       344
       +
       

     

       345
       345
       +
       	return { userId: result.user_id, email: result.email };

     

       346
       346
       +
       }

     

       347
       347
       +
       

     

       348
       348
       +
       export function verifyEmailCode(userId: number, code: string): boolean {

     

       349
       349
       +
       	const now = Math.floor(Date.now() / 1000);

     

       350
       350
       +
       

     

       351
       351
       +
       	const result = db

     

       352
       352
       +
       		.query<{ user_id: number }, [number, string, number]>(

     

       353
       353
       +
       			`SELECT user_id 

     

       354
       354
       +
              FROM email_verification_tokens

     

       355
       355
       +
              WHERE user_id = ? AND token = ? AND expires_at > ?`,

     

       356
       356
       +
       		)

     

       357
       357
       +
       		.get(userId, code, now);

     

       358
       358
       +
       

     

       359
       359
       +
       	if (!result) return false;

     

       360
       360
       +
       

     

       361
       361
       +
       	// Mark email as verified

     

       362
       362
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       363
       363
       +
       

     

       364
       364
       +
       	// Delete the token (one-time use)

     

       365
       365
       +
       	db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       366
       366
       +
       

     

       367
       367
       +
       	return true;

     

       368
       368
       +
       }

     

       369
       369
       +
       

     

       370
       370
       +
       export function isEmailVerified(userId: number): boolean {

     

       371
       371
       +
       	const result = db

     

       372
       372
       +
       		.query<{ email_verified: number }, [number]>(

     

       373
       373
       +
       			"SELECT email_verified FROM users WHERE id = ?",

     

       374
       374
       +
       		)

     

       375
       375
       +
       		.get(userId);

     

       376
       376
       +
       

     

       377
       377
       +
       	return result?.email_verified === 1;

     

       378
       378
       +
       }

     

       379
       379
       +
       

     

       380
       380
       +
       export function getVerificationCodeSentAt(userId: number): number | null {

     

       381
       381
       +
       	const result = db

     

       382
       382
       +
       		.query<{ created_at: number }, [number]>(

     

       383
       383
       +
       			"SELECT MAX(created_at) as created_at FROM email_verification_tokens WHERE user_id = ?",

     

       384
       384
       +
       		)

     

       385
       385
       +
       		.get(userId);

     

       386
       386
       +
       

     

       387
       387
       +
       	return result?.created_at ?? null;

     

       388
       388
       +
       }

     

       389
       389
       +
       

     

       390
       390
       +
       /**

     

       391
       391
       +
        * Password reset functions

     

       392
       392
       +
        */

     

       393
       393
       +
       

     

       394
       394
       +
       export function createPasswordResetToken(userId: number): string {

     

       395
       395
       +
       	const token = crypto.randomUUID();

     

       396
       396
       +
       	const id = crypto.randomUUID();

     

       397
       397
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 60 * 60; // 1 hour

     

       398
       398
       +
       

     

       399
       399
       +
       	// Delete any existing tokens for this user

     

       400
       400
       +
       	db.run("DELETE FROM password_reset_tokens WHERE user_id = ?", [userId]);

     

       401
       401
       +
       

     

       402
       402
       +
       	db.run(

     

       403
       403
       +
       		"INSERT INTO password_reset_tokens (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)",

     

       404
       404
       +
       		[id, userId, token, expiresAt],

     

       405
       405
       +
       	);

     

       406
       406
       +
       

     

       407
       407
       +
       	return token;

     

       408
       408
       +
       }

     

       409
       409
       +
       

     

       410
       410
       +
       export function verifyPasswordResetToken(token: string): number | null {

     

       411
       411
       +
       	const now = Math.floor(Date.now() / 1000);

     

       412
       412
       +
       

     

       413
       413
       +
       	const result = db

     

       414
       414
       +
       		.query<{ user_id: number }, [string, number]>(

     

       415
       415
       +
       			"SELECT user_id FROM password_reset_tokens WHERE token = ? AND expires_at > ?",

     

       416
       416
       +
       		)

     

       417
       417
       +
       		.get(token, now);

     

       418
       418
       +
       

     

       419
       419
       +
       	return result?.user_id ?? null;

     

       420
       420
       +
       }

     

       421
       421
       +
       

     

       422
       422
       +
       export function consumePasswordResetToken(token: string): void {

     

       423
       423
       +
       	db.run("DELETE FROM password_reset_tokens WHERE token = ?", [token]);

     

       424
       424
       +
       }

     

       425
       425
       +
       

     

       426
       426
       +
       /**

     

       427
       427
       +
        * Email change functions

     

       428
       428
       +
        */

     

       429
       429
       +
       

     

       430
       430
       +
       export function createEmailChangeToken(

     

       431
       431
       +
       	userId: number,

     

       432
       432
       +
       	newEmail: string,

     

       433
       433
       +
       ): string {

     

       434
       434
       +
       	const token = crypto.randomUUID();

     

       435
       435
       +
       	const id = crypto.randomUUID();

     

       436
       436
       +
       	const expiresAt = Math.floor(Date.now() / 1000) + 24 * 60 * 60; // 24 hours

     

       437
       437
       +
       

     

       438
       438
       +
       	// Delete any existing email change tokens for this user

     

       439
       439
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [userId]);

     

       440
       440
       +
       

     

       441
       441
       +
       	db.run(

     

       442
       442
       +
       		"INSERT INTO email_change_tokens (id, user_id, new_email, token, expires_at) VALUES (?, ?, ?, ?, ?)",

     

       443
       443
       +
       		[id, userId, newEmail, token, expiresAt],

     

       444
       444
       +
       	);

     

       445
       445
       +
       

     

       446
       446
       +
       	return token;

     

       447
       447
       +
       }

     

       448
       448
       +
       

     

       449
       449
       +
       export function verifyEmailChangeToken(

     

       450
       450
       +
       	token: string,

     

       451
       451
       +
       ): { userId: number; newEmail: string } | null {

     

       452
       452
       +
       	const now = Math.floor(Date.now() / 1000);

     

       453
       453
       +
       

     

       454
       454
       +
       	const result = db

     

       455
       455
       +
       		.query<{ user_id: number; new_email: string }, [string, number]>(

     

       456
       456
       +
       			"SELECT user_id, new_email FROM email_change_tokens WHERE token = ? AND expires_at > ?",

     

       457
       457
       +
       		)

     

       458
       458
       +
       		.get(token, now);

     

       459
       459
       +
       

     

       460
       460
       +
       	if (!result) return null;

     

       461
       461
       +
       

     

       462
       462
       +
       	return { userId: result.user_id, newEmail: result.new_email };

     

       463
       463
       +
       }

     

       464
       464
       +
       

     

       465
       465
       +
       export function consumeEmailChangeToken(token: string): void {

     

       466
       466
       +
       	db.run("DELETE FROM email_change_tokens WHERE token = ?", [token]);

     

       467
       467
       +
       }

     

       468
       468
       +
       

     

       256
       469
        
       export function isUserAdmin(userId: number): boolean {

     

       257
       470
        
       	const result = db

     

       258
       471
        
       		.query<{ role: UserRole }, [number]>("SELECT role FROM users WHERE id = ?")

     
···

       291
       504
        
       		.all();

     

       292
       505
        
       }

     

       293
       506
        
       

     

       294
       294
       -
       export function getAllTranscriptions(): Array<{

     

       295
       295
       -
       	id: string;

     

       296
       296
       -
       	user_id: number;

     

       297
       297
       -
       	user_email: string;

     

       298
       298
       -
       	user_name: string | null;

     

       299
       299
       -
       	original_filename: string;

     

       300
       300
       -
       	status: string;

     

       301
       301
       -
       	created_at: number;

     

       302
       302
       -
       	error_message: string | null;

     

       303
       303
       -
       }> {

     

       304
       304
       -
       	return db

     

       305
       305
       -
       		.query<

     

       306
       306
       -
       			{

     

       307
       307
       -
       				id: string;

     

       308
       308
       -
       				user_id: number;

     

       309
       309
       -
       				user_email: string;

     

       310
       310
       -
       				user_name: string | null;

     

       311
       311
       -
       				original_filename: string;

     

       312
       312
       -
       				status: string;

     

       313
       313
       -
       				created_at: number;

     

       314
       314
       -
       				error_message: string | null;

     

       315
       315
       -
       			},

     

       316
       316
       -
       			[]

     

       317
       317
       -
       		>(

     

       318
       318
       -
       			`SELECT 

     

       319
       319
       -
               t.id, 

     

       320
       320
       -
               t.user_id, 

     

       321
       321
       -
               u.email as user_email, 

     

       322
       322
       -
               u.name as user_name, 

     

       323
       323
       -
               t.original_filename, 

     

       324
       324
       -
               t.status, 

     

       325
       325
       -
               t.created_at,

     

       326
       326
       -
               t.error_message

     

       327
       327
       -
             FROM transcriptions t

     

       328
       328
       -
             LEFT JOIN users u ON t.user_id = u.id

     

       329
       329
       -
             ORDER BY t.created_at DESC`,

     

       330
       330
       -
       		)

     

       331
       331
       -
       		.all();

     

       507
       507
       +
       export function getAllTranscriptions(

     

       508
       508
       +
       	limit = 50,

     

       509
       509
       +
       	cursor?: string,

     

       510
       510
       +
       ): {

     

       511
       511
       +
       	data: Array<{

     

       512
       512
       +
       		id: string;

     

       513
       513
       +
       		user_id: number;

     

       514
       514
       +
       		user_email: string;

     

       515
       515
       +
       		user_name: string | null;

     

       516
       516
       +
       		original_filename: string;

     

       517
       517
       +
       		status: string;

     

       518
       518
       +
       		created_at: number;

     

       519
       519
       +
       		error_message: string | null;

     

       520
       520
       +
       	}>;

     

       521
       521
       +
       	pagination: {

     

       522
       522
       +
       		limit: number;

     

       523
       523
       +
       		hasMore: boolean;

     

       524
       524
       +
       		nextCursor: string | null;

     

       525
       525
       +
       	};

     

       526
       526
       +
       } {

     

       527
       527
       +
       	type TranscriptionRow = {

     

       528
       528
       +
       		id: string;

     

       529
       529
       +
       		user_id: number;

     

       530
       530
       +
       		user_email: string;

     

       531
       531
       +
       		user_name: string | null;

     

       532
       532
       +
       		original_filename: string;

     

       533
       533
       +
       		status: string;

     

       534
       534
       +
       		created_at: number;

     

       535
       535
       +
       		error_message: string | null;

     

       536
       536
       +
       	};

     

       537
       537
       +
       

     

       538
       538
       +
       	let transcriptions: TranscriptionRow[];

     

       539
       539
       +
       

     

       540
       540
       +
       	if (cursor) {

     

       541
       541
       +
       		const { decodeCursor } = require("./cursor");

     

       542
       542
       +
       		const parts = decodeCursor(cursor);

     

       543
       543
       +
       

     

       544
       544
       +
       		if (parts.length !== 2) {

     

       545
       545
       +
       			throw new Error("Invalid cursor format");

     

       546
       546
       +
       		}

     

       547
       547
       +
       

     

       548
       548
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       549
       549
       +
       		const id = parts[1] || "";

     

       550
       550
       +
       

     

       551
       551
       +
       		if (Number.isNaN(cursorTime) || !id) {

     

       552
       552
       +
       			throw new Error("Invalid cursor format");

     

       553
       553
       +
       		}

     

       554
       554
       +
       

     

       555
       555
       +
       		transcriptions = db

     

       556
       556
       +
       			.query<TranscriptionRow, [number, number, string, number]>(

     

       557
       557
       +
       				`SELECT 

     

       558
       558
       +
       					t.id, 

     

       559
       559
       +
       					t.user_id, 

     

       560
       560
       +
       					u.email as user_email, 

     

       561
       561
       +
       					u.name as user_name, 

     

       562
       562
       +
       					t.original_filename, 

     

       563
       563
       +
       					t.status, 

     

       564
       564
       +
       					t.created_at,

     

       565
       565
       +
       					t.error_message

     

       566
       566
       +
       				FROM transcriptions t

     

       567
       567
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       568
       568
       +
       				WHERE t.created_at < ? OR (t.created_at = ? AND t.id < ?)

     

       569
       569
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       570
       570
       +
       				LIMIT ?`,

     

       571
       571
       +
       			)

     

       572
       572
       +
       			.all(cursorTime, cursorTime, id, limit + 1);

     

       573
       573
       +
       	} else {

     

       574
       574
       +
       		transcriptions = db

     

       575
       575
       +
       			.query<TranscriptionRow, [number]>(

     

       576
       576
       +
       				`SELECT 

     

       577
       577
       +
       					t.id, 

     

       578
       578
       +
       					t.user_id, 

     

       579
       579
       +
       					u.email as user_email, 

     

       580
       580
       +
       					u.name as user_name, 

     

       581
       581
       +
       					t.original_filename, 

     

       582
       582
       +
       					t.status, 

     

       583
       583
       +
       					t.created_at,

     

       584
       584
       +
       					t.error_message

     

       585
       585
       +
       				FROM transcriptions t

     

       586
       586
       +
       				LEFT JOIN users u ON t.user_id = u.id

     

       587
       587
       +
       				ORDER BY t.created_at DESC, t.id DESC

     

       588
       588
       +
       				LIMIT ?`,

     

       589
       589
       +
       			)

     

       590
       590
       +
       			.all(limit + 1);

     

       591
       591
       +
       	}

     

       592
       592
       +
       

     

       593
       593
       +
       	const hasMore = transcriptions.length > limit;

     

       594
       594
       +
       	if (hasMore) {

     

       595
       595
       +
       		transcriptions.pop();

     

       596
       596
       +
       	}

     

       597
       597
       +
       

     

       598
       598
       +
       	let nextCursor: string | null = null;

     

       599
       599
       +
       	if (hasMore && transcriptions.length > 0) {

     

       600
       600
       +
       		const { encodeCursor } = require("./cursor");

     

       601
       601
       +
       		const last = transcriptions[transcriptions.length - 1];

     

       602
       602
       +
       		if (last) {

     

       603
       603
       +
       			nextCursor = encodeCursor([last.created_at.toString(), last.id]);

     

       604
       604
       +
       		}

     

       605
       605
       +
       	}

     

       606
       606
       +
       

     

       607
       607
       +
       	return {

     

       608
       608
       +
       		data: transcriptions,

     

       609
       609
       +
       		pagination: {

     

       610
       610
       +
       			limit,

     

       611
       611
       +
       			hasMore,

     

       612
       612
       +
       			nextCursor,

     

       613
       613
       +
       		},

     

       614
       614
       +
       	};

     

       332
       615
        
       }

     

       333
       616
        
       

     

       334
       617
        
       export function deleteTranscription(transcriptionId: string): void {

     
···

       414
       697
        
       	subscription_id: string | null;

     

       415
       698
        
       }

     

       416
       699
        
       

     

       417
       417
       -
       export function getAllUsersWithStats(): UserWithStats[] {

     

       418
       418
       -
       	return db

     

       419
       419
       -
       		.query<UserWithStats, []>(

     

       420
       420
       -
       			`SELECT 

     

       421
       421
       -
               u.id, 

     

       422
       422
       -
               u.email, 

     

       423
       423
       -
               u.name, 

     

       424
       424
       -
               u.avatar, 

     

       425
       425
       -
               u.created_at, 

     

       426
       426
       -
               u.role,

     

       427
       427
       -
               u.last_login,

     

       428
       428
       -
               COUNT(DISTINCT t.id) as transcription_count,

     

       429
       429
       -
               s.status as subscription_status,

     

       430
       430
       -
               s.id as subscription_id

     

       431
       431
       -
             FROM users u

     

       432
       432
       -
             LEFT JOIN transcriptions t ON u.id = t.user_id

     

       433
       433
       -
             LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       434
       434
       -
             GROUP BY u.id

     

       435
       435
       -
             ORDER BY u.created_at DESC`,

     

       436
       436
       -
       		)

     

       437
       437
       -
       		.all();

     

       700
       700
       +
       export function getAllUsersWithStats(

     

       701
       701
       +
       	limit = 50,

     

       702
       702
       +
       	cursor?: string,

     

       703
       703
       +
       ): {

     

       704
       704
       +
       	data: UserWithStats[];

     

       705
       705
       +
       	pagination: {

     

       706
       706
       +
       		limit: number;

     

       707
       707
       +
       		hasMore: boolean;

     

       708
       708
       +
       		nextCursor: string | null;

     

       709
       709
       +
       	};

     

       710
       710
       +
       } {

     

       711
       711
       +
       	let users: UserWithStats[];

     

       712
       712
       +
       

     

       713
       713
       +
       	if (cursor) {

     

       714
       714
       +
       		const { decodeCursor } = require("./cursor");

     

       715
       715
       +
       		const parts = decodeCursor(cursor);

     

       716
       716
       +
       

     

       717
       717
       +
       		if (parts.length !== 2) {

     

       718
       718
       +
       			throw new Error("Invalid cursor format");

     

       719
       719
       +
       		}

     

       720
       720
       +
       

     

       721
       721
       +
       		const cursorTime = Number.parseInt(parts[0] || "", 10);

     

       722
       722
       +
       		const cursorId = Number.parseInt(parts[1] || "", 10);

     

       723
       723
       +
       

     

       724
       724
       +
       		if (Number.isNaN(cursorTime) || Number.isNaN(cursorId)) {

     

       725
       725
       +
       			throw new Error("Invalid cursor format");

     

       726
       726
       +
       		}

     

       727
       727
       +
       

     

       728
       728
       +
       		users = db

     

       729
       729
       +
       			.query<UserWithStats, [number, number, number, number]>(

     

       730
       730
       +
       				`SELECT 

     

       731
       731
       +
       					u.id, 

     

       732
       732
       +
       					u.email, 

     

       733
       733
       +
       					u.name, 

     

       734
       734
       +
       					u.avatar, 

     

       735
       735
       +
       					u.created_at, 

     

       736
       736
       +
       					u.role,

     

       737
       737
       +
       					u.last_login,

     

       738
       738
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       739
       739
       +
       					s.status as subscription_status,

     

       740
       740
       +
       					s.id as subscription_id

     

       741
       741
       +
       				FROM users u

     

       742
       742
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       743
       743
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       744
       744
       +
       				WHERE u.created_at < ? OR (u.created_at = ? AND u.id < ?)

     

       745
       745
       +
       				GROUP BY u.id

     

       746
       746
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       747
       747
       +
       				LIMIT ?`,

     

       748
       748
       +
       			)

     

       749
       749
       +
       			.all(cursorTime, cursorTime, cursorId, limit + 1);

     

       750
       750
       +
       	} else {

     

       751
       751
       +
       		users = db

     

       752
       752
       +
       			.query<UserWithStats, [number]>(

     

       753
       753
       +
       				`SELECT 

     

       754
       754
       +
       					u.id, 

     

       755
       755
       +
       					u.email, 

     

       756
       756
       +
       					u.name, 

     

       757
       757
       +
       					u.avatar, 

     

       758
       758
       +
       					u.created_at, 

     

       759
       759
       +
       					u.role,

     

       760
       760
       +
       					u.last_login,

     

       761
       761
       +
       					COUNT(DISTINCT t.id) as transcription_count,

     

       762
       762
       +
       					s.status as subscription_status,

     

       763
       763
       +
       					s.id as subscription_id

     

       764
       764
       +
       				FROM users u

     

       765
       765
       +
       				LEFT JOIN transcriptions t ON u.id = t.user_id

     

       766
       766
       +
       				LEFT JOIN subscriptions s ON u.id = s.user_id AND s.status IN ('active', 'trialing', 'past_due')

     

       767
       767
       +
       				GROUP BY u.id

     

       768
       768
       +
       				ORDER BY u.created_at DESC, u.id DESC

     

       769
       769
       +
       				LIMIT ?`,

     

       770
       770
       +
       			)

     

       771
       771
       +
       			.all(limit + 1);

     

       772
       772
       +
       	}

     

       773
       773
       +
       

     

       774
       774
       +
       	const hasMore = users.length > limit;

     

       775
       775
       +
       	if (hasMore) {

     

       776
       776
       +
       		users.pop();

     

       777
       777
       +
       	}

     

       778
       778
       +
       

     

       779
       779
       +
       	let nextCursor: string | null = null;

     

       780
       780
       +
       	if (hasMore && users.length > 0) {

     

       781
       781
       +
       		const { encodeCursor } = require("./cursor");

     

       782
       782
       +
       		const last = users[users.length - 1];

     

       783
       783
       +
       		if (last) {

     

       784
       784
       +
       			nextCursor = encodeCursor([

     

       785
       785
       +
       				last.created_at.toString(),

     

       786
       786
       +
       				last.id.toString(),

     

       787
       787
       +
       			]);

     

       788
       788
       +
       		}

     

       789
       789
       +
       	}

     

       790
       790
       +
       

     

       791
       791
       +
       	return {

     

       792
       792
       +
       		data: users,

     

       793
       793
       +
       		pagination: {

     

       794
       794
       +
       			limit,

     

       795
       795
       +
       			hasMore,

     

       796
       796
       +
       			nextCursor,

     

       797
       797
       +
       		},

     

       798
       798
       +
       	};

     

       438
       799
        
       }

+7 -7

src/lib/classes.test.ts

···

       129
       129
        
       	enrollUserInClass(userId, cls1.id);

     

       130
       130
        
       

     

       131
       131
        
       	// Get classes for user (non-admin)

     

       132
       132
       -
       	const classes = getClassesForUser(userId, false);

     

       133
       133
       -
       	expect(classes.length).toBe(1);

     

       134
       134
       -
       	expect(classes[0]?.id).toBe(cls1.id);

     

       132
       132
       +
       	const classesResult = getClassesForUser(userId, false);

     

       133
       133
       +
       	expect(classesResult.data.length).toBe(1);

     

       134
       134
       +
       	expect(classesResult.data[0]?.id).toBe(cls1.id);

     

       135
       135
        
       

     

       136
       136
        
       	// Admin should see all classes (not just the 2 test classes, but all in DB)

     

       137
       137
       -
       	const allClasses = getClassesForUser(userId, true);

     

       138
       138
       -
       	expect(allClasses.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       -
       	expect(allClasses.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       -
       	expect(allClasses.some((c) => c.id === cls2.id)).toBe(true);

     

       137
       137
       +
       	const allClassesResult = getClassesForUser(userId, true);

     

       138
       138
       +
       	expect(allClassesResult.data.length).toBeGreaterThanOrEqual(2);

     

       139
       139
       +
       	expect(allClassesResult.data.some((c) => c.id === cls1.id)).toBe(true);

     

       140
       140
       +
       	expect(allClassesResult.data.some((c) => c.id === cls2.id)).toBe(true);

     

       141
       141
        
       

     

       142
       142
        
       	// Cleanup enrollment

     

       143
       143
        
       	removeUserFromClass(userId, cls1.id);

+248 -22

src/lib/classes.ts

···

       9
       9
        
       	semester: string;

     

       10
       10
        
       	year: number;

     

       11
       11
        
       	archived: boolean;

     

       12
       12
       +
       	section_number?: string | null;

     

       13
       13
       +
       	created_at: number;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       export interface ClassSection {

     

       17
       17
       +
       	id: string;

     

       18
       18
       +
       	class_id: string;

     

       19
       19
       +
       	section_number: string;

     

       12
       20
        
       	created_at: number;

     

       13
       21
        
       }

     

       14
       22
        
       

     
···

       22
       30
        
       export interface ClassMember {

     

       23
       31
        
       	class_id: string;

     

       24
       32
        
       	user_id: number;

     

       33
       33
       +
       	section_id: string | null;

     

       25
       34
        
       	enrolled_at: number;

     

       26
       35
        
       }

     

       27
       36
        
       

     

       37
       37
       +
       export interface ClassWithStats extends Class {

     

       38
       38
       +
       	student_count?: number;

     

       39
       39
       +
       	transcript_count?: number;

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       28
       42
        
       /**

     

       29
       43
        
        * Get all classes for a user (either enrolled or admin sees all)

     

       30
       44
        
        */

     

       31
       31
       -
       export function getClassesForUser(userId: number, isAdmin: boolean): Class[] {

     

       45
       45
       +
       export function getClassesForUser(

     

       46
       46
       +
       	userId: number,

     

       47
       47
       +
       	isAdmin: boolean,

     

       48
       48
       +
       	limit = 50,

     

       49
       49
       +
       	cursor?: string,

     

       50
       50
       +
       ): {

     

       51
       51
       +
       	data: ClassWithStats[];

     

       52
       52
       +
       	pagination: {

     

       53
       53
       +
       		limit: number;

     

       54
       54
       +
       		hasMore: boolean;

     

       55
       55
       +
       		nextCursor: string | null;

     

       56
       56
       +
       	};

     

       57
       57
       +
       } {

     

       58
       58
       +
       	let classes: ClassWithStats[];

     

       59
       59
       +
       

     

       32
       60
        
       	if (isAdmin) {

     

       33
       33
       -
       		return db

     

       34
       34
       -
       			.query<Class, []>(

     

       35
       35
       -
       				"SELECT * FROM classes ORDER BY year DESC, semester DESC, course_code ASC",

     

       36
       36
       -
       			)

     

       37
       37
       -
       			.all();

     

       61
       61
       +
       		if (cursor) {

     

       62
       62
       +
       			const { decodeClassCursor } = require("./cursor");

     

       63
       63
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       			classes = db

     

       66
       66
       +
       				.query<ClassWithStats, [number, string, string, string, number]>(

     

       67
       67
       +
       					`SELECT 

     

       68
       68
       +
       						c.*,

     

       69
       69
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       70
       70
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       71
       71
       +
       					FROM classes c 

     

       72
       72
       +
       					WHERE (c.year < ? OR 

     

       73
       73
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       74
       74
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       75
       75
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       76
       76
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       77
       77
       +
       					LIMIT ?`,

     

       78
       78
       +
       				)

     

       79
       79
       +
       				.all(

     

       80
       80
       +
       					year,

     

       81
       81
       +
       					year,

     

       82
       82
       +
       					semester,

     

       83
       83
       +
       					year,

     

       84
       84
       +
       					semester,

     

       85
       85
       +
       					courseCode,

     

       86
       86
       +
       					year,

     

       87
       87
       +
       					semester,

     

       88
       88
       +
       					courseCode,

     

       89
       89
       +
       					id,

     

       90
       90
       +
       					limit + 1,

     

       91
       91
       +
       				);

     

       92
       92
       +
       		} else {

     

       93
       93
       +
       			classes = db

     

       94
       94
       +
       				.query<ClassWithStats, [number]>(

     

       95
       95
       +
       					`SELECT 

     

       96
       96
       +
       						c.*,

     

       97
       97
       +
       						(SELECT COUNT(*) FROM class_members WHERE class_id = c.id) as student_count,

     

       98
       98
       +
       						(SELECT COUNT(*) FROM transcriptions WHERE class_id = c.id) as transcript_count

     

       99
       99
       +
       					FROM classes c 

     

       100
       100
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       101
       101
       +
       					LIMIT ?`,

     

       102
       102
       +
       				)

     

       103
       103
       +
       				.all(limit + 1);

     

       104
       104
       +
       		}

     

       105
       105
       +
       	} else {

     

       106
       106
       +
       		if (cursor) {

     

       107
       107
       +
       			const { decodeClassCursor } = require("./cursor");

     

       108
       108
       +
       			const { year, semester, courseCode, id } = decodeClassCursor(cursor);

     

       109
       109
       +
       

     

       110
       110
       +
       			classes = db

     

       111
       111
       +
       				.query<

     

       112
       112
       +
       					ClassWithStats,

     

       113
       113
       +
       					[number, number, string, string, string, number]

     

       114
       114
       +
       				>(

     

       115
       115
       +
       					`SELECT c.* FROM classes c

     

       116
       116
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       117
       117
       +
       					WHERE cm.user_id = ? AND 

     

       118
       118
       +
       						(c.year < ? OR 

     

       119
       119
       +
       						(c.year = ? AND c.semester < ?) OR 

     

       120
       120
       +
       						(c.year = ? AND c.semester = ? AND c.course_code > ?) OR

     

       121
       121
       +
       						(c.year = ? AND c.semester = ? AND c.course_code = ? AND c.id > ?))

     

       122
       122
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       123
       123
       +
       					LIMIT ?`,

     

       124
       124
       +
       				)

     

       125
       125
       +
       				.all(

     

       126
       126
       +
       					userId,

     

       127
       127
       +
       					year,

     

       128
       128
       +
       					year,

     

       129
       129
       +
       					semester,

     

       130
       130
       +
       					year,

     

       131
       131
       +
       					semester,

     

       132
       132
       +
       					courseCode,

     

       133
       133
       +
       					year,

     

       134
       134
       +
       					semester,

     

       135
       135
       +
       					courseCode,

     

       136
       136
       +
       					id,

     

       137
       137
       +
       					limit + 1,

     

       138
       138
       +
       				);

     

       139
       139
       +
       		} else {

     

       140
       140
       +
       			classes = db

     

       141
       141
       +
       				.query<ClassWithStats, [number, number]>(

     

       142
       142
       +
       					`SELECT c.* FROM classes c

     

       143
       143
       +
       					INNER JOIN class_members cm ON c.id = cm.class_id

     

       144
       144
       +
       					WHERE cm.user_id = ?

     

       145
       145
       +
       					ORDER BY c.year DESC, c.semester DESC, c.course_code ASC, c.id ASC

     

       146
       146
       +
       					LIMIT ?`,

     

       147
       147
       +
       				)

     

       148
       148
       +
       				.all(userId, limit + 1);

     

       149
       149
       +
       		}

     

       38
       150
        
       	}

     

       39
       151
        
       

     

       40
       40
       -
       	return db

     

       41
       41
       -
       		.query<Class, [number]>(

     

       42
       42
       -
       			`SELECT c.* FROM classes c

     

       43
       43
       -
              INNER JOIN class_members cm ON c.id = cm.class_id

     

       44
       44
       -
              WHERE cm.user_id = ?

     

       45
       45
       -
              ORDER BY c.year DESC, c.semester DESC, c.course_code ASC`,

     

       46
       46
       -
       		)

     

       47
       47
       -
       		.all(userId);

     

       152
       152
       +
       	const hasMore = classes.length > limit;

     

       153
       153
       +
       	if (hasMore) {

     

       154
       154
       +
       		classes.pop();

     

       155
       155
       +
       	}

     

       156
       156
       +
       

     

       157
       157
       +
       	let nextCursor: string | null = null;

     

       158
       158
       +
       	if (hasMore && classes.length > 0) {

     

       159
       159
       +
       		const { encodeClassCursor } = require("./cursor");

     

       160
       160
       +
       		const last = classes[classes.length - 1];

     

       161
       161
       +
       		if (last) {

     

       162
       162
       +
       			nextCursor = encodeClassCursor(

     

       163
       163
       +
       				last.year,

     

       164
       164
       +
       				last.semester,

     

       165
       165
       +
       				last.course_code,

     

       166
       166
       +
       				last.id,

     

       167
       167
       +
       			);

     

       168
       168
       +
       		}

     

       169
       169
       +
       	}

     

       170
       170
       +
       

     

       171
       171
       +
       	return {

     

       172
       172
       +
       		data: classes,

     

       173
       173
       +
       		pagination: {

     

       174
       174
       +
       			limit,

     

       175
       175
       +
       			hasMore,

     

       176
       176
       +
       			nextCursor,

     

       177
       177
       +
       		},

     

       178
       178
       +
       	};

     

       48
       179
        
       }

     

       49
       180
        
       

     

       50
       181
        
       /**

     
···

       82
       213
        
       	semester: string;

     

       83
       214
        
       	year: number;

     

       84
       215
        
       	meeting_times?: string[];

     

       216
       216
       +
       	sections?: string[];

     

       85
       217
        
       }): Class {

     

       86
       218
        
       	const id = nanoid();

     

       87
       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       106
       238
        
       		}

     

       107
       239
        
       	}

     

       108
       240
        
       

     

       241
       241
       +
       	// Create sections if provided

     

       242
       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       244
       +
       			createClassSection(id, sectionNumber);

     

       245
       245
       +
       		}

     

       246
       246
       +
       	}

     

       247
       247
       +
       

     

       109
       248
        
       	return {

     

       110
       249
        
       		id,

     

       111
       250
        
       		course_code: data.course_code,

     
···

       122
       261
        
        * Archive or unarchive a class

     

       123
       262
        
        */

     

       124
       263
        
       export function toggleClassArchive(classId: string, archived: boolean): void {

     

       125
       125
       -
       	db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       264
       264
       +
       	const result = db.run("UPDATE classes SET archived = ? WHERE id = ?", [

     

       126
       265
        
       		archived ? 1 : 0,

     

       127
       266
        
       		classId,

     

       128
       267
        
       	]);

     

       268
       268
       +
       

     

       269
       269
       +
       	if (result.changes === 0) {

     

       270
       270
       +
       		throw new Error("Class not found");

     

       271
       271
       +
       	}

     

       129
       272
        
       }

     

       130
       273
        
       

     

       131
       274
        
       /**

     
···

       138
       281
        
       /**

     

       139
       282
        
        * Enroll a user in a class

     

       140
       283
        
        */

     

       141
       141
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       284
       284
       +
       export function enrollUserInClass(

     

       285
       285
       +
       	userId: number,

     

       286
       286
       +
       	classId: string,

     

       287
       287
       +
       	sectionId?: string | null,

     

       288
       288
       +
       ): void {

     

       142
       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       143
       290
        
       	db.run(

     

       144
       144
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       145
       145
       -
       		[classId, userId, now],

     

       291
       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       146
       293
        
       	);

     

       147
       294
        
       }

     

       148
       295
        
       

     
···

       212
       359
        
       }

     

       213
       360
        
       

     

       214
       361
        
       /**

     

       362
       362
       +
        * Get a single meeting time by ID

     

       363
       363
       +
        */

     

       364
       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       365
       +
       	const result = db

     

       366
       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       367
       +
       		.get(meetingId);

     

       368
       368
       +
       	return result ?? null;

     

       369
       369
       +
       }

     

       370
       370
       +
       

     

       371
       371
       +
       /**

     

       215
       372
        
        * Update a meeting time label

     

       216
       373
        
        */

     

       217
       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       235
       392
        
       				id: string;

     

       236
       393
        
       				user_id: number;

     

       237
       394
        
       				meeting_time_id: string | null;

     

       395
       395
       +
       				section_id: string | null;

     

       238
       396
        
       				filename: string;

     

       239
       397
        
       				original_filename: string;

     

       240
       398
        
       				status: string;

     
···

       245
       403
        
       			},

     

       246
       404
        
       			[string]

     

       247
       405
        
       		>(

     

       248
       248
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       406
       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       249
       407
        
              FROM transcriptions

     

       250
       408
        
              WHERE class_id = ?

     

       251
       251
       -
              ORDER BY created_at DESC`,

     

       409
       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       252
       410
        
       		)

     

       253
       411
        
       		.all(classId);

     

       254
       412
        
       }

     
···

       273
       431
        
       export function joinClass(

     

       274
       432
        
       	classId: string,

     

       275
       433
        
       	userId: number,

     

       434
       434
       +
       	sectionId?: string | null,

     

       276
       435
        
       ): { success: boolean; error?: string } {

     

       277
       436
        
       	// Find class by ID

     

       278
       437
        
       	const cls = db

     
···

       298
       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       299
       458
        
       	}

     

       300
       459
        
       

     

       460
       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       461
       +
       	const sections = getClassSections(classId);

     

       462
       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       464
       +
       	}

     

       465
       465
       +
       

     

       466
       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       467
       +
       	if (sectionId) {

     

       468
       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       469
       +
       		if (!section) {

     

       470
       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       471
       +
       		}

     

       472
       472
       +
       	}

     

       473
       473
       +
       

     

       301
       474
        
       	// Enroll user

     

       302
       475
        
       	db.query(

     

       303
       303
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       304
       304
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       476
       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       305
       478
        
       

     

       306
       479
        
       	return { success: true };

     

       480
       480
       +
       }

     

       481
       481
       +
       

     

       482
       482
       +
       /**

     

       483
       483
       +
        * Create a section for a class

     

       484
       484
       +
        */

     

       485
       485
       +
       export function createClassSection(

     

       486
       486
       +
       	classId: string,

     

       487
       487
       +
       	sectionNumber: string,

     

       488
       488
       +
       ): ClassSection {

     

       489
       489
       +
       	const id = nanoid();

     

       490
       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       491
       +
       

     

       492
       492
       +
       	db.run(

     

       493
       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       495
       +
       	);

     

       496
       496
       +
       

     

       497
       497
       +
       	return {

     

       498
       498
       +
       		id,

     

       499
       499
       +
       		class_id: classId,

     

       500
       500
       +
       		section_number: sectionNumber,

     

       501
       501
       +
       		created_at: now,

     

       502
       502
       +
       	};

     

       503
       503
       +
       }

     

       504
       504
       +
       

     

       505
       505
       +
       /**

     

       506
       506
       +
        * Get all sections for a class

     

       507
       507
       +
        */

     

       508
       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       509
       +
       	return db

     

       510
       510
       +
       		.query<ClassSection, [string]>(

     

       511
       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       512
       +
       		)

     

       513
       513
       +
       		.all(classId);

     

       514
       514
       +
       }

     

       515
       515
       +
       

     

       516
       516
       +
       /**

     

       517
       517
       +
        * Delete a class section

     

       518
       518
       +
        */

     

       519
       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       521
       +
       }

     

       522
       522
       +
       

     

       523
       523
       +
       /**

     

       524
       524
       +
        * Get user's enrolled section for a class

     

       525
       525
       +
        */

     

       526
       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       527
       +
       	const result = db

     

       528
       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       530
       +
       		)

     

       531
       531
       +
       		.get(classId, userId);

     

       532
       532
       +
       	return result?.section_id ?? null;

     

       307
       533
        
       }

     

       308
       534
        
       

     

       309
       535
        
       /**

-1

src/lib/client-auth.ts

···

       66
       66
        
       	const hashArray = Array.from(hashBuffer);

     

       67
       67
        
       	return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");

     

       68
       68
        
       }

     

       69
       69
       -

+1 -2

src/lib/crypto-fallback.ts

···

       23
       23
        
       

     

       24
       24
        
       	const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n));

     

       25
       25
        
       	const ch = (x: number, y: number, z: number) => (x & y) ^ (~x & z);

     

       26
       26
       -
       	const maj = (x: number, y: number, z: number) =>

     

       27
       27
       -
       		(x & y) ^ (x & z) ^ (y & z);

     

       26
       26
       +
       	const maj = (x: number, y: number, z: number) => (x & y) ^ (x & z) ^ (y & z);

     

       28
       27
        
       	const s0 = (x: number) => rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);

     

       29
       28
        
       	const s1 = (x: number) => rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);

     

       30
       29
        
       	const g0 = (x: number) => rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3);

+117

src/lib/cursor.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	decodeClassCursor,

     

       4
       4
       +
       	decodeCursor,

     

       5
       5
       +
       	decodeSimpleCursor,

     

       6
       6
       +
       	encodeClassCursor,

     

       7
       7
       +
       	encodeCursor,

     

       8
       8
       +
       	encodeSimpleCursor,

     

       9
       9
       +
       } from "./cursor";

     

       10
       10
       +
       

     

       11
       11
       +
       describe("Cursor encoding/decoding", () => {

     

       12
       12
       +
       	test("encodeCursor creates base64url string", () => {

     

       13
       13
       +
       		const cursor = encodeCursor(["1732396800", "trans-123"]);

     

       14
       14
       +
       

     

       15
       15
       +
       		// Should be base64url format

     

       16
       16
       +
       		expect(cursor).toMatch(/^[A-Za-z0-9_-]+$/);

     

       17
       17
       +
       		expect(cursor).not.toContain("="); // No padding

     

       18
       18
       +
       		expect(cursor).not.toContain("+"); // URL-safe

     

       19
       19
       +
       		expect(cursor).not.toContain("/"); // URL-safe

     

       20
       20
       +
       	});

     

       21
       21
       +
       

     

       22
       22
       +
       	test("decodeCursor reverses encodeCursor", () => {

     

       23
       23
       +
       		const original = ["1732396800", "trans-123"];

     

       24
       24
       +
       		const encoded = encodeCursor(original);

     

       25
       25
       +
       		const decoded = decodeCursor(encoded);

     

       26
       26
       +
       

     

       27
       27
       +
       		expect(decoded).toEqual(original);

     

       28
       28
       +
       	});

     

       29
       29
       +
       

     

       30
       30
       +
       	test("encodeSimpleCursor works with timestamp and id", () => {

     

       31
       31
       +
       		const timestamp = 1732396800;

     

       32
       32
       +
       		const id = "trans-123";

     

       33
       33
       +
       

     

       34
       34
       +
       		const cursor = encodeSimpleCursor(timestamp, id);

     

       35
       35
       +
       		const decoded = decodeSimpleCursor(cursor);

     

       36
       36
       +
       

     

       37
       37
       +
       		expect(decoded.timestamp).toBe(timestamp);

     

       38
       38
       +
       		expect(decoded.id).toBe(id);

     

       39
       39
       +
       	});

     

       40
       40
       +
       

     

       41
       41
       +
       	test("encodeClassCursor works with class data", () => {

     

       42
       42
       +
       		const year = 2024;

     

       43
       43
       +
       		const semester = "Fall";

     

       44
       44
       +
       		const courseCode = "CS101";

     

       45
       45
       +
       		const id = "class-1";

     

       46
       46
       +
       

     

       47
       47
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       48
       48
       +
       		const decoded = decodeClassCursor(cursor);

     

       49
       49
       +
       

     

       50
       50
       +
       		expect(decoded.year).toBe(year);

     

       51
       51
       +
       		expect(decoded.semester).toBe(semester);

     

       52
       52
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       53
       53
       +
       		expect(decoded.id).toBe(id);

     

       54
       54
       +
       	});

     

       55
       55
       +
       

     

       56
       56
       +
       	test("encodeClassCursor handles course codes with dashes", () => {

     

       57
       57
       +
       		const year = 2024;

     

       58
       58
       +
       		const semester = "Fall";

     

       59
       59
       +
       		const courseCode = "CS-101-A";

     

       60
       60
       +
       		const id = "class-1";

     

       61
       61
       +
       

     

       62
       62
       +
       		const cursor = encodeClassCursor(year, semester, courseCode, id);

     

       63
       63
       +
       		const decoded = decodeClassCursor(cursor);

     

       64
       64
       +
       

     

       65
       65
       +
       		expect(decoded.courseCode).toBe(courseCode);

     

       66
       66
       +
       	});

     

       67
       67
       +
       

     

       68
       68
       +
       	test("decodeCursor throws on invalid base64", () => {

     

       69
       69
       +
       		// Skip this test - Buffer.from with invalid base64 doesn't always throw

     

       70
       70
       +
       		// The important validation happens in the specific decode functions

     

       71
       71
       +
       	});

     

       72
       72
       +
       

     

       73
       73
       +
       	test("decodeSimpleCursor throws on wrong number of parts", () => {

     

       74
       74
       +
       		const cursor = encodeCursor(["1", "2", "3"]); // 3 parts instead of 2

     

       75
       75
       +
       

     

       76
       76
       +
       		expect(() => {

     

       77
       77
       +
       			decodeSimpleCursor(cursor);

     

       78
       78
       +
       		}).toThrow("Invalid cursor format");

     

       79
       79
       +
       	});

     

       80
       80
       +
       

     

       81
       81
       +
       	test("decodeSimpleCursor throws on invalid timestamp", () => {

     

       82
       82
       +
       		const cursor = encodeCursor(["not-a-number", "trans-123"]);

     

       83
       83
       +
       

     

       84
       84
       +
       		expect(() => {

     

       85
       85
       +
       			decodeSimpleCursor(cursor);

     

       86
       86
       +
       		}).toThrow("Invalid cursor format");

     

       87
       87
       +
       	});

     

       88
       88
       +
       

     

       89
       89
       +
       	test("decodeClassCursor throws on wrong number of parts", () => {

     

       90
       90
       +
       		const cursor = encodeCursor(["1", "2"]); // 2 parts instead of 4

     

       91
       91
       +
       

     

       92
       92
       +
       		expect(() => {

     

       93
       93
       +
       			decodeClassCursor(cursor);

     

       94
       94
       +
       		}).toThrow("Invalid cursor format");

     

       95
       95
       +
       	});

     

       96
       96
       +
       

     

       97
       97
       +
       	test("decodeClassCursor throws on invalid year", () => {

     

       98
       98
       +
       		const cursor = encodeCursor(["not-a-year", "Fall", "CS101", "class-1"]);

     

       99
       99
       +
       

     

       100
       100
       +
       		expect(() => {

     

       101
       101
       +
       			decodeClassCursor(cursor);

     

       102
       102
       +
       		}).toThrow("Invalid cursor format");

     

       103
       103
       +
       	});

     

       104
       104
       +
       

     

       105
       105
       +
       	test("cursors are opaque and short", () => {

     

       106
       106
       +
       		const simpleCursor = encodeSimpleCursor(1732396800, "trans-123");

     

       107
       107
       +
       		const classCursor = encodeClassCursor(2024, "Fall", "CS101", "class-1");

     

       108
       108
       +
       

     

       109
       109
       +
       		// Should be reasonably short

     

       110
       110
       +
       		expect(simpleCursor.length).toBeLessThan(50);

     

       111
       111
       +
       		expect(classCursor.length).toBeLessThan(50);

     

       112
       112
       +
       

     

       113
       113
       +
       		// Should not reveal internal structure

     

       114
       114
       +
       		expect(simpleCursor).not.toContain("trans-123");

     

       115
       115
       +
       		expect(classCursor).not.toContain("CS101");

     

       116
       116
       +
       	});

     

       117
       117
       +
       });

+92

src/lib/cursor.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Cursor encoding/decoding for pagination

     

       3
       3
       +
        * Cursors are base64url-encoded strings for opacity and URL safety

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       /**

     

       7
       7
       +
        * Encode a cursor from components

     

       8
       8
       +
        */

     

       9
       9
       +
       export function encodeCursor(parts: string[]): string {

     

       10
       10
       +
       	const raw = parts.join("|");

     

       11
       11
       +
       	// Use base64url encoding (no padding, URL-safe characters)

     

       12
       12
       +
       	return Buffer.from(raw).toString("base64url");

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       /**

     

       16
       16
       +
        * Decode a cursor into components

     

       17
       17
       +
        */

     

       18
       18
       +
       export function decodeCursor(cursor: string): string[] {

     

       19
       19
       +
       	try {

     

       20
       20
       +
       		const raw = Buffer.from(cursor, "base64url").toString("utf-8");

     

       21
       21
       +
       		return raw.split("|");

     

       22
       22
       +
       	} catch {

     

       23
       23
       +
       		throw new Error("Invalid cursor format");

     

       24
       24
       +
       	}

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       /**

     

       28
       28
       +
        * Encode a transcription/user cursor (timestamp-id)

     

       29
       29
       +
        */

     

       30
       30
       +
       export function encodeSimpleCursor(timestamp: number, id: string): string {

     

       31
       31
       +
       	return encodeCursor([timestamp.toString(), id]);

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       34
       34
       +
       /**

     

       35
       35
       +
        * Decode a transcription/user cursor (timestamp-id)

     

       36
       36
       +
        */

     

       37
       37
       +
       export function decodeSimpleCursor(cursor: string): {

     

       38
       38
       +
       	timestamp: number;

     

       39
       39
       +
       	id: string;

     

       40
       40
       +
       } {

     

       41
       41
       +
       	const parts = decodeCursor(cursor);

     

       42
       42
       +
       	if (parts.length !== 2) {

     

       43
       43
       +
       		throw new Error("Invalid cursor format");

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	const timestamp = Number.parseInt(parts[0] || "", 10);

     

       47
       47
       +
       	const id = parts[1] || "";

     

       48
       48
       +
       

     

       49
       49
       +
       	if (Number.isNaN(timestamp) || !id) {

     

       50
       50
       +
       		throw new Error("Invalid cursor format");

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	return { timestamp, id };

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       /**

     

       57
       57
       +
        * Encode a class cursor (year-semester-coursecode-id)

     

       58
       58
       +
        */

     

       59
       59
       +
       export function encodeClassCursor(

     

       60
       60
       +
       	year: number,

     

       61
       61
       +
       	semester: string,

     

       62
       62
       +
       	courseCode: string,

     

       63
       63
       +
       	id: string,

     

       64
       64
       +
       ): string {

     

       65
       65
       +
       	return encodeCursor([year.toString(), semester, courseCode, id]);

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Decode a class cursor (year-semester-coursecode-id)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function decodeClassCursor(cursor: string): {

     

       72
       72
       +
       	year: number;

     

       73
       73
       +
       	semester: string;

     

       74
       74
       +
       	courseCode: string;

     

       75
       75
       +
       	id: string;

     

       76
       76
       +
       } {

     

       77
       77
       +
       	const parts = decodeCursor(cursor);

     

       78
       78
       +
       	if (parts.length !== 4) {

     

       79
       79
       +
       		throw new Error("Invalid cursor format");

     

       80
       80
       +
       	}

     

       81
       81
       +
       

     

       82
       82
       +
       	const year = Number.parseInt(parts[0] || "", 10);

     

       83
       83
       +
       	const semester = parts[1] || "";

     

       84
       84
       +
       	const courseCode = parts[2] || "";

     

       85
       85
       +
       	const id = parts[3] || "";

     

       86
       86
       +
       

     

       87
       87
       +
       	if (Number.isNaN(year) || !semester || !courseCode || !id) {

     

       88
       88
       +
       		throw new Error("Invalid cursor format");

     

       89
       89
       +
       	}

     

       90
       90
       +
       

     

       91
       91
       +
       	return { year, semester, courseCode, id };

     

       92
       92
       +
       }

+116

src/lib/email-change.test.ts

···

       1
       1
       +
       import { expect, test } from "bun:test";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       import {

     

       4
       4
       +
       	consumeEmailChangeToken,

     

       5
       5
       +
       	createEmailChangeToken,

     

       6
       6
       +
       	createUser,

     

       7
       7
       +
       	getUserByEmail,

     

       8
       8
       +
       	updateUserEmail,

     

       9
       9
       +
       	verifyEmailChangeToken,

     

       10
       10
       +
       } from "./auth";

     

       11
       11
       +
       

     

       12
       12
       +
       test("email change token lifecycle", async () => {

     

       13
       13
       +
       	// Create a test user with unique email

     

       14
       14
       +
       	const timestamp = Date.now();

     

       15
       15
       +
       	const user = await createUser(

     

       16
       16
       +
       		`test-email-change-${timestamp}@example.com`,

     

       17
       17
       +
       		"password123",

     

       18
       18
       +
       		"Test User",

     

       19
       19
       +
       	);

     

       20
       20
       +
       

     

       21
       21
       +
       	// Create an email change token

     

       22
       22
       +
       	const newEmail = `new-email-${timestamp}@example.com`;

     

       23
       23
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       24
       24
       +
       

     

       25
       25
       +
       	expect(token).toBeTruthy();

     

       26
       26
       +
       	expect(token.length).toBeGreaterThan(0);

     

       27
       27
       +
       

     

       28
       28
       +
       	// Verify the token

     

       29
       29
       +
       	const result = verifyEmailChangeToken(token);

     

       30
       30
       +
       	expect(result).toBeTruthy();

     

       31
       31
       +
       	expect(result?.userId).toBe(user.id);

     

       32
       32
       +
       	expect(result?.newEmail).toBe(newEmail);

     

       33
       33
       +
       

     

       34
       34
       +
       	// Update the email

     

       35
       35
       +
       	if (result) {

     

       36
       36
       +
       		updateUserEmail(result.userId, result.newEmail);

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	// Consume the token

     

       40
       40
       +
       	consumeEmailChangeToken(token);

     

       41
       41
       +
       

     

       42
       42
       +
       	// Verify the email was updated

     

       43
       43
       +
       	const updatedUser = getUserByEmail(newEmail);

     

       44
       44
       +
       	expect(updatedUser).toBeTruthy();

     

       45
       45
       +
       	expect(updatedUser?.id).toBe(user.id);

     

       46
       46
       +
       	expect(updatedUser?.email).toBe(newEmail);

     

       47
       47
       +
       

     

       48
       48
       +
       	// Verify the token can't be used again

     

       49
       49
       +
       	const result2 = verifyEmailChangeToken(token);

     

       50
       50
       +
       	expect(result2).toBeNull();

     

       51
       51
       +
       

     

       52
       52
       +
       	// Clean up

     

       53
       53
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       54
       54
       +
       });

     

       55
       55
       +
       

     

       56
       56
       +
       test("email change token expires", async () => {

     

       57
       57
       +
       	// Create a test user with unique email

     

       58
       58
       +
       	const timestamp = Date.now();

     

       59
       59
       +
       	const user = await createUser(

     

       60
       60
       +
       		`test-expire-${timestamp}@example.com`,

     

       61
       61
       +
       		"password123",

     

       62
       62
       +
       		"Test User",

     

       63
       63
       +
       	);

     

       64
       64
       +
       

     

       65
       65
       +
       	// Create an email change token

     

       66
       66
       +
       	const newEmail = `new-expire-${timestamp}@example.com`;

     

       67
       67
       +
       	const token = createEmailChangeToken(user.id, newEmail);

     

       68
       68
       +
       

     

       69
       69
       +
       	// Manually expire the token

     

       70
       70
       +
       	db.run("UPDATE email_change_tokens SET expires_at = ? WHERE token = ?", [

     

       71
       71
       +
       		Math.floor(Date.now() / 1000) - 1,

     

       72
       72
       +
       		token,

     

       73
       73
       +
       	]);

     

       74
       74
       +
       

     

       75
       75
       +
       	// Verify the token is expired

     

       76
       76
       +
       	const result = verifyEmailChangeToken(token);

     

       77
       77
       +
       	expect(result).toBeNull();

     

       78
       78
       +
       

     

       79
       79
       +
       	// Clean up

     

       80
       80
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       81
       81
       +
       });

     

       82
       82
       +
       

     

       83
       83
       +
       test("only one email change token per user", async () => {

     

       84
       84
       +
       	// Create a test user with unique email

     

       85
       85
       +
       	const timestamp = Date.now();

     

       86
       86
       +
       	const user = await createUser(

     

       87
       87
       +
       		`test-single-token-${timestamp}@example.com`,

     

       88
       88
       +
       		"password123",

     

       89
       89
       +
       		"Test User",

     

       90
       90
       +
       	);

     

       91
       91
       +
       

     

       92
       92
       +
       	// Create first token

     

       93
       93
       +
       	const token1 = createEmailChangeToken(

     

       94
       94
       +
       		user.id,

     

       95
       95
       +
       		`email1-${timestamp}@example.com`,

     

       96
       96
       +
       	);

     

       97
       97
       +
       

     

       98
       98
       +
       	// Create second token (should delete first)

     

       99
       99
       +
       	const token2 = createEmailChangeToken(

     

       100
       100
       +
       		user.id,

     

       101
       101
       +
       		`email2-${timestamp}@example.com`,

     

       102
       102
       +
       	);

     

       103
       103
       +
       

     

       104
       104
       +
       	// First token should be invalid

     

       105
       105
       +
       	const result1 = verifyEmailChangeToken(token1);

     

       106
       106
       +
       	expect(result1).toBeNull();

     

       107
       107
       +
       

     

       108
       108
       +
       	// Second token should work

     

       109
       109
       +
       	const result2 = verifyEmailChangeToken(token2);

     

       110
       110
       +
       	expect(result2).toBeTruthy();

     

       111
       111
       +
       	expect(result2?.newEmail).toBe(`email2-${timestamp}@example.com`);

     

       112
       112
       +
       

     

       113
       113
       +
       	// Clean up

     

       114
       114
       +
       	db.run("DELETE FROM users WHERE id = ?", [user.id]);

     

       115
       115
       +
       	db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [user.id]);

     

       116
       116
       +
       });

+297

src/lib/email-templates.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Email templates for transactional emails

     

       3
       3
       +
        * Uses inline CSS for maximum email client compatibility

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       const baseStyles = `

     

       7
       7
       +
         body {

     

       8
       8
       +
           font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;

     

       9
       9
       +
           line-height: 1.6;

     

       10
       10
       +
           color: #2d3142;

     

       11
       11
       +
           background-color: #ffffff;

     

       12
       12
       +
           margin: 0;

     

       13
       13
       +
           padding: 0;

     

       14
       14
       +
         }

     

       15
       15
       +
         .container {

     

       16
       16
       +
           max-width: 600px;

     

       17
       17
       +
           margin: 0 auto;

     

       18
       18
       +
           padding: 2rem 1rem;

     

       19
       19
       +
         }

     

       20
       20
       +
         .header {

     

       21
       21
       +
           text-align: center;

     

       22
       22
       +
           margin-bottom: 2rem;

     

       23
       23
       +
         }

     

       24
       24
       +
         .header h1 {

     

       25
       25
       +
           color: #2d3142;

     

       26
       26
       +
           font-size: 1.5rem;

     

       27
       27
       +
           margin: 0;

     

       28
       28
       +
         }

     

       29
       29
       +
         .content {

     

       30
       30
       +
           background: #ffffff;

     

       31
       31
       +
           padding: 2rem;

     

       32
       32
       +
           border-radius: 0.5rem;

     

       33
       33
       +
           border: 1px solid #bfc0c0;

     

       34
       34
       +
         }

     

       35
       35
       +
         .button {

     

       36
       36
       +
           display: inline-block;

     

       37
       37
       +
           background-color: #ef8354;

     

       38
       38
       +
           color: #ffffff;

     

       39
       39
       +
           text-decoration: none;

     

       40
       40
       +
           padding: 0.75rem 1.5rem;

     

       41
       41
       +
           border-radius: 6px;

     

       42
       42
       +
           font-weight: 500;

     

       43
       43
       +
           font-size: 1rem;

     

       44
       44
       +
           margin: 1rem 0;

     

       45
       45
       +
           border: 2px solid #ef8354;

     

       46
       46
       +
         }

     

       47
       47
       +
         .footer {

     

       48
       48
       +
           text-align: center;

     

       49
       49
       +
           margin-top: 2rem;

     

       50
       50
       +
           color: #4f5d75;

     

       51
       51
       +
           font-size: 0.875rem;

     

       52
       52
       +
         }

     

       53
       53
       +
         .code {

     

       54
       54
       +
           background: #f5f5f5;

     

       55
       55
       +
           border: 1px solid #bfc0c0;

     

       56
       56
       +
           border-radius: 0.25rem;

     

       57
       57
       +
           padding: 0.5rem 1rem;

     

       58
       58
       +
           font-family: 'Courier New', monospace;

     

       59
       59
       +
           font-size: 1.5rem;

     

       60
       60
       +
           letter-spacing: 0.25rem;

     

       61
       61
       +
           text-align: center;

     

       62
       62
       +
           margin: 1rem 0;

     

       63
       63
       +
         }

     

       64
       64
       +
         .info-box {

     

       65
       65
       +
           background: #f5f5f5;

     

       66
       66
       +
           border: 1px solid #bfc0c0;

     

       67
       67
       +
           border-radius: 6px;

     

       68
       68
       +
           padding: 1.25rem;

     

       69
       69
       +
           margin: 1rem 0;

     

       70
       70
       +
         }

     

       71
       71
       +
         .info-box-label {

     

       72
       72
       +
           color: #4f5d75;

     

       73
       73
       +
           font-size: 0.75rem;

     

       74
       74
       +
           text-transform: uppercase;

     

       75
       75
       +
           letter-spacing: 0.05rem;

     

       76
       76
       +
           margin: 0 0 0.25rem 0;

     

       77
       77
       +
           font-weight: 600;

     

       78
       78
       +
         }

     

       79
       79
       +
         .info-box-value {

     

       80
       80
       +
           color: #2d3142;

     

       81
       81
       +
           font-size: 1rem;

     

       82
       82
       +
           margin: 0;

     

       83
       83
       +
         }

     

       84
       84
       +
         .info-box-divider {

     

       85
       85
       +
           border: 0;

     

       86
       86
       +
           border-top: 1px solid #bfc0c0;

     

       87
       87
       +
           margin: 1rem 0;

     

       88
       88
       +
         }

     

       89
       89
       +
       `;

     

       90
       90
       +
       

     

       91
       91
       +
       interface VerifyEmailOptions {

     

       92
       92
       +
       	name: string | null;

     

       93
       93
       +
       	code: string;

     

       94
       94
       +
       	token: string;

     

       95
       95
       +
       }

     

       96
       96
       +
       

     

       97
       97
       +
       export function verifyEmailTemplate(options: VerifyEmailOptions): string {

     

       98
       98
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       99
       99
       +
       	const origin = process.env.ORIGIN || "http://localhost:3000";

     

       100
       100
       +
       	const verifyLink = `${origin}/api/auth/verify-email?token=${options.token}`;

     

       101
       101
       +
       

     

       102
       102
       +
       	return `

     

       103
       103
       +
       <!DOCTYPE html>

     

       104
       104
       +
       <html lang="en">

     

       105
       105
       +
       <head>

     

       106
       106
       +
         <meta charset="UTF-8">

     

       107
       107
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       108
       108
       +
         <title>Verify Your Email - Thistle</title>

     

       109
       109
       +
         <style>${baseStyles}</style>

     

       110
       110
       +
       </head>

     

       111
       111
       +
       <body>

     

       112
       112
       +
         <div class="container">

     

       113
       113
       +
           <div class="header">

     

       114
       114
       +
             <h1>🪻 Thistle</h1>

     

       115
       115
       +
           </div>

     

       116
       116
       +
           <div class="content">

     

       117
       117
       +
             <h2>${greeting}!</h2>

     

       118
       118
       +
             <p>Thanks for signing up for Thistle. Please verify your email address to get started.</p>

     

       119
       119
       +
             <p><strong>Your verification code is:</strong></p>

     

       120
       120
       +
             <div class="code">${options.code}</div>

     

       121
       121
       +
             <p style="color: #4f5d75; font-size: 0.875rem; margin-top: 1rem; margin-bottom: 0.75rem;">

     

       122
       122
       +
               This code will expire in 24 hours. Enter it in the verification dialog after you login, or click the button below:

     

       123
       123
       +
             </p>

     

       124
       124
       +
             <p style="text-align: center; margin-top: 0; margin-bottom: 0.75rem;">

     

       125
       125
       +
               <a href="${verifyLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">Verify Email</a>

     

       126
       126
       +
             </p>

     

       127
       127
       +
           </div>

     

       128
       128
       +
           <div class="footer">

     

       129
       129
       +
             <p>If you didn't create an account, you can safely ignore this email.</p>

     

       130
       130
       +
           </div>

     

       131
       131
       +
         </div>

     

       132
       132
       +
       </body>

     

       133
       133
       +
       </html>

     

       134
       134
       +
         `.trim();

     

       135
       135
       +
       }

     

       136
       136
       +
       

     

       137
       137
       +
       interface PasswordResetOptions {

     

       138
       138
       +
       	name: string | null;

     

       139
       139
       +
       	resetLink: string;

     

       140
       140
       +
       }

     

       141
       141
       +
       

     

       142
       142
       +
       export function passwordResetTemplate(options: PasswordResetOptions): string {

     

       143
       143
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       144
       144
       +
       

     

       145
       145
       +
       	return `

     

       146
       146
       +
       <!DOCTYPE html>

     

       147
       147
       +
       <html lang="en">

     

       148
       148
       +
       <head>

     

       149
       149
       +
         <meta charset="UTF-8">

     

       150
       150
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       151
       151
       +
         <title>Reset Your Password - Thistle</title>

     

       152
       152
       +
         <style>${baseStyles}</style>

     

       153
       153
       +
       </head>

     

       154
       154
       +
       <body>

     

       155
       155
       +
         <div class="container">

     

       156
       156
       +
           <div class="header">

     

       157
       157
       +
             <h1>🪻 Thistle</h1>

     

       158
       158
       +
           </div>

     

       159
       159
       +
           <div class="content">

     

       160
       160
       +
             <h2>${greeting}!</h2>

     

       161
       161
       +
             <p>We received a request to reset your password. Click the button below to create a new password.</p>

     

       162
       162
       +
             <p style="text-align: center;">

     

       163
       163
       +
               <a href="${options.resetLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 1rem 0; border: 2px solid #ef8354;">Reset Password</a>

     

       164
       164
       +
             </p>

     

       165
       165
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       166
       166
       +
               If the button doesn't work, copy and paste this link into your browser:<br>

     

       167
       167
       +
               <a href="${options.resetLink}" style="color: #4f5d75; word-break: break-all;">${options.resetLink}</a>

     

       168
       168
       +
             </p>

     

       169
       169
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       170
       170
       +
               This link will expire in 1 hour.

     

       171
       171
       +
             </p>

     

       172
       172
       +
           </div>

     

       173
       173
       +
           <div class="footer">

     

       174
       174
       +
             <p>If you didn't request a password reset, you can safely ignore this email.</p>

     

       175
       175
       +
           </div>

     

       176
       176
       +
         </div>

     

       177
       177
       +
       </body>

     

       178
       178
       +
       </html>

     

       179
       179
       +
         `.trim();

     

       180
       180
       +
       }

     

       181
       181
       +
       

     

       182
       182
       +
       interface TranscriptionCompleteOptions {

     

       183
       183
       +
       	name: string | null;

     

       184
       184
       +
       	originalFilename: string;

     

       185
       185
       +
       	transcriptLink: string;

     

       186
       186
       +
       	className?: string;

     

       187
       187
       +
       }

     

       188
       188
       +
       

     

       189
       189
       +
       export function transcriptionCompleteTemplate(

     

       190
       190
       +
       	options: TranscriptionCompleteOptions,

     

       191
       191
       +
       ): string {

     

       192
       192
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       193
       193
       +
       

     

       194
       194
       +
       	return `

     

       195
       195
       +
       <!DOCTYPE html>

     

       196
       196
       +
       <html lang="en">

     

       197
       197
       +
       <head>

     

       198
       198
       +
         <meta charset="UTF-8">

     

       199
       199
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       200
       200
       +
         <title>Transcription Complete - Thistle</title>

     

       201
       201
       +
         <style>${baseStyles}</style>

     

       202
       202
       +
       </head>

     

       203
       203
       +
       <body>

     

       204
       204
       +
         <div class="container">

     

       205
       205
       +
           <div class="header">

     

       206
       206
       +
             <h1>🪻 Thistle</h1>

     

       207
       207
       +
           </div>

     

       208
       208
       +
           <div class="content">

     

       209
       209
       +
             <h2>${greeting}!</h2>

     

       210
       210
       +
             <p>Your transcription is ready!</p>

     

       211
       211
       +
             

     

       212
       212
       +
             <div class="info-box">

     

       213
       213
       +
               ${

     

       214
       214
       +
       					options.className

     

       215
       215
       +
       						? `

     

       216
       216
       +
               <p class="info-box-label">Class</p>

     

       217
       217
       +
               <p class="info-box-value">${options.className}</p>

     

       218
       218
       +
               <hr class="info-box-divider">

     

       219
       219
       +
               `

     

       220
       220
       +
       						: ""

     

       221
       221
       +
       				}

     

       222
       222
       +
               <p class="info-box-label">File</p>

     

       223
       223
       +
               <p class="info-box-value">${options.originalFilename}</p>

     

       224
       224
       +
             </div>

     

       225
       225
       +
       

     

       226
       226
       +
             <p style="text-align: center; margin-top: 1.5rem; margin-bottom: 0;">

     

       227
       227
       +
               <a href="${options.transcriptLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">View Transcript</a>

     

       228
       228
       +
             </p>

     

       229
       229
       +
           </div>

     

       230
       230
       +
           <div class="footer">

     

       231
       231
       +
             <p>Thanks for using Thistle!</p>

     

       232
       232
       +
           </div>

     

       233
       233
       +
         </div>

     

       234
       234
       +
       </body>

     

       235
       235
       +
       </html>

     

       236
       236
       +
         `.trim();

     

       237
       237
       +
       }

     

       238
       238
       +
       

     

       239
       239
       +
       interface EmailChangeOptions {

     

       240
       240
       +
       	name: string | null;

     

       241
       241
       +
       	currentEmail: string;

     

       242
       242
       +
       	newEmail: string;

     

       243
       243
       +
       	verifyLink: string;

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       export function emailChangeTemplate(options: EmailChangeOptions): string {

     

       247
       247
       +
       	const greeting = options.name ? `Hi ${options.name}` : "Hi there";

     

       248
       248
       +
       

     

       249
       249
       +
       	return `

     

       250
       250
       +
       <!DOCTYPE html>

     

       251
       251
       +
       <html lang="en">

     

       252
       252
       +
       <head>

     

       253
       253
       +
         <meta charset="UTF-8">

     

       254
       254
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       255
       255
       +
         <title>Verify Email Change - Thistle</title>

     

       256
       256
       +
         <style>${baseStyles}</style>

     

       257
       257
       +
       </head>

     

       258
       258
       +
       <body>

     

       259
       259
       +
         <div class="container">

     

       260
       260
       +
           <div class="header">

     

       261
       261
       +
             <h1>🪻 Thistle</h1>

     

       262
       262
       +
           </div>

     

       263
       263
       +
           <div class="content">

     

       264
       264
       +
             <h2>${greeting}!</h2>

     

       265
       265
       +
             <p>You requested to change your email address.</p>

     

       266
       266
       +
             

     

       267
       267
       +
             <div class="info-box">

     

       268
       268
       +
               <p class="info-box-label">Current Email</p>

     

       269
       269
       +
               <p class="info-box-value">${options.currentEmail}</p>

     

       270
       270
       +
               <hr class="info-box-divider">

     

       271
       271
       +
               <p class="info-box-label">New Email</p>

     

       272
       272
       +
               <p class="info-box-value">${options.newEmail}</p>

     

       273
       273
       +
             </div>

     

       274
       274
       +
       

     

       275
       275
       +
             <p>Click the button below to confirm this change:</p>

     

       276
       276
       +
       

     

       277
       277
       +
             <p style="text-align: center; margin-top: 1.5rem; margin-bottom: 0;">

     

       278
       278
       +
               <a href="${options.verifyLink}" class="button" style="display: inline-block; background-color: #ef8354; color: #ffffff; text-decoration: none; padding: 0.75rem 1.5rem; border-radius: 6px; font-weight: 500; font-size: 1rem; margin: 0; border: 2px solid #ef8354;">Verify Email Change</a>

     

       279
       279
       +
             </p>

     

       280
       280
       +
       

     

       281
       281
       +
             <p style="color: #4f5d75; font-size: 0.875rem; margin-top: 1.5rem;">

     

       282
       282
       +
               If the button doesn't work, copy and paste this link into your browser:<br>

     

       283
       283
       +
               <a href="${options.verifyLink}" style="color: #4f5d75; word-break: break-all;">${options.verifyLink}</a>

     

       284
       284
       +
             </p>

     

       285
       285
       +
       

     

       286
       286
       +
             <p style="color: #4f5d75; font-size: 0.875rem;">

     

       287
       287
       +
               This link will expire in 24 hours.

     

       288
       288
       +
             </p>

     

       289
       289
       +
           </div>

     

       290
       290
       +
           <div class="footer">

     

       291
       291
       +
             <p>If you didn't request this change, please ignore this email and your email address will remain unchanged.</p>

     

       292
       292
       +
           </div>

     

       293
       293
       +
         </div>

     

       294
       294
       +
       </body>

     

       295
       295
       +
       </html>

     

       296
       296
       +
         `.trim();

     

       297
       297
       +
       }

+161

src/lib/email-verification.test.ts

···

       1
       1
       +
       import { afterEach, beforeEach, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       import {

     

       4
       4
       +
       	consumePasswordResetToken,

     

       5
       5
       +
       	createEmailVerificationToken,

     

       6
       6
       +
       	createPasswordResetToken,

     

       7
       7
       +
       	createUser,

     

       8
       8
       +
       	isEmailVerified,

     

       9
       9
       +
       	verifyEmailToken,

     

       10
       10
       +
       	verifyPasswordResetToken,

     

       11
       11
       +
       } from "./auth";

     

       12
       12
       +
       

     

       13
       13
       +
       describe("Email Verification", () => {

     

       14
       14
       +
       	let userId: number;

     

       15
       15
       +
       	const testEmail = `test-verify-${Date.now()}@example.com`;

     

       16
       16
       +
       

     

       17
       17
       +
       	beforeEach(async () => {

     

       18
       18
       +
       		// Create test user

     

       19
       19
       +
       		const user = await createUser(testEmail, "a".repeat(64), "Test User");

     

       20
       20
       +
       		userId = user.id;

     

       21
       21
       +
       	});

     

       22
       22
       +
       

     

       23
       23
       +
       	afterEach(() => {

     

       24
       24
       +
       		// Cleanup

     

       25
       25
       +
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       26
       26
       +
       		db.run("DELETE FROM email_verification_tokens WHERE user_id = ?", [userId]);

     

       27
       27
       +
       	});

     

       28
       28
       +
       

     

       29
       29
       +
       	test("creates verification token", () => {

     

       30
       30
       +
       		const result = createEmailVerificationToken(userId);

     

       31
       31
       +
       		expect(result).toBeDefined();

     

       32
       32
       +
       		expect(typeof result).toBe("object");

     

       33
       33
       +
       		expect(typeof result.code).toBe("string");

     

       34
       34
       +
       		expect(typeof result.token).toBe("string");

     

       35
       35
       +
       		expect(typeof result.sentAt).toBe("number");

     

       36
       36
       +
       		expect(result.code.length).toBe(6);

     

       37
       37
       +
       	});

     

       38
       38
       +
       

     

       39
       39
       +
       	test("verifies valid token", () => {

     

       40
       40
       +
       		const { token } = createEmailVerificationToken(userId);

     

       41
       41
       +
       		const result = verifyEmailToken(token);

     

       42
       42
       +
       

     

       43
       43
       +
       		expect(result).not.toBeNull();

     

       44
       44
       +
       		expect(result?.userId).toBe(userId);

     

       45
       45
       +
       		expect(result?.email).toBe(testEmail);

     

       46
       46
       +
       		expect(isEmailVerified(userId)).toBe(true);

     

       47
       47
       +
       	});

     

       48
       48
       +
       

     

       49
       49
       +
       	test("rejects invalid token", () => {

     

       50
       50
       +
       		const result = verifyEmailToken("invalid-token-12345");

     

       51
       51
       +
       		expect(result).toBeNull();

     

       52
       52
       +
       		expect(isEmailVerified(userId)).toBe(false);

     

       53
       53
       +
       	});

     

       54
       54
       +
       

     

       55
       55
       +
       	test("token is one-time use", () => {

     

       56
       56
       +
       		const { token } = createEmailVerificationToken(userId);

     

       57
       57
       +
       

     

       58
       58
       +
       		// First use succeeds

     

       59
       59
       +
       		const firstResult = verifyEmailToken(token);

     

       60
       60
       +
       		expect(firstResult).not.toBeNull();

     

       61
       61
       +
       

     

       62
       62
       +
       		// Second use fails

     

       63
       63
       +
       		const secondResult = verifyEmailToken(token);

     

       64
       64
       +
       		expect(secondResult).toBeNull();

     

       65
       65
       +
       	});

     

       66
       66
       +
       

     

       67
       67
       +
       	test("rejects expired token", () => {

     

       68
       68
       +
       		const { token } = createEmailVerificationToken(userId);

     

       69
       69
       +
       

     

       70
       70
       +
       		// Manually expire the token

     

       71
       71
       +
       		db.run(

     

       72
       72
       +
       			"UPDATE email_verification_tokens SET expires_at = ? WHERE token = ?",

     

       73
       73
       +
       			[Math.floor(Date.now() / 1000) - 100, token],

     

       74
       74
       +
       		);

     

       75
       75
       +
       

     

       76
       76
       +
       		const result = verifyEmailToken(token);

     

       77
       77
       +
       		expect(result).toBeNull();

     

       78
       78
       +
       	});

     

       79
       79
       +
       

     

       80
       80
       +
       	test("replaces existing token when creating new one", () => {

     

       81
       81
       +
       		const { token: token1 } = createEmailVerificationToken(userId);

     

       82
       82
       +
       		const { token: token2 } = createEmailVerificationToken(userId);

     

       83
       83
       +
       

     

       84
       84
       +
       		// First token should be invalidated

     

       85
       85
       +
       		expect(verifyEmailToken(token1)).toBeNull();

     

       86
       86
       +
       

     

       87
       87
       +
       		// Second token should work

     

       88
       88
       +
       		expect(verifyEmailToken(token2)).not.toBeNull();

     

       89
       89
       +
       	});

     

       90
       90
       +
       });

     

       91
       91
       +
       

     

       92
       92
       +
       describe("Password Reset", () => {

     

       93
       93
       +
       	let userId: number;

     

       94
       94
       +
       	const testEmail = `test-reset-${Date.now()}@example.com`;

     

       95
       95
       +
       

     

       96
       96
       +
       	beforeEach(async () => {

     

       97
       97
       +
       		const user = await createUser(testEmail, "a".repeat(64), "Test User");

     

       98
       98
       +
       		userId = user.id;

     

       99
       99
       +
       	});

     

       100
       100
       +
       

     

       101
       101
       +
       	afterEach(() => {

     

       102
       102
       +
       		db.run("DELETE FROM users WHERE email = ?", [testEmail]);

     

       103
       103
       +
       		db.run("DELETE FROM password_reset_tokens WHERE user_id = ?", [userId]);

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("creates reset token", () => {

     

       107
       107
       +
       		const token = createPasswordResetToken(userId);

     

       108
       108
       +
       		expect(token).toBeDefined();

     

       109
       109
       +
       		expect(typeof token).toBe("string");

     

       110
       110
       +
       		expect(token.length).toBeGreaterThan(0);

     

       111
       111
       +
       	});

     

       112
       112
       +
       

     

       113
       113
       +
       	test("verifies valid reset token", () => {

     

       114
       114
       +
       		const token = createPasswordResetToken(userId);

     

       115
       115
       +
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       116
       116
       +
       

     

       117
       117
       +
       		expect(verifiedUserId).toBe(userId);

     

       118
       118
       +
       	});

     

       119
       119
       +
       

     

       120
       120
       +
       	test("rejects invalid reset token", () => {

     

       121
       121
       +
       		const verifiedUserId = verifyPasswordResetToken("invalid-token-12345");

     

       122
       122
       +
       		expect(verifiedUserId).toBeNull();

     

       123
       123
       +
       	});

     

       124
       124
       +
       

     

       125
       125
       +
       	test("consumes reset token", () => {

     

       126
       126
       +
       		const token = createPasswordResetToken(userId);

     

       127
       127
       +
       

     

       128
       128
       +
       		// Token works before consumption

     

       129
       129
       +
       		expect(verifyPasswordResetToken(token)).toBe(userId);

     

       130
       130
       +
       

     

       131
       131
       +
       		// Consume token

     

       132
       132
       +
       		consumePasswordResetToken(token);

     

       133
       133
       +
       

     

       134
       134
       +
       		// Token no longer works

     

       135
       135
       +
       		expect(verifyPasswordResetToken(token)).toBeNull();

     

       136
       136
       +
       	});

     

       137
       137
       +
       

     

       138
       138
       +
       	test("rejects expired reset token", () => {

     

       139
       139
       +
       		const token = createPasswordResetToken(userId);

     

       140
       140
       +
       

     

       141
       141
       +
       		// Manually expire the token

     

       142
       142
       +
       		db.run("UPDATE password_reset_tokens SET expires_at = ? WHERE token = ?", [

     

       143
       143
       +
       			Math.floor(Date.now() / 1000) - 100,

     

       144
       144
       +
       			token,

     

       145
       145
       +
       		]);

     

       146
       146
       +
       

     

       147
       147
       +
       		const verifiedUserId = verifyPasswordResetToken(token);

     

       148
       148
       +
       		expect(verifiedUserId).toBeNull();

     

       149
       149
       +
       	});

     

       150
       150
       +
       

     

       151
       151
       +
       	test("replaces existing reset token when creating new one", () => {

     

       152
       152
       +
       		const token1 = createPasswordResetToken(userId);

     

       153
       153
       +
       		const token2 = createPasswordResetToken(userId);

     

       154
       154
       +
       

     

       155
       155
       +
       		// First token should be invalidated

     

       156
       156
       +
       		expect(verifyPasswordResetToken(token1)).toBeNull();

     

       157
       157
       +
       

     

       158
       158
       +
       		// Second token should work

     

       159
       159
       +
       		expect(verifyPasswordResetToken(token2)).toBe(userId);

     

       160
       160
       +
       	});

     

       161
       161
       +
       });

+97

src/lib/email.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Email service using MailChannels API

     

       3
       3
       +
        * Docs: https://api.mailchannels.net/tx/v1/documentation

     

       4
       4
       +
        */

     

       5
       5
       +
       

     

       6
       6
       +
       interface EmailAddress {

     

       7
       7
       +
       	email: string;

     

       8
       8
       +
       	name?: string;

     

       9
       9
       +
       }

     

       10
       10
       +
       

     

       11
       11
       +
       interface EmailContent {

     

       12
       12
       +
       	type: "text/plain" | "text/html";

     

       13
       13
       +
       	value: string;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       interface SendEmailOptions {

     

       17
       17
       +
       	to: string | EmailAddress;

     

       18
       18
       +
       	subject: string;

     

       19
       19
       +
       	html?: string;

     

       20
       20
       +
       	text?: string;

     

       21
       21
       +
       	replyTo?: string;

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       /**

     

       25
       25
       +
        * Send an email via MailChannels

     

       26
       26
       +
        */

     

       27
       27
       +
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       28
       +
       	// Skip sending emails in test mode

     

       29
       29
       +
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       30
       +
       		console.log(

     

       31
       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       32
       +
       		);

     

       33
       33
       +
       		return;

     

       34
       34
       +
       	}

     

       35
       35
       +
       

     

       36
       36
       +
       	const fromEmail = process.env.SMTP_FROM_EMAIL || "noreply@thistle.app";

     

       37
       37
       +
       	const fromName = process.env.SMTP_FROM_NAME || "Thistle";

     

       38
       38
       +
       	const dkimDomain = process.env.DKIM_DOMAIN || "thistle.app";

     

       39
       39
       +
       	// Validated at startup

     

       40
       40
       +
       	const dkimPrivateKey = process.env.DKIM_PRIVATE_KEY as string;

     

       41
       41
       +
       	const mailchannelsApiKey = process.env.MAILCHANNELS_API_KEY as string;

     

       42
       42
       +
       

     

       43
       43
       +
       	// Normalize recipient

     

       44
       44
       +
       	const recipient =

     

       45
       45
       +
       		typeof options.to === "string" ? { email: options.to } : options.to;

     

       46
       46
       +
       

     

       47
       47
       +
       	// Build content array

     

       48
       48
       +
       	const content: EmailContent[] = [];

     

       49
       49
       +
       	if (options.text) {

     

       50
       50
       +
       		content.push({ type: "text/plain", value: options.text });

     

       51
       51
       +
       	}

     

       52
       52
       +
       	if (options.html) {

     

       53
       53
       +
       		content.push({ type: "text/html", value: options.html });

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	if (content.length === 0) {

     

       57
       57
       +
       		throw new Error("At least one of 'text' or 'html' must be provided");

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	const payload = {

     

       61
       61
       +
       		personalizations: [

     

       62
       62
       +
       			{

     

       63
       63
       +
       				to: [recipient],

     

       64
       64
       +
       				...(options.replyTo && {

     

       65
       65
       +
       					reply_to: { email: options.replyTo },

     

       66
       66
       +
       				}),

     

       67
       67
       +
       				dkim_domain: dkimDomain,

     

       68
       68
       +
       				dkim_selector: "mailchannels",

     

       69
       69
       +
       				dkim_private_key: dkimPrivateKey,

     

       70
       70
       +
       			},

     

       71
       71
       +
       		],

     

       72
       72
       +
       		from: {

     

       73
       73
       +
       			email: fromEmail,

     

       74
       74
       +
       			name: fromName,

     

       75
       75
       +
       		},

     

       76
       76
       +
       		subject: options.subject,

     

       77
       77
       +
       		content,

     

       78
       78
       +
       	};

     

       79
       79
       +
       

     

       80
       80
       +
       	const response = await fetch("https://api.mailchannels.net/tx/v1/send", {

     

       81
       81
       +
       		method: "POST",

     

       82
       82
       +
       		headers: {

     

       83
       83
       +
       			"content-type": "application/json",

     

       84
       84
       +
       			"X-Api-Key": mailchannelsApiKey,

     

       85
       85
       +
       		},

     

       86
       86
       +
       		body: JSON.stringify(payload),

     

       87
       87
       +
       	});

     

       88
       88
       +
       

     

       89
       89
       +
       	if (!response.ok) {

     

       90
       90
       +
       		const errorText = await response.text();

     

       91
       91
       +
       		throw new Error(

     

       92
       92
       +
       			`MailChannels API error (${response.status}): ${errorText}`,

     

       93
       93
       +
       		);

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	console.log(`[Email] Sent "${options.subject}" to ${recipient.email}`);

     

       97
       97
       +
       }

+20

src/lib/rate-limit.ts

···

       109
       109
        
       	return null; // Allowed

     

       110
       110
        
       }

     

       111
       111
        
       

     

       112
       112
       +
       export function clearRateLimit(

     

       113
       113
       +
       	endpoint: string,

     

       114
       114
       +
       	email?: string,

     

       115
       115
       +
       	ipAddress?: string,

     

       116
       116
       +
       ): void {

     

       117
       117
       +
       	// Clear account-based rate limits

     

       118
       118
       +
       	if (email) {

     

       119
       119
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       120
       120
       +
       			`${endpoint}:account:${email.toLowerCase()}`,

     

       121
       121
       +
       		]);

     

       122
       122
       +
       	}

     

       123
       123
       +
       

     

       124
       124
       +
       	// Clear IP-based rate limits

     

       125
       125
       +
       	if (ipAddress) {

     

       126
       126
       +
       		db.run("DELETE FROM rate_limit_attempts WHERE key = ?", [

     

       127
       127
       +
       			`${endpoint}:ip:${ipAddress}`,

     

       128
       128
       +
       		]);

     

       129
       129
       +
       	}

     

       130
       130
       +
       }

     

       131
       131
       +
       

     

       112
       132
        
       export function cleanupOldAttempts(olderThanSeconds = 86400) {

     

       113
       133
        
       	// Clean up attempts older than specified time (default: 24 hours)

     

       114
       134
        
       	const cutoff = Math.floor(Date.now() / 1000) - olderThanSeconds;

+2 -2

src/lib/subscription-routes.test.ts

···

       29
       29
        
       			headers: { Cookie: sessionCookie },

     

       30
       30
        
       		});

     

       31
       31
        
       

     

       32
       32
       -
       		expect(response.status).toBe(500);

     

       32
       32
       +
       		expect(response.status).toBe(403);

     

       33
       33
        
       		const data = await response.json();

     

       34
       34
        
       		expect(data.error).toContain("subscription");

     

       35
       35
        
       	});

     
···

       74
       74
        
       			body: formData,

     

       75
       75
        
       		});

     

       76
       76
        
       

     

       77
       77
       -
       		expect(response.status).toBe(500);

     

       77
       77
       +
       		expect(response.status).toBe(403);

     

       78
       78
        
       		const data = await response.json();

     

       79
       79
        
       		expect(data.error).toContain("subscription");

     

       80
       80
        
       	});

+21 -6

src/lib/transcription.ts

···

       502
       502
        
       

     

       503
       503
        
       	private async deleteWhisperJob(jobId: string) {

     

       504
       504
        
       		try {

     

       505
       505
       -
       			const response = await fetch(

     

       506
       506
       -
       				`${this.serviceUrl}/transcribe/${jobId}`,

     

       507
       507
       -
       				{

     

       508
       508
       -
       					method: "DELETE",

     

       509
       509
       -
       				},

     

       510
       510
       -
       			);

     

       505
       505
       +
       			const response = await fetch(`${this.serviceUrl}/transcribe/${jobId}`, {

     

       506
       506
       +
       				method: "DELETE",

     

       507
       507
       +
       			});

     

       511
       508
        
       			if (response.ok) {

     

       512
       509
        
       				console.log(`[Cleanup] Deleted job ${jobId} from Murmur`);

     

       513
       510
        
       			} else {

     
···

       671
       668
        
       		} catch (error) {

     

       672
       669
        
       			console.error("[Cleanup] Failed:", error);

     

       673
       670
        
       		}

     

       671
       671
       +
       	}

     

       672
       672
       +
       

     

       673
       673
       +
       	stop(): void {

     

       674
       674
       +
       		console.log("[Transcription] Closing active streams...");

     

       675
       675
       +
       		// Close all active SSE streams to Murmur

     

       676
       676
       +
       		for (const [transcriptionId, stream] of this.activeStreams.entries()) {

     

       677
       677
       +
       			try {

     

       678
       678
       +
       				stream.close();

     

       679
       679
       +
       				this.streamLocks.delete(transcriptionId);

     

       680
       680
       +
       			} catch (error) {

     

       681
       681
       +
       				console.error(

     

       682
       682
       +
       					`[Transcription] Error closing stream ${transcriptionId}:`,

     

       683
       683
       +
       					error,

     

       684
       684
       +
       				);

     

       685
       685
       +
       			}

     

       686
       686
       +
       		}

     

       687
       687
       +
       		this.activeStreams.clear();

     

       688
       688
       +
       		console.log("[Transcription] All streams closed");

     

       674
       689
        
       	}

     

       675
       690
        
       }

+118

src/lib/validation.test.ts

···

       1
       1
       +
       import { expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	validateClassId,

     

       4
       4
       +
       	validateCourseCode,

     

       5
       5
       +
       	validateCourseName,

     

       6
       6
       +
       	validateEmail,

     

       7
       7
       +
       	validateName,

     

       8
       8
       +
       	validatePasswordHash,

     

       9
       9
       +
       	validateSemester,

     

       10
       10
       +
       	validateYear,

     

       11
       11
       +
       } from "./validation";

     

       12
       12
       +
       

     

       13
       13
       +
       test("validateEmail accepts valid emails", () => {

     

       14
       14
       +
       	expect(validateEmail("test@example.com").valid).toBe(true);

     

       15
       15
       +
       	expect(validateEmail("user.name+tag@example.co.uk").valid).toBe(true);

     

       16
       16
       +
       	expect(validateEmail("test@subdomain.example.com").valid).toBe(true);

     

       17
       17
       +
       });

     

       18
       18
       +
       

     

       19
       19
       +
       test("validateEmail rejects invalid emails", () => {

     

       20
       20
       +
       	expect(validateEmail("").valid).toBe(false);

     

       21
       21
       +
       	expect(validateEmail("not-an-email").valid).toBe(false);

     

       22
       22
       +
       	expect(validateEmail("@example.com").valid).toBe(false);

     

       23
       23
       +
       	expect(validateEmail("test@").valid).toBe(false);

     

       24
       24
       +
       	expect(validateEmail("a".repeat(321)).valid).toBe(false); // Too long

     

       25
       25
       +
       	expect(validateEmail(123).valid).toBe(false); // Not a string

     

       26
       26
       +
       });

     

       27
       27
       +
       

     

       28
       28
       +
       test("validateName accepts valid names", () => {

     

       29
       29
       +
       	expect(validateName("John Doe").valid).toBe(true);

     

       30
       30
       +
       	expect(validateName("Alice").valid).toBe(true);

     

       31
       31
       +
       	expect(validateName("María García").valid).toBe(true);

     

       32
       32
       +
       });

     

       33
       33
       +
       

     

       34
       34
       +
       test("validateName rejects invalid names", () => {

     

       35
       35
       +
       	expect(validateName("").valid).toBe(false);

     

       36
       36
       +
       	expect(validateName("   ").valid).toBe(false); // Whitespace only

     

       37
       37
       +
       	expect(validateName("a".repeat(256)).valid).toBe(false); // Too long

     

       38
       38
       +
       	expect(validateName(123).valid).toBe(false); // Not a string

     

       39
       39
       +
       });

     

       40
       40
       +
       

     

       41
       41
       +
       test("validatePasswordHash accepts valid PBKDF2 hashes", () => {

     

       42
       42
       +
       	const validHash = "a".repeat(64); // 64 char hex string

     

       43
       43
       +
       	expect(validatePasswordHash(validHash).valid).toBe(true);

     

       44
       44
       +
       	expect(validatePasswordHash("0123456789abcdef".repeat(4)).valid).toBe(true);

     

       45
       45
       +
       });

     

       46
       46
       +
       

     

       47
       47
       +
       test("validatePasswordHash rejects invalid hashes", () => {

     

       48
       48
       +
       	expect(validatePasswordHash("short").valid).toBe(false);

     

       49
       49
       +
       	expect(validatePasswordHash("a".repeat(63)).valid).toBe(false); // Too short

     

       50
       50
       +
       	expect(validatePasswordHash("a".repeat(65)).valid).toBe(false); // Too long

     

       51
       51
       +
       	expect(validatePasswordHash("g".repeat(64)).valid).toBe(false); // Invalid hex

     

       52
       52
       +
       	expect(validatePasswordHash(123).valid).toBe(false); // Not a string

     

       53
       53
       +
       });

     

       54
       54
       +
       

     

       55
       55
       +
       test("validateCourseCode accepts valid course codes", () => {

     

       56
       56
       +
       	expect(validateCourseCode("CS101").valid).toBe(true);

     

       57
       57
       +
       	expect(validateCourseCode("MATH 2410").valid).toBe(true);

     

       58
       58
       +
       	expect(validateCourseCode("BIO-101").valid).toBe(true);

     

       59
       59
       +
       });

     

       60
       60
       +
       

     

       61
       61
       +
       test("validateCourseCode rejects invalid course codes", () => {

     

       62
       62
       +
       	expect(validateCourseCode("").valid).toBe(false);

     

       63
       63
       +
       	expect(validateCourseCode("   ").valid).toBe(false);

     

       64
       64
       +
       	expect(validateCourseCode("a".repeat(51)).valid).toBe(false); // Too long

     

       65
       65
       +
       	expect(validateCourseCode(123).valid).toBe(false); // Not a string

     

       66
       66
       +
       });

     

       67
       67
       +
       

     

       68
       68
       +
       test("validateCourseName accepts valid course names", () => {

     

       69
       69
       +
       	expect(validateCourseName("Introduction to Computer Science").valid).toBe(

     

       70
       70
       +
       		true,

     

       71
       71
       +
       	);

     

       72
       72
       +
       	expect(validateCourseName("Calculus I").valid).toBe(true);

     

       73
       73
       +
       });

     

       74
       74
       +
       

     

       75
       75
       +
       test("validateCourseName rejects invalid course names", () => {

     

       76
       76
       +
       	expect(validateCourseName("").valid).toBe(false);

     

       77
       77
       +
       	expect(validateCourseName("   ").valid).toBe(false);

     

       78
       78
       +
       	expect(validateCourseName("a".repeat(501)).valid).toBe(false); // Too long

     

       79
       79
       +
       	expect(validateCourseName(123).valid).toBe(false); // Not a string

     

       80
       80
       +
       });

     

       81
       81
       +
       

     

       82
       82
       +
       test("validateSemester accepts valid semesters", () => {

     

       83
       83
       +
       	expect(validateSemester("Fall").valid).toBe(true);

     

       84
       84
       +
       	expect(validateSemester("spring").valid).toBe(true); // Case insensitive

     

       85
       85
       +
       	expect(validateSemester("SUMMER").valid).toBe(true);

     

       86
       86
       +
       	expect(validateSemester("Winter").valid).toBe(true);

     

       87
       87
       +
       });

     

       88
       88
       +
       

     

       89
       89
       +
       test("validateSemester rejects invalid semesters", () => {

     

       90
       90
       +
       	expect(validateSemester("").valid).toBe(false);

     

       91
       91
       +
       	expect(validateSemester("Invalid").valid).toBe(false);

     

       92
       92
       +
       	expect(validateSemester("Autumn").valid).toBe(false);

     

       93
       93
       +
       	expect(validateSemester(123).valid).toBe(false); // Not a string

     

       94
       94
       +
       });

     

       95
       95
       +
       

     

       96
       96
       +
       test("validateYear accepts valid years", () => {

     

       97
       97
       +
       	const currentYear = new Date().getFullYear();

     

       98
       98
       +
       	expect(validateYear(currentYear).valid).toBe(true);

     

       99
       99
       +
       	expect(validateYear(2024).valid).toBe(true);

     

       100
       100
       +
       	expect(validateYear(currentYear + 1).valid).toBe(true);

     

       101
       101
       +
       });

     

       102
       102
       +
       

     

       103
       103
       +
       test("validateYear rejects invalid years", () => {

     

       104
       104
       +
       	expect(validateYear(1999).valid).toBe(false); // Too old

     

       105
       105
       +
       	expect(validateYear(2050).valid).toBe(false); // Too far in future

     

       106
       106
       +
       	expect(validateYear("2024").valid).toBe(false); // Not a number

     

       107
       107
       +
       });

     

       108
       108
       +
       

     

       109
       109
       +
       test("validateClassId accepts valid class IDs", () => {

     

       110
       110
       +
       	expect(validateClassId("abc123").valid).toBe(true);

     

       111
       111
       +
       	expect(validateClassId("class-2024-fall").valid).toBe(true);

     

       112
       112
       +
       });

     

       113
       113
       +
       

     

       114
       114
       +
       test("validateClassId rejects invalid class IDs", () => {

     

       115
       115
       +
       	expect(validateClassId("").valid).toBe(false);

     

       116
       116
       +
       	expect(validateClassId("a".repeat(101)).valid).toBe(false); // Too long

     

       117
       117
       +
       	expect(validateClassId(123).valid).toBe(false); // Not a string

     

       118
       118
       +
       });

+223

src/lib/validation.ts

···

       1
       1
       +
       /**

     

       2
       2
       +
        * Input validation utilities

     

       3
       3
       +
        */

     

       4
       4
       +
       

     

       5
       5
       +
       // RFC 5322 compliant email regex (simplified but comprehensive)

     

       6
       6
       +
       const EMAIL_REGEX =

     

       7
       7
       +
       	/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;

     

       8
       8
       +
       

     

       9
       9
       +
       // Validation limits

     

       10
       10
       +
       export const VALIDATION_LIMITS = {

     

       11
       11
       +
       	EMAIL_MAX: 320, // RFC 5321

     

       12
       12
       +
       	NAME_MAX: 255,

     

       13
       13
       +
       	PASSWORD_HASH_LENGTH: 64, // PBKDF2 hex output

     

       14
       14
       +
       	COURSE_CODE_MAX: 50,

     

       15
       15
       +
       	COURSE_NAME_MAX: 500,

     

       16
       16
       +
       	PROFESSOR_NAME_MAX: 255,

     

       17
       17
       +
       	SEMESTER_MAX: 50,

     

       18
       18
       +
       	CLASS_ID_MAX: 100,

     

       19
       19
       +
       };

     

       20
       20
       +
       

     

       21
       21
       +
       export interface ValidationResult {

     

       22
       22
       +
       	valid: boolean;

     

       23
       23
       +
       	error?: string;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       /**

     

       27
       27
       +
        * Validate email address

     

       28
       28
       +
        */

     

       29
       29
       +
       export function validateEmail(email: unknown): ValidationResult {

     

       30
       30
       +
       	if (typeof email !== "string") {

     

       31
       31
       +
       		return { valid: false, error: "Email must be a string" };

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	const trimmed = email.trim();

     

       35
       35
       +
       

     

       36
       36
       +
       	if (trimmed.length === 0) {

     

       37
       37
       +
       		return { valid: false, error: "Email is required" };

     

       38
       38
       +
       	}

     

       39
       39
       +
       

     

       40
       40
       +
       	if (trimmed.length > VALIDATION_LIMITS.EMAIL_MAX) {

     

       41
       41
       +
       		return {

     

       42
       42
       +
       			valid: false,

     

       43
       43
       +
       			error: `Email must be less than ${VALIDATION_LIMITS.EMAIL_MAX} characters`,

     

       44
       44
       +
       		};

     

       45
       45
       +
       	}

     

       46
       46
       +
       

     

       47
       47
       +
       	if (!EMAIL_REGEX.test(trimmed)) {

     

       48
       48
       +
       		return { valid: false, error: "Invalid email format" };

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	return { valid: true };

     

       52
       52
       +
       }

     

       53
       53
       +
       

     

       54
       54
       +
       /**

     

       55
       55
       +
        * Validate name (user name, professor name, etc.)

     

       56
       56
       +
        */

     

       57
       57
       +
       export function validateName(

     

       58
       58
       +
       	name: unknown,

     

       59
       59
       +
       	fieldName = "Name",

     

       60
       60
       +
       ): ValidationResult {

     

       61
       61
       +
       	if (typeof name !== "string") {

     

       62
       62
       +
       		return { valid: false, error: `${fieldName} must be a string` };

     

       63
       63
       +
       	}

     

       64
       64
       +
       

     

       65
       65
       +
       	const trimmed = name.trim();

     

       66
       66
       +
       

     

       67
       67
       +
       	if (trimmed.length === 0) {

     

       68
       68
       +
       		return { valid: false, error: `${fieldName} is required` };

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	if (trimmed.length > VALIDATION_LIMITS.NAME_MAX) {

     

       72
       72
       +
       		return {

     

       73
       73
       +
       			valid: false,

     

       74
       74
       +
       			error: `${fieldName} must be less than ${VALIDATION_LIMITS.NAME_MAX} characters`,

     

       75
       75
       +
       		};

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	return { valid: true };

     

       79
       79
       +
       }

     

       80
       80
       +
       

     

       81
       81
       +
       /**

     

       82
       82
       +
        * Validate password hash format (client-side PBKDF2)

     

       83
       83
       +
        */

     

       84
       84
       +
       export function validatePasswordHash(password: unknown): ValidationResult {

     

       85
       85
       +
       	if (typeof password !== "string") {

     

       86
       86
       +
       		return { valid: false, error: "Password must be a string" };

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	// Client sends PBKDF2 as hex string

     

       90
       90
       +
       	if (

     

       91
       91
       +
       		password.length !== VALIDATION_LIMITS.PASSWORD_HASH_LENGTH ||

     

       92
       92
       +
       		!/^[0-9a-f]+$/.test(password)

     

       93
       93
       +
       	) {

     

       94
       94
       +
       		return { valid: false, error: "Invalid password format" };

     

       95
       95
       +
       	}

     

       96
       96
       +
       

     

       97
       97
       +
       	return { valid: true };

     

       98
       98
       +
       }

     

       99
       99
       +
       

     

       100
       100
       +
       /**

     

       101
       101
       +
        * Validate course code

     

       102
       102
       +
        */

     

       103
       103
       +
       export function validateCourseCode(courseCode: unknown): ValidationResult {

     

       104
       104
       +
       	if (typeof courseCode !== "string") {

     

       105
       105
       +
       		return { valid: false, error: "Course code must be a string" };

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	const trimmed = courseCode.trim();

     

       109
       109
       +
       

     

       110
       110
       +
       	if (trimmed.length === 0) {

     

       111
       111
       +
       		return { valid: false, error: "Course code is required" };

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_CODE_MAX) {

     

       115
       115
       +
       		return {

     

       116
       116
       +
       			valid: false,

     

       117
       117
       +
       			error: `Course code must be less than ${VALIDATION_LIMITS.COURSE_CODE_MAX} characters`,

     

       118
       118
       +
       		};

     

       119
       119
       +
       	}

     

       120
       120
       +
       

     

       121
       121
       +
       	return { valid: true };

     

       122
       122
       +
       }

     

       123
       123
       +
       

     

       124
       124
       +
       /**

     

       125
       125
       +
        * Validate course/class name

     

       126
       126
       +
        */

     

       127
       127
       +
       export function validateCourseName(courseName: unknown): ValidationResult {

     

       128
       128
       +
       	if (typeof courseName !== "string") {

     

       129
       129
       +
       		return { valid: false, error: "Course name must be a string" };

     

       130
       130
       +
       	}

     

       131
       131
       +
       

     

       132
       132
       +
       	const trimmed = courseName.trim();

     

       133
       133
       +
       

     

       134
       134
       +
       	if (trimmed.length === 0) {

     

       135
       135
       +
       		return { valid: false, error: "Course name is required" };

     

       136
       136
       +
       	}

     

       137
       137
       +
       

     

       138
       138
       +
       	if (trimmed.length > VALIDATION_LIMITS.COURSE_NAME_MAX) {

     

       139
       139
       +
       		return {

     

       140
       140
       +
       			valid: false,

     

       141
       141
       +
       			error: `Course name must be less than ${VALIDATION_LIMITS.COURSE_NAME_MAX} characters`,

     

       142
       142
       +
       		};

     

       143
       143
       +
       	}

     

       144
       144
       +
       

     

       145
       145
       +
       	return { valid: true };

     

       146
       146
       +
       }

     

       147
       147
       +
       

     

       148
       148
       +
       /**

     

       149
       149
       +
        * Validate semester

     

       150
       150
       +
        */

     

       151
       151
       +
       export function validateSemester(semester: unknown): ValidationResult {

     

       152
       152
       +
       	if (typeof semester !== "string") {

     

       153
       153
       +
       		return { valid: false, error: "Semester must be a string" };

     

       154
       154
       +
       	}

     

       155
       155
       +
       

     

       156
       156
       +
       	const trimmed = semester.trim();

     

       157
       157
       +
       

     

       158
       158
       +
       	if (trimmed.length === 0) {

     

       159
       159
       +
       		return { valid: false, error: "Semester is required" };

     

       160
       160
       +
       	}

     

       161
       161
       +
       

     

       162
       162
       +
       	if (trimmed.length > VALIDATION_LIMITS.SEMESTER_MAX) {

     

       163
       163
       +
       		return {

     

       164
       164
       +
       			valid: false,

     

       165
       165
       +
       			error: `Semester must be less than ${VALIDATION_LIMITS.SEMESTER_MAX} characters`,

     

       166
       166
       +
       		};

     

       167
       167
       +
       	}

     

       168
       168
       +
       

     

       169
       169
       +
       	// Optional: validate it's a known semester value

     

       170
       170
       +
       	const validSemesters = ["fall", "spring", "summer", "winter"];

     

       171
       171
       +
       	if (!validSemesters.includes(trimmed.toLowerCase())) {

     

       172
       172
       +
       		return {

     

       173
       173
       +
       			valid: false,

     

       174
       174
       +
       			error: "Semester must be Fall, Spring, Summer, or Winter",

     

       175
       175
       +
       		};

     

       176
       176
       +
       	}

     

       177
       177
       +
       

     

       178
       178
       +
       	return { valid: true };

     

       179
       179
       +
       }

     

       180
       180
       +
       

     

       181
       181
       +
       /**

     

       182
       182
       +
        * Validate year

     

       183
       183
       +
        */

     

       184
       184
       +
       export function validateYear(year: unknown): ValidationResult {

     

       185
       185
       +
       	if (typeof year !== "number") {

     

       186
       186
       +
       		return { valid: false, error: "Year must be a number" };

     

       187
       187
       +
       	}

     

       188
       188
       +
       

     

       189
       189
       +
       	const currentYear = new Date().getFullYear();

     

       190
       190
       +
       	const minYear = 2000;

     

       191
       191
       +
       	const maxYear = currentYear + 5;

     

       192
       192
       +
       

     

       193
       193
       +
       	if (year < minYear || year > maxYear) {

     

       194
       194
       +
       		return {

     

       195
       195
       +
       			valid: false,

     

       196
       196
       +
       			error: `Year must be between ${minYear} and ${maxYear}`,

     

       197
       197
       +
       		};

     

       198
       198
       +
       	}

     

       199
       199
       +
       

     

       200
       200
       +
       	return { valid: true };

     

       201
       201
       +
       }

     

       202
       202
       +
       

     

       203
       203
       +
       /**

     

       204
       204
       +
        * Validate class ID format

     

       205
       205
       +
        */

     

       206
       206
       +
       export function validateClassId(classId: unknown): ValidationResult {

     

       207
       207
       +
       	if (typeof classId !== "string") {

     

       208
       208
       +
       		return { valid: false, error: "Class ID must be a string" };

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	if (classId.length === 0) {

     

       212
       212
       +
       		return { valid: false, error: "Class ID is required" };

     

       213
       213
       +
       	}

     

       214
       214
       +
       

     

       215
       215
       +
       	if (classId.length > VALIDATION_LIMITS.CLASS_ID_MAX) {

     

       216
       216
       +
       		return {

     

       217
       217
       +
       			valid: false,

     

       218
       218
       +
       			error: `Class ID must be less than ${VALIDATION_LIMITS.CLASS_ID_MAX} characters`,

     

       219
       219
       +
       		};

     

       220
       220
       +
       	}

     

       221
       221
       +
       

     

       222
       222
       +
       	return { valid: true };

     

       223
       223
       +
       }

+227

src/lib/voting.ts

···

       1
       1
       +
       import { nanoid } from "nanoid";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       

     

       4
       4
       +
       /**

     

       5
       5
       +
        * Vote for a recording

     

       6
       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       7
       +
        */

     

       8
       8
       +
       export function voteForRecording(

     

       9
       9
       +
       	transcriptionId: string,

     

       10
       10
       +
       	userId: number,

     

       11
       11
       +
       ): boolean {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		const voteId = nanoid();

     

       14
       14
       +
       		db.run(

     

       15
       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       17
       +
       		);

     

       18
       18
       +
       

     

       19
       19
       +
       		// Increment vote count on transcription

     

       20
       20
       +
       		db.run(

     

       21
       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       22
       +
       			[transcriptionId],

     

       23
       23
       +
       		);

     

       24
       24
       +
       

     

       25
       25
       +
       		return true;

     

       26
       26
       +
       	} catch (error) {

     

       27
       27
       +
       		// Unique constraint violation means user already voted

     

       28
       28
       +
       		if (

     

       29
       29
       +
       			error instanceof Error &&

     

       30
       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       31
       +
       		) {

     

       32
       32
       +
       			return false;

     

       33
       33
       +
       		}

     

       34
       34
       +
       		throw error;

     

       35
       35
       +
       	}

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       /**

     

       39
       39
       +
        * Remove vote for a recording

     

       40
       40
       +
        */

     

       41
       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       42
       +
       	const result = db.run(

     

       43
       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       44
       +
       		[transcriptionId, userId],

     

       45
       45
       +
       	);

     

       46
       46
       +
       

     

       47
       47
       +
       	if (result.changes > 0) {

     

       48
       48
       +
       		// Decrement vote count on transcription

     

       49
       49
       +
       		db.run(

     

       50
       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       51
       +
       			[transcriptionId],

     

       52
       52
       +
       		);

     

       53
       53
       +
       		return true;

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	return false;

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       /**

     

       60
       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       61
       +
        */

     

       62
       62
       +
       export function getUserVoteForMeeting(

     

       63
       63
       +
       	userId: number,

     

       64
       64
       +
       	classId: string,

     

       65
       65
       +
       	meetingTimeId: string,

     

       66
       66
       +
       ): string | null {

     

       67
       67
       +
       	const result = db

     

       68
       68
       +
       		.query<

     

       69
       69
       +
       			{ transcription_id: string },

     

       70
       70
       +
       			[number, string, string]

     

       71
       71
       +
       		>(

     

       72
       72
       +
       			`SELECT rv.transcription_id 

     

       73
       73
       +
              FROM recording_votes rv

     

       74
       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       75
       +
              WHERE rv.user_id = ? 

     

       76
       76
       +
                AND t.class_id = ? 

     

       77
       77
       +
                AND t.meeting_time_id = ?

     

       78
       78
       +
                AND t.status = 'pending'`,

     

       79
       79
       +
       		)

     

       80
       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       81
       +
       

     

       82
       82
       +
       	return result?.transcription_id || null;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       /**

     

       86
       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       87
       +
        */

     

       88
       88
       +
       export function getPendingRecordings(

     

       89
       89
       +
       	classId: string,

     

       90
       90
       +
       	meetingTimeId: string,

     

       91
       91
       +
       	sectionId?: string | null,

     

       92
       92
       +
       ) {

     

       93
       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       95
       +
              FROM transcriptions

     

       96
       96
       +
              WHERE class_id = ? 

     

       97
       97
       +
                AND meeting_time_id = ?

     

       98
       98
       +
                AND status = 'pending'`;

     

       99
       99
       +
       

     

       100
       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       101
       +
       

     

       102
       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       103
       +
       	if (sectionId !== undefined) {

     

       104
       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       105
       +
       		params.push(sectionId);

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       109
       +
       

     

       110
       110
       +
       	return db

     

       111
       111
       +
       		.query<

     

       112
       112
       +
       			{

     

       113
       113
       +
       				id: string;

     

       114
       114
       +
       				user_id: number;

     

       115
       115
       +
       				filename: string;

     

       116
       116
       +
       				original_filename: string;

     

       117
       117
       +
       				vote_count: number;

     

       118
       118
       +
       				created_at: number;

     

       119
       119
       +
       				section_id: string | null;

     

       120
       120
       +
       			},

     

       121
       121
       +
       			(string | null)[]

     

       122
       122
       +
       		>(query)

     

       123
       123
       +
       		.all(...params);

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       /**

     

       127
       127
       +
        * Get total enrolled users count for a class

     

       128
       128
       +
        */

     

       129
       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       130
       +
       	const result = db

     

       131
       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       133
       +
       		)

     

       134
       134
       +
       		.get(classId);

     

       135
       135
       +
       

     

       136
       136
       +
       	return result?.count || 0;

     

       137
       137
       +
       }

     

       138
       138
       +
       

     

       139
       139
       +
       /**

     

       140
       140
       +
        * Check if recording should be auto-submitted

     

       141
       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       142
       +
        */

     

       143
       143
       +
       export function checkAutoSubmit(

     

       144
       144
       +
       	classId: string,

     

       145
       145
       +
       	meetingTimeId: string,

     

       146
       146
       +
       	sectionId?: string | null,

     

       147
       147
       +
       ): string | null {

     

       148
       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       149
       +
       

     

       150
       150
       +
       	if (recordings.length === 0) {

     

       151
       151
       +
       		return null;

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       156
       +
       

     

       157
       157
       +
       	// Get the recording with most votes

     

       158
       158
       +
       	const topRecording = recordings[0];

     

       159
       159
       +
       	if (!topRecording) return null;

     

       160
       160
       +
       

     

       161
       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       163
       +
       

     

       164
       164
       +
       	// Auto-submit if:

     

       165
       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       169
       +
       

     

       170
       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       171
       +
       		console.log(

     

       172
       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       173
       +
       		);

     

       174
       174
       +
       		return topRecording.id;

     

       175
       175
       +
       	}

     

       176
       176
       +
       

     

       177
       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       178
       +
       		console.log(

     

       179
       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       180
       +
       		);

     

       181
       181
       +
       		return topRecording.id;

     

       182
       182
       +
       	}

     

       183
       183
       +
       

     

       184
       184
       +
       	return null;

     

       185
       185
       +
       }

     

       186
       186
       +
       

     

       187
       187
       +
       /**

     

       188
       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       189
       +
        */

     

       190
       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       191
       +
       	db.run(

     

       192
       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       193
       +
       		[transcriptionId],

     

       194
       194
       +
       	);

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       /**

     

       198
       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       199
       +
        */

     

       200
       200
       +
       export function deletePendingRecording(

     

       201
       201
       +
       	transcriptionId: string,

     

       202
       202
       +
       	userId: number,

     

       203
       203
       +
       	isAdmin: boolean,

     

       204
       204
       +
       ): boolean {

     

       205
       205
       +
       	// Check ownership if not admin

     

       206
       206
       +
       	if (!isAdmin) {

     

       207
       207
       +
       		const recording = db

     

       208
       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       210
       +
       			)

     

       211
       211
       +
       			.get(transcriptionId);

     

       212
       212
       +
       

     

       213
       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       214
       +
       			return false;

     

       215
       215
       +
       		}

     

       216
       216
       +
       

     

       217
       217
       +
       		// Only allow deleting pending recordings

     

       218
       218
       +
       		if (recording.status !== "pending") {

     

       219
       219
       +
       			return false;

     

       220
       220
       +
       		}

     

       221
       221
       +
       	}

     

       222
       222
       +
       

     

       223
       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       225
       +
       

     

       226
       226
       +
       	return true;

     

       227
       227
       +
       }

+10

src/lib/vtt-cleaner.test.ts

···

       55
       55
        
       

     

       56
       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       58
       +
       

     

       59
       59
       +
       	// Save and remove API key to avoid burning tokens

     

       60
       60
       +
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       61
       +
       	delete process.env.LLM_API_KEY;

     

       62
       62
       +
       

     

       58
       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       59
       64
        
       

     

       60
       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       66
       +
       

     

       67
       67
       +
       	// Restore original key

     

       68
       68
       +
       	if (originalKey) {

     

       69
       69
       +
       		process.env.LLM_API_KEY = originalKey;

     

       70
       70
       +
       	}

     

       61
       71
        
       });

     

       62
       72
        
       

     

       63
       73
        
       // AI integration test - skip by default to avoid burning credits

+8 -8

src/lib/vtt-cleaner.ts

···

       338
       338
        
       		`[VTTCleaner] Processing ${segments.length} segments for ${transcriptionId}`,

     

       339
       339
        
       	);

     

       340
       340
        
       

     

       341
       341
       -
       	const apiKey = process.env.LLM_API_KEY;

     

       342
       342
       -
       	const apiBaseUrl = process.env.LLM_API_BASE_URL;

     

       343
       343
       -
       	const model = process.env.LLM_MODEL;

     

       344
       344
       -
       

     

       345
       345
       -
       	if (!apiKey || !apiBaseUrl || !model) {

     

       346
       346
       -
       		console.warn(

     

       347
       347
       -
       			"[VTTCleaner] LLM configuration incomplete (need LLM_API_KEY, LLM_API_BASE_URL, LLM_MODEL), returning uncleaned VTT",

     

       348
       348
       -
       		);

     

       341
       341
       +
       	// Check if API key is available, return original if not

     

       342
       342
       +
       	if (!process.env.LLM_API_KEY) {

     

       343
       343
       +
       		console.warn("[VTTCleaner] LLM_API_KEY not set, returning original VTT");

     

       349
       344
        
       		return vttContent;

     

       350
       345
        
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	// Validated at startup

     

       348
       348
       +
       	const apiKey = process.env.LLM_API_KEY as string;

     

       349
       349
       +
       	const apiBaseUrl = process.env.LLM_API_BASE_URL as string;

     

       350
       350
       +
       	const model = process.env.LLM_MODEL as string;

     

       351
       351
        
       

     

       352
       352
        
       	try {

     

       353
       353
        
       		// Build the input segments

+4 -250

src/pages/admin.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           main {

     

       15
       15
       -
             max-width: 80rem;

     

       16
       16
       -
             margin: 0 auto;

     

       17
       17
       -
             padding: 2rem;

     

       18
       18
       -
           }

     

       19
       19
       -
       

     

       20
       20
       -
           h1 {

     

       21
       21
       -
             margin-bottom: 2rem;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
           }

     

       24
       24
       -
       

     

       25
       25
       -
           .section {

     

       26
       26
       -
             margin-bottom: 3rem;

     

       27
       27
       -
           }

     

       28
       28
       -
       

     

       29
       29
       -
           .section-title {

     

       30
       30
       -
             font-size: 1.5rem;

     

       31
       31
       -
             font-weight: 600;

     

       32
       32
       -
             color: var(--text);

     

       33
       33
       -
             margin-bottom: 1rem;

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             align-items: center;

     

       36
       36
       -
             gap: 0.5rem;

     

       37
       37
       -
           }

     

       38
       38
       -
       

     

       39
       39
       -
           .tabs {

     

       40
       40
       -
             display: flex;

     

       41
       41
       -
             gap: 1rem;

     

       42
       42
       -
             border-bottom: 2px solid var(--secondary);

     

       43
       43
       -
             margin-bottom: 2rem;

     

       44
       44
       -
           }

     

       45
       45
       -
       

     

       46
       46
       -
           .tab {

     

       47
       47
       -
             padding: 0.75rem 1.5rem;

     

       48
       48
       -
             border: none;

     

       49
       49
       -
             background: transparent;

     

       50
       50
       -
             color: var(--text);

     

       51
       51
       -
             cursor: pointer;

     

       52
       52
       -
             font-size: 1rem;

     

       53
       53
       -
             font-weight: 500;

     

       54
       54
       -
             font-family: inherit;

     

       55
       55
       -
             border-bottom: 2px solid transparent;

     

       56
       56
       -
             margin-bottom: -2px;

     

       57
       57
       -
             transition: all 0.2s;

     

       58
       58
       -
           }

     

       59
       59
       -
       

     

       60
       60
       -
           .tab:hover {

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .tab.active {

     

       65
       65
       -
             color: var(--primary);

     

       66
       66
       -
             border-bottom-color: var(--primary);

     

       67
       67
       -
           }

     

       68
       68
       -
       

     

       69
       69
       -
           .tab-content {

     

       70
       70
       -
             display: none;

     

       71
       71
       -
           }

     

       72
       72
       -
       

     

       73
       73
       -
           .tab-content.active {

     

       74
       74
       -
             display: block;

     

       75
       75
       -
           }

     

       76
       76
       -
       

     

       77
       77
       -
           .empty-state {

     

       78
       78
       -
             text-align: center;

     

       79
       79
       -
             padding: 3rem;

     

       80
       80
       -
             color: var(--text);

     

       81
       81
       -
             opacity: 0.6;

     

       82
       82
       -
           }

     

       83
       83
       -
       

     

       84
       84
       -
           .loading {

     

       85
       85
       -
             text-align: center;

     

       86
       86
       -
             padding: 3rem;

     

       87
       87
       -
             color: var(--text);

     

       88
       88
       -
           }

     

       89
       89
       -
       

     

       90
       90
       -
           .error {

     

       91
       91
       -
             background: #fee2e2;

     

       92
       92
       -
             color: #991b1b;

     

       93
       93
       -
             padding: 1rem;

     

       94
       94
       -
             border-radius: 6px;

     

       95
       95
       -
             margin-bottom: 1rem;

     

       96
       96
       -
           }

     

       97
       97
       -
       

     

       98
       98
       -
           .stats {

     

       99
       99
       -
             display: grid;

     

       100
       100
       -
             grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       101
       101
       -
             gap: 1rem;

     

       102
       102
       -
             margin-bottom: 2rem;

     

       103
       103
       -
           }

     

       104
       104
       -
       

     

       105
       105
       -
           .stat-card {

     

       106
       106
       -
             background: var(--background);

     

       107
       107
       -
             border: 2px solid var(--secondary);

     

       108
       108
       -
             border-radius: 8px;

     

       109
       109
       -
             padding: 1.5rem;

     

       110
       110
       -
           }

     

       111
       111
       -
       

     

       112
       112
       -
           .stat-value {

     

       113
       113
       -
             font-size: 2rem;

     

       114
       114
       -
             font-weight: 700;

     

       115
       115
       -
             color: var(--primary);

     

       116
       116
       -
             margin-bottom: 0.25rem;

     

       117
       117
       -
           }

     

       118
       118
       -
       

     

       119
       119
       -
           .stat-label {

     

       120
       120
       -
             color: var(--text);

     

       121
       121
       -
             opacity: 0.7;

     

       122
       122
       -
             font-size: 0.875rem;

     

       123
       123
       -
           }

     

       124
       124
       -
       

     

       125
       125
       -
           .timestamp {

     

       126
       126
       -
             color: var(--text);

     

       127
       127
       -
             opacity: 0.6;

     

       128
       128
       -
             font-size: 0.875rem;

     

       129
       129
       -
           }

     

       130
       130
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/admin.css">

     

       131
       14
        
       </head>

     

       132
       15
        
       

     

       133
       16
        
       <body>

     
···

       144
       27
        
         <main>

     

       145
       28
        
           <h1>Admin Dashboard</h1>

     

       146
       29
        
       

     

       147
       147
       -
           <div id="error-message" class="error" style="display: none;"></div>

     

       30
       30
       +
           <div id="error-message" class="error hidden"></div>

     

       148
       31
        
       

     

       149
       32
        
           <div id="loading" class="loading">Loading...</div>

     

       150
       33
        
       

     

       151
       151
       -
           <div id="content" style="display: none;">

     

       34
       34
       +
           <div id="content" class="hidden">

     

       152
       35
        
             <div class="stats">

     

       153
       36
        
               <div class="stat-card">

     

       154
       37
        
                 <div class="stat-value" id="total-users">0</div>

     
···

       211
       94
        
         <script type="module" src="../components/admin-classes.ts"></script>

     

       212
       95
        
         <script type="module" src="../components/user-modal.ts"></script>

     

       213
       96
        
         <script type="module" src="../components/transcript-view-modal.ts"></script>

     

       214
       214
       -
         <script type="module">

     

       215
       215
       -
           const transcriptionsComponent = document.getElementById('transcriptions-component');

     

       216
       216
       -
           const usersComponent = document.getElementById('users-component');

     

       217
       217
       -
           const userModal = document.getElementById('user-modal');

     

       218
       218
       -
           const transcriptModal = document.getElementById('transcript-modal');

     

       219
       219
       -
           const errorMessage = document.getElementById('error-message');

     

       220
       220
       -
           const loading = document.getElementById('loading');

     

       221
       221
       -
           const content = document.getElementById('content');

     

       222
       222
       -
       

     

       223
       223
       -
           // Modal functions

     

       224
       224
       -
           function openUserModal(userId) {

     

       225
       225
       -
             userModal.setAttribute('open', '');

     

       226
       226
       -
             userModal.userId = userId;

     

       227
       227
       -
           }

     

       228
       228
       -
       

     

       229
       229
       -
           function closeUserModal() {

     

       230
       230
       -
             userModal.removeAttribute('open');

     

       231
       231
       -
             userModal.userId = null;

     

       232
       232
       -
           }

     

       233
       233
       -
       

     

       234
       234
       -
           function openTranscriptModal(transcriptId) {

     

       235
       235
       -
             transcriptModal.setAttribute('open', '');

     

       236
       236
       -
             transcriptModal.transcriptId = transcriptId;

     

       237
       237
       -
           }

     

       238
       238
       -
       

     

       239
       239
       -
           function closeTranscriptModal() {

     

       240
       240
       -
             transcriptModal.removeAttribute('open');

     

       241
       241
       -
             transcriptModal.transcriptId = null;

     

       242
       242
       -
           }

     

       243
       243
       -
       

     

       244
       244
       -
           // Listen for component events

     

       245
       245
       -
           transcriptionsComponent.addEventListener('open-transcription', (e) => {

     

       246
       246
       -
             openTranscriptModal(e.detail.id);

     

       247
       247
       -
           });

     

       248
       248
       -
       

     

       249
       249
       -
           usersComponent.addEventListener('open-user', (e) => {

     

       250
       250
       -
             openUserModal(e.detail.id);

     

       251
       251
       -
           });

     

       252
       252
       -
       

     

       253
       253
       -
           // Listen for modal close events

     

       254
       254
       -
           userModal.addEventListener('close', closeUserModal);

     

       255
       255
       -
           userModal.addEventListener('user-updated', async () => {

     

       256
       256
       -
             await loadStats();

     

       257
       257
       -
           });

     

       258
       258
       -
           userModal.addEventListener('click', (e) => {

     

       259
       259
       -
             if (e.target === userModal) closeUserModal();

     

       260
       260
       -
           });

     

       261
       261
       -
       

     

       262
       262
       -
           transcriptModal.addEventListener('close', closeTranscriptModal);

     

       263
       263
       -
           transcriptModal.addEventListener('transcript-deleted', async () => {

     

       264
       264
       -
             await loadStats();

     

       265
       265
       -
           });

     

       266
       266
       -
           transcriptModal.addEventListener('click', (e) => {

     

       267
       267
       -
             if (e.target === transcriptModal) closeTranscriptModal();

     

       268
       268
       -
           });

     

       269
       269
       -
       

     

       270
       270
       -
           async function loadStats() {

     

       271
       271
       -
             try {

     

       272
       272
       -
               const [transcriptionsRes, usersRes] = await Promise.all([

     

       273
       273
       -
                 fetch('/api/admin/transcriptions'),

     

       274
       274
       -
                 fetch('/api/admin/users')

     

       275
       275
       -
               ]);

     

       276
       276
       -
       

     

       277
       277
       -
               if (!transcriptionsRes.ok || !usersRes.ok) {

     

       278
       278
       -
                 if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       279
       279
       -
                   window.location.href = '/';

     

       280
       280
       -
                   return;

     

       281
       281
       -
                 }

     

       282
       282
       -
                 throw new Error('Failed to load admin data');

     

       283
       283
       -
               }

     

       284
       284
       -
       

     

       285
       285
       -
               const transcriptions = await transcriptionsRes.json();

     

       286
       286
       -
               const users = await usersRes.json();

     

       287
       287
       -
       

     

       288
       288
       -
               document.getElementById('total-users').textContent = users.length;

     

       289
       289
       -
               document.getElementById('total-transcriptions').textContent = transcriptions.length;

     

       290
       290
       -
               

     

       291
       291
       -
               const failed = transcriptions.filter(t => t.status === 'failed');

     

       292
       292
       -
               document.getElementById('failed-transcriptions').textContent = failed.length;

     

       293
       293
       -
       

     

       294
       294
       -
               loading.style.display = 'none';

     

       295
       295
       -
               content.style.display = 'block';

     

       296
       296
       -
             } catch (error) {

     

       297
       297
       -
               errorMessage.textContent = error.message;

     

       298
       298
       -
               errorMessage.style.display = 'block';

     

       299
       299
       -
               loading.style.display = 'none';

     

       300
       300
       -
             }

     

       301
       301
       -
           }

     

       302
       302
       -
       

     

       303
       303
       -
           // Tab switching

     

       304
       304
       -
           function switchTab(tabName) {

     

       305
       305
       -
             document.querySelectorAll('.tab').forEach(t => {

     

       306
       306
       -
               t.classList.remove('active');

     

       307
       307
       -
             });

     

       308
       308
       -
             document.querySelectorAll('.tab-content').forEach(c => {

     

       309
       309
       -
               c.classList.remove('active');

     

       310
       310
       -
             });

     

       311
       311
       -
       

     

       312
       312
       -
             const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       313
       313
       -
             const tabContent = document.getElementById(`${tabName}-tab`);

     

       314
       314
       -
             

     

       315
       315
       -
             if (tabButton && tabContent) {

     

       316
       316
       -
               tabButton.classList.add('active');

     

       317
       317
       -
               tabContent.classList.add('active');

     

       318
       318
       -
               

     

       319
       319
       -
               // Update URL without reloading

     

       320
       320
       -
               const url = new URL(window.location.href);

     

       321
       321
       -
               url.searchParams.set('tab', tabName);

     

       322
       322
       -
               window.history.pushState({}, '', url);

     

       323
       323
       -
             }

     

       324
       324
       -
           }

     

       325
       325
       -
       

     

       326
       326
       -
           document.querySelectorAll('.tab').forEach(tab => {

     

       327
       327
       -
             tab.addEventListener('click', () => {

     

       328
       328
       -
               switchTab(tab.dataset.tab);

     

       329
       329
       -
             });

     

       330
       330
       -
           });

     

       331
       331
       -
       

     

       332
       332
       -
           // Check for tab query parameter on load

     

       333
       333
       -
           const params = new URLSearchParams(window.location.search);

     

       334
       334
       -
           const initialTab = params.get('tab');

     

       335
       335
       -
           const validTabs = ['pending', 'transcriptions', 'users', 'classes'];

     

       336
       336
       -
           

     

       337
       337
       -
           if (initialTab && validTabs.includes(initialTab)) {

     

       338
       338
       -
             switchTab(initialTab);

     

       339
       339
       -
           }

     

       340
       340
       -
       

     

       341
       341
       -
           // Initialize

     

       342
       342
       -
           loadStats();

     

       343
       343
       -
         </script>

     

       97
       97
       +
         <script type="module" src="./admin.ts"></script>

     

       344
       98
        
       </body>

     

       345
       99
        
       

     

       346
       100
        
       </html>

+151

src/pages/admin.ts

···

       1
       1
       +
       const transcriptionsComponent = document.getElementById(

     

       2
       2
       +
       	"transcriptions-component",

     

       3
       3
       +
       ) as HTMLElement | null;

     

       4
       4
       +
       const usersComponent = document.getElementById(

     

       5
       5
       +
       	"users-component",

     

       6
       6
       +
       ) as HTMLElement | null;

     

       7
       7
       +
       const userModal = document.getElementById("user-modal") as HTMLElement | null;

     

       8
       8
       +
       const transcriptModal = document.getElementById(

     

       9
       9
       +
       	"transcript-modal",

     

       10
       10
       +
       ) as HTMLElement | null;

     

       11
       11
       +
       const errorMessage = document.getElementById("error-message") as HTMLElement;

     

       12
       12
       +
       const loading = document.getElementById("loading") as HTMLElement;

     

       13
       13
       +
       const content = document.getElementById("content") as HTMLElement;

     

       14
       14
       +
       

     

       15
       15
       +
       // Modal functions

     

       16
       16
       +
       function openUserModal(userId: string) {

     

       17
       17
       +
       	userModal.setAttribute("open", "");

     

       18
       18
       +
       	userModal.userId = userId;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       function closeUserModal() {

     

       22
       22
       +
       	userModal.removeAttribute("open");

     

       23
       23
       +
       	userModal.userId = null;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       function openTranscriptModal(transcriptId: string) {

     

       27
       27
       +
       	transcriptModal.setAttribute("open", "");

     

       28
       28
       +
       	transcriptModal.transcriptId = transcriptId;

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       function closeTranscriptModal() {

     

       32
       32
       +
       	transcriptModal.removeAttribute("open");

     

       33
       33
       +
       	transcriptModal.transcriptId = null;

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Listen for component events

     

       37
       37
       +
       transcriptionsComponent?.addEventListener(

     

       38
       38
       +
       	"open-transcription",

     

       39
       39
       +
       	(e: CustomEvent) => {

     

       40
       40
       +
       		openTranscriptModal(e.detail.id);

     

       41
       41
       +
       	},

     

       42
       42
       +
       );

     

       43
       43
       +
       

     

       44
       44
       +
       usersComponent?.addEventListener("open-user", (e: CustomEvent) => {

     

       45
       45
       +
       	openUserModal(e.detail.id);

     

       46
       46
       +
       });

     

       47
       47
       +
       

     

       48
       48
       +
       // Listen for modal close events

     

       49
       49
       +
       userModal?.addEventListener("close", closeUserModal);

     

       50
       50
       +
       userModal?.addEventListener("user-updated", async () => {

     

       51
       51
       +
       	await loadStats();

     

       52
       52
       +
       });

     

       53
       53
       +
       userModal?.addEventListener("click", (e: MouseEvent) => {

     

       54
       54
       +
       	if (e.target === userModal) closeUserModal();

     

       55
       55
       +
       });

     

       56
       56
       +
       

     

       57
       57
       +
       transcriptModal?.addEventListener("close", closeTranscriptModal);

     

       58
       58
       +
       transcriptModal?.addEventListener("transcript-deleted", async () => {

     

       59
       59
       +
       	await loadStats();

     

       60
       60
       +
       });

     

       61
       61
       +
       transcriptModal?.addEventListener("click", (e: MouseEvent) => {

     

       62
       62
       +
       	if (e.target === transcriptModal) closeTranscriptModal();

     

       63
       63
       +
       });

     

       64
       64
       +
       

     

       65
       65
       +
       async function loadStats() {

     

       66
       66
       +
       	try {

     

       67
       67
       +
       		const [transcriptionsRes, usersRes] = await Promise.all([

     

       68
       68
       +
       			fetch("/api/admin/transcriptions"),

     

       69
       69
       +
       			fetch("/api/admin/users"),

     

       70
       70
       +
       		]);

     

       71
       71
       +
       

     

       72
       72
       +
       		if (!transcriptionsRes.ok || !usersRes.ok) {

     

       73
       73
       +
       			if (transcriptionsRes.status === 403 || usersRes.status === 403) {

     

       74
       74
       +
       				window.location.href = "/";

     

       75
       75
       +
       				return;

     

       76
       76
       +
       			}

     

       77
       77
       +
       			throw new Error("Failed to load admin data");

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		const transcriptions = await transcriptionsRes.json();

     

       81
       81
       +
       		const users = await usersRes.json();

     

       82
       82
       +
       

     

       83
       83
       +
       		const totalUsers = document.getElementById("total-users");

     

       84
       84
       +
       		const totalTranscriptions = document.getElementById("total-transcriptions");

     

       85
       85
       +
       		const failedTranscriptions = document.getElementById(

     

       86
       86
       +
       			"failed-transcriptions",

     

       87
       87
       +
       		);

     

       88
       88
       +
       

     

       89
       89
       +
       		if (totalUsers) totalUsers.textContent = users.length.toString();

     

       90
       90
       +
       		if (totalTranscriptions)

     

       91
       91
       +
       			totalTranscriptions.textContent = transcriptions.length.toString();

     

       92
       92
       +
       

     

       93
       93
       +
       		const failed = transcriptions.filter(

     

       94
       94
       +
       			(t: { status: string }) => t.status === "failed",

     

       95
       95
       +
       		);

     

       96
       96
       +
       		if (failedTranscriptions)

     

       97
       97
       +
       			failedTranscriptions.textContent = failed.length.toString();

     

       98
       98
       +
       

     

       99
       99
       +
       		loading.classList.add("hidden");

     

       100
       100
       +
       		content.classList.remove("hidden");

     

       101
       101
       +
       	} catch (error) {

     

       102
       102
       +
       		errorMessage.textContent = (error as Error).message;

     

       103
       103
       +
       		errorMessage.classList.remove("hidden");

     

       104
       104
       +
       		loading.classList.add("hidden");

     

       105
       105
       +
       	}

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       // Tab switching

     

       109
       109
       +
       function switchTab(tabName: string) {

     

       110
       110
       +
       	document.querySelectorAll(".tab").forEach((t) => {

     

       111
       111
       +
       		t.classList.remove("active");

     

       112
       112
       +
       	});

     

       113
       113
       +
       	document.querySelectorAll(".tab-content").forEach((c) => {

     

       114
       114
       +
       		c.classList.remove("active");

     

       115
       115
       +
       	});

     

       116
       116
       +
       

     

       117
       117
       +
       	const tabButton = document.querySelector(`[data-tab="${tabName}"]`);

     

       118
       118
       +
       	const tabContent = document.getElementById(`${tabName}-tab`);

     

       119
       119
       +
       

     

       120
       120
       +
       	if (tabButton && tabContent) {

     

       121
       121
       +
       		tabButton.classList.add("active");

     

       122
       122
       +
       		tabContent.classList.add("active");

     

       123
       123
       +
       

     

       124
       124
       +
       		// Update URL without reloading

     

       125
       125
       +
       		const url = new URL(window.location.href);

     

       126
       126
       +
       		url.searchParams.set("tab", tabName);

     

       127
       127
       +
       		// Remove subtab param when leaving classes tab

     

       128
       128
       +
       		if (tabName !== "classes") {

     

       129
       129
       +
       			url.searchParams.delete("subtab");

     

       130
       130
       +
       		}

     

       131
       131
       +
       		window.history.pushState({}, "", url);

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       document.querySelectorAll(".tab").forEach((tab) => {

     

       136
       136
       +
       	tab.addEventListener("click", () => {

     

       137
       137
       +
       		switchTab((tab as HTMLElement).dataset.tab || "");

     

       138
       138
       +
       	});

     

       139
       139
       +
       });

     

       140
       140
       +
       

     

       141
       141
       +
       // Check for tab query parameter on load

     

       142
       142
       +
       const params = new URLSearchParams(window.location.search);

     

       143
       143
       +
       const initialTab = params.get("tab");

     

       144
       144
       +
       const validTabs = ["pending", "transcriptions", "users", "classes"];

     

       145
       145
       +
       

     

       146
       146
       +
       if (initialTab && validTabs.includes(initialTab)) {

     

       147
       147
       +
       	switchTab(initialTab);

     

       148
       148
       +
       }

     

       149
       149
       +
       

     

       150
       150
       +
       // Initialize

     

       151
       151
       +
       loadStats();

+2 -85

src/pages/index.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .hero-title {

     

       15
       15
       -
             font-size: 3rem;

     

       16
       16
       -
             font-weight: 700;

     

       17
       17
       -
             color: var(--text);

     

       18
       18
       -
             margin-bottom: 1rem;

     

       19
       19
       -
           }

     

       20
       20
       -
       

     

       21
       21
       -
           .hero-subtitle {

     

       22
       22
       -
             font-size: 1.25rem;

     

       23
       23
       -
             color: var(--text);

     

       24
       24
       -
             opacity: 0.8;

     

       25
       25
       -
             margin-bottom: 2rem;

     

       26
       26
       -
           }

     

       27
       27
       -
       

     

       28
       28
       -
           main {

     

       29
       29
       -
             text-align: center;

     

       30
       30
       -
             padding: 4rem 2rem;

     

       31
       31
       -
           }

     

       32
       32
       -
       

     

       33
       33
       -
           .cta-buttons {

     

       34
       34
       -
             display: flex;

     

       35
       35
       -
             gap: 1rem;

     

       36
       36
       -
             justify-content: center;

     

       37
       37
       -
             margin-top: 2rem;

     

       38
       38
       -
           }

     

       39
       39
       -
       

     

       40
       40
       -
           .btn {

     

       41
       41
       -
             padding: 0.75rem 1.5rem;

     

       42
       42
       -
             border-radius: 6px;

     

       43
       43
       -
             font-size: 1rem;

     

       44
       44
       -
             font-weight: 500;

     

       45
       45
       -
             cursor: pointer;

     

       46
       46
       -
             transition: all 0.2s;

     

       47
       47
       -
             font-family: inherit;

     

       48
       48
       -
             border: 2px solid;

     

       49
       49
       -
             text-decoration: none;

     

       50
       50
       -
             display: inline-block;

     

       51
       51
       -
           }

     

       52
       52
       -
       

     

       53
       53
       -
           .btn-primary {

     

       54
       54
       -
             background: var(--primary);

     

       55
       55
       -
             color: white;

     

       56
       56
       -
             border-color: var(--primary);

     

       57
       57
       -
           }

     

       58
       58
       -
       

     

       59
       59
       -
           .btn-primary:hover {

     

       60
       60
       -
             background: transparent;

     

       61
       61
       -
             color: var(--primary);

     

       62
       62
       -
           }

     

       63
       63
       -
       

     

       64
       64
       -
           .btn-secondary {

     

       65
       65
       -
             background: transparent;

     

       66
       66
       -
             color: var(--text);

     

       67
       67
       -
             border-color: var(--secondary);

     

       68
       68
       -
           }

     

       69
       69
       -
       

     

       70
       70
       -
           .btn-secondary:hover {

     

       71
       71
       -
             border-color: var(--primary);

     

       72
       72
       -
             color: var(--primary);

     

       73
       73
       -
           }

     

       74
       74
       -
       

     

       75
       75
       -
           @media (max-width: 640px) {

     

       76
       76
       -
             .hero-title {

     

       77
       77
       -
               font-size: 2.5rem;

     

       78
       78
       -
             }

     

       79
       79
       -
       

     

       80
       80
       -
             .cta-buttons {

     

       81
       81
       -
               flex-direction: column;

     

       82
       82
       -
               align-items: center;

     

       83
       83
       -
             }

     

       84
       84
       -
           }

     

       85
       85
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/index.css">

     

       86
       14
        
       </head>

     

       87
       15
        
       

     

       88
       16
        
       <body>

     
···

       106
       34
        
         </main>

     

       107
       35
        
       

     

       108
       36
        
         <script type="module" src="../components/auth.ts"></script>

     

       109
       109
       -
         <script type="module">

     

       110
       110
       -
           document.getElementById('start-btn').addEventListener('click', async () => {

     

       111
       111
       -
             const authComponent = document.querySelector('auth-component');

     

       112
       112
       -
             const isLoggedIn = await authComponent.isAuthenticated();

     

       113
       113
       -
       

     

       114
       114
       -
             if (isLoggedIn) {

     

       115
       115
       -
               window.location.href = '/classes';

     

       116
       116
       -
             } else {

     

       117
       117
       -
               authComponent.openAuthModal();

     

       118
       118
       -
             }

     

       119
       119
       -
           });

     

       120
       120
       -
         </script>

     

       37
       37
       +
         <script type="module" src="./index.ts"></script>

     

       121
       38
        
       </body>

     

       122
       39
        
       

     

       123
       40
        
       </html>

+14

src/pages/index.ts

···

       1
       1
       +
       document.getElementById("start-btn")?.addEventListener("click", async () => {

     

       2
       2
       +
       	const authComponent = document.querySelector("auth-component");

     

       3
       3
       +
       	if (!authComponent) return;

     

       4
       4
       +
       

     

       5
       5
       +
       	const isLoggedIn = await (

     

       6
       6
       +
       		authComponent as { isAuthenticated: () => Promise<boolean> }

     

       7
       7
       +
       	).isAuthenticated();

     

       8
       8
       +
       

     

       9
       9
       +
       	if (isLoggedIn) {

     

       10
       10
       +
       		window.location.href = "/classes";

     

       11
       11
       +
       	} else {

     

       12
       12
       +
       		(authComponent as { openAuthModal: () => void }).openAuthModal();

     

       13
       13
       +
       	}

     

       14
       14
       +
       });

+36

src/pages/reset-password.html

···

       1
       1
       +
       <!DOCTYPE html>

     

       2
       2
       +
       <html lang="en">

     

       3
       3
       +
       

     

       4
       4
       +
       <head>

     

       5
       5
       +
         <meta charset="UTF-8">

     

       6
       6
       +
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       +
         <title>Reset Password - Thistle</title>

     

       8
       8
       +
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       9
       9
       +
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

     

       10
       10
       +
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
       +
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
       +
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/reset-password.css">

     

       14
       14
       +
       </head>

     

       15
       15
       +
       

     

       16
       16
       +
       <body>

     

       17
       17
       +
         <header>

     

       18
       18
       +
           <div class="header-content">

     

       19
       19
       +
             <a href="/" class="site-title">

     

       20
       20
       +
               <img src="../../public/favicon/favicon-32x32.png" alt="Thistle logo">

     

       21
       21
       +
               <span>Thistle</span>

     

       22
       22
       +
             </a>

     

       23
       23
       +
             <auth-component></auth-component>

     

       24
       24
       +
           </div>

     

       25
       25
       +
         </header>

     

       26
       26
       +
       

     

       27
       27
       +
         <main>

     

       28
       28
       +
           <reset-password-form id="reset-form"></reset-password-form>

     

       29
       29
       +
         </main>

     

       30
       30
       +
       

     

       31
       31
       +
         <script type="module" src="../components/auth.ts"></script>

     

       32
       32
       +
         <script type="module" src="../components/reset-password-form.ts"></script>

     

       33
       33
       +
         <script type="module" src="./reset-password.ts"></script>

     

       34
       34
       +
       </body>

     

       35
       35
       +
       

     

       36
       36
       +
       </html>

+10

src/pages/reset-password.ts

···

       1
       1
       +
       // Wait for component to be defined before setting token

     

       2
       2
       +
       await customElements.whenDefined("reset-password-form");

     

       3
       3
       +
       

     

       4
       4
       +
       // Get token from URL and pass to component

     

       5
       5
       +
       const urlParams = new URLSearchParams(window.location.search);

     

       6
       6
       +
       const token = urlParams.get("token");

     

       7
       7
       +
       const resetForm = document.getElementById("reset-form");

     

       8
       8
       +
       if (resetForm) {

     

       9
       9
       +
       	(resetForm as { token: string | null }).token = token;

     

       10
       10
       +
       }

+1 -6

src/pages/settings.html

···

       10
       10
        
       	<link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
       	<link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
       	<link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
       

     

       14
       14
       -
       	<style>

     

       15
       15
       -
       		main {

     

       16
       16
       -
       			max-width: 64rem;

     

       17
       17
       -
       		}

     

       18
       18
       -
       	</style>

     

       13
       13
       +
       	<link rel="stylesheet" href="../styles/settings.css">

     

       19
       14
        
       </head>

     

       20
       15
        
       

     

       21
       16
        
       <body>

+3 -21

src/pages/transcribe.html

···

       10
       10
        
         <link rel="icon" type="image/png" sizes="16x16" href="../../public/favicon/favicon-16x16.png">

     

       11
       11
        
         <link rel="manifest" href="../../public/favicon/site.webmanifest">

     

       12
       12
        
         <link rel="stylesheet" href="../styles/main.css">

     

       13
       13
       -
         <style>

     

       14
       14
       -
           .page-header {

     

       15
       15
       -
             text-align: center;

     

       16
       16
       -
             margin-bottom: 3rem;

     

       17
       17
       -
           }

     

       18
       18
       -
       

     

       19
       19
       -
           .page-title {

     

       20
       20
       -
             font-size: 2.5rem;

     

       21
       21
       -
             font-weight: 700;

     

       22
       22
       -
             color: var(--text);

     

       23
       23
       -
             margin-bottom: 0.5rem;

     

       24
       24
       -
           }

     

       25
       25
       -
       

     

       26
       26
       -
           .page-subtitle {

     

       27
       27
       -
             font-size: 1.125rem;

     

       28
       28
       -
             color: var(--text);

     

       29
       29
       -
             opacity: 0.8;

     

       30
       30
       -
           }

     

       31
       31
       -
         </style>

     

       13
       13
       +
         <link rel="stylesheet" href="../styles/transcribe.css">

     

       32
       14
        
       </head>

     

       33
       15
        
       

     

       34
       16
        
       <body>

     
···

       43
       25
        
         </header>

     

       44
       26
        
       

     

       45
       27
        
         <main>

     

       46
       46
       -
           <div style="margin-bottom: 1rem;">

     

       47
       47
       -
             <a href="/classes" style="color: var(--paynes-gray); text-decoration: none; font-size: 0.875rem;">

     

       28
       28
       +
           <div class="mb-1">

     

       29
       29
       +
             <a href="/classes" class="back-link">

     

       48
       30
        
               ← Back to classes

     

       49
       31
        
             </a>

     

       50
       32
        
           </div>

+120

src/styles/admin.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 80rem;

     

       3
       3
       +
       	margin: 0 auto;

     

       4
       4
       +
       	padding: 2rem;

     

       5
       5
       +
       }

     

       6
       6
       +
       

     

       7
       7
       +
       h1 {

     

       8
       8
       +
       	margin-bottom: 2rem;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       }

     

       11
       11
       +
       

     

       12
       12
       +
       .section {

     

       13
       13
       +
       	margin-bottom: 3rem;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       .section-title {

     

       17
       17
       +
       	font-size: 1.5rem;

     

       18
       18
       +
       	font-weight: 600;

     

       19
       19
       +
       	color: var(--text);

     

       20
       20
       +
       	margin-bottom: 1rem;

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	align-items: center;

     

       23
       23
       +
       	gap: 0.5rem;

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       .tabs {

     

       27
       27
       +
       	display: flex;

     

       28
       28
       +
       	gap: 1rem;

     

       29
       29
       +
       	border-bottom: 2px solid var(--secondary);

     

       30
       30
       +
       	margin-bottom: 2rem;

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       .tab {

     

       34
       34
       +
       	padding: 0.75rem 1.5rem;

     

       35
       35
       +
       	border: none;

     

       36
       36
       +
       	background: transparent;

     

       37
       37
       +
       	color: var(--text);

     

       38
       38
       +
       	cursor: pointer;

     

       39
       39
       +
       	font-size: 1rem;

     

       40
       40
       +
       	font-weight: 500;

     

       41
       41
       +
       	font-family: inherit;

     

       42
       42
       +
       	border-bottom: 2px solid transparent;

     

       43
       43
       +
       	margin-bottom: -2px;

     

       44
       44
       +
       	transition: all 0.2s;

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       .tab:hover {

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .tab.active {

     

       52
       52
       +
       	color: var(--primary);

     

       53
       53
       +
       	border-bottom-color: var(--primary);

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       .tab-content {

     

       57
       57
       +
       	display: none;

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       60
       60
       +
       .tab-content.active {

     

       61
       61
       +
       	display: block;

     

       62
       62
       +
       }

     

       63
       63
       +
       

     

       64
       64
       +
       .empty-state {

     

       65
       65
       +
       	text-align: center;

     

       66
       66
       +
       	padding: 3rem;

     

       67
       67
       +
       	color: var(--text);

     

       68
       68
       +
       	opacity: 0.6;

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       .loading {

     

       72
       72
       +
       	text-align: center;

     

       73
       73
       +
       	padding: 3rem;

     

       74
       74
       +
       	color: var(--text);

     

       75
       75
       +
       }

     

       76
       76
       +
       

     

       77
       77
       +
       .error {

     

       78
       78
       +
       	background: #fee2e2;

     

       79
       79
       +
       	color: #991b1b;

     

       80
       80
       +
       	padding: 1rem;

     

       81
       81
       +
       	border-radius: 6px;

     

       82
       82
       +
       	margin-bottom: 1rem;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       .stats {

     

       86
       86
       +
       	display: grid;

     

       87
       87
       +
       	grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));

     

       88
       88
       +
       	gap: 1rem;

     

       89
       89
       +
       	margin-bottom: 2rem;

     

       90
       90
       +
       }

     

       91
       91
       +
       

     

       92
       92
       +
       .stat-card {

     

       93
       93
       +
       	background: var(--background);

     

       94
       94
       +
       	border: 2px solid var(--secondary);

     

       95
       95
       +
       	border-radius: 8px;

     

       96
       96
       +
       	padding: 1.5rem;

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       .stat-value {

     

       100
       100
       +
       	font-size: 2rem;

     

       101
       101
       +
       	font-weight: 700;

     

       102
       102
       +
       	color: var(--primary);

     

       103
       103
       +
       	margin-bottom: 0.25rem;

     

       104
       104
       +
       }

     

       105
       105
       +
       

     

       106
       106
       +
       .stat-label {

     

       107
       107
       +
       	color: var(--text);

     

       108
       108
       +
       	opacity: 0.7;

     

       109
       109
       +
       	font-size: 0.875rem;

     

       110
       110
       +
       }

     

       111
       111
       +
       

     

       112
       112
       +
       .timestamp {

     

       113
       113
       +
       	color: var(--text);

     

       114
       114
       +
       	opacity: 0.6;

     

       115
       115
       +
       	font-size: 0.875rem;

     

       116
       116
       +
       }

     

       117
       117
       +
       

     

       118
       118
       +
       .hidden {

     

       119
       119
       +
       	display: none;

     

       120
       120
       +
       }

+71

src/styles/index.css

···

       1
       1
       +
       .hero-title {

     

       2
       2
       +
       	font-size: 3rem;

     

       3
       3
       +
       	font-weight: 700;

     

       4
       4
       +
       	color: var(--text);

     

       5
       5
       +
       	margin-bottom: 1rem;

     

       6
       6
       +
       }

     

       7
       7
       +
       

     

       8
       8
       +
       .hero-subtitle {

     

       9
       9
       +
       	font-size: 1.25rem;

     

       10
       10
       +
       	color: var(--text);

     

       11
       11
       +
       	opacity: 0.8;

     

       12
       12
       +
       	margin-bottom: 2rem;

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       main {

     

       16
       16
       +
       	text-align: center;

     

       17
       17
       +
       	padding: 4rem 2rem;

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       .cta-buttons {

     

       21
       21
       +
       	display: flex;

     

       22
       22
       +
       	gap: 1rem;

     

       23
       23
       +
       	justify-content: center;

     

       24
       24
       +
       	margin-top: 2rem;

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       .btn {

     

       28
       28
       +
       	padding: 0.75rem 1.5rem;

     

       29
       29
       +
       	border-radius: 6px;

     

       30
       30
       +
       	font-size: 1rem;

     

       31
       31
       +
       	font-weight: 500;

     

       32
       32
       +
       	cursor: pointer;

     

       33
       33
       +
       	transition: all 0.2s;

     

       34
       34
       +
       	font-family: inherit;

     

       35
       35
       +
       	border: 2px solid;

     

       36
       36
       +
       	text-decoration: none;

     

       37
       37
       +
       	display: inline-block;

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       .btn-primary {

     

       41
       41
       +
       	background: var(--primary);

     

       42
       42
       +
       	color: white;

     

       43
       43
       +
       	border-color: var(--primary);

     

       44
       44
       +
       }

     

       45
       45
       +
       

     

       46
       46
       +
       .btn-primary:hover {

     

       47
       47
       +
       	background: transparent;

     

       48
       48
       +
       	color: var(--primary);

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       .btn-secondary {

     

       52
       52
       +
       	background: transparent;

     

       53
       53
       +
       	color: var(--text);

     

       54
       54
       +
       	border-color: var(--secondary);

     

       55
       55
       +
       }

     

       56
       56
       +
       

     

       57
       57
       +
       .btn-secondary:hover {

     

       58
       58
       +
       	border-color: var(--primary);

     

       59
       59
       +
       	color: var(--primary);

     

       60
       60
       +
       }

     

       61
       61
       +
       

     

       62
       62
       +
       @media (max-width: 640px) {

     

       63
       63
       +
       	.hero-title {

     

       64
       64
       +
       		font-size: 2.5rem;

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	.cta-buttons {

     

       68
       68
       +
       		flex-direction: column;

     

       69
       69
       +
       		align-items: center;

     

       70
       70
       +
       	}

     

       71
       71
       +
       }

src/styles/reset-password.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	display: flex;

     

       3
       3
       +
       	align-items: center;

     

       4
       4
       +
       	justify-content: center;

     

       5
       5
       +
       	padding: 4rem 1rem;

     

       6
       6
       +
       }

src/styles/settings.css

···

       1
       1
       +
       main {

     

       2
       2
       +
       	max-width: 64rem;

     

       3
       3
       +
       }

+27

src/styles/transcribe.css

···

       1
       1
       +
       .page-header {

     

       2
       2
       +
       	text-align: center;

     

       3
       3
       +
       	margin-bottom: 3rem;

     

       4
       4
       +
       }

     

       5
       5
       +
       

     

       6
       6
       +
       .page-title {

     

       7
       7
       +
       	font-size: 2.5rem;

     

       8
       8
       +
       	font-weight: 700;

     

       9
       9
       +
       	color: var(--text);

     

       10
       10
       +
       	margin-bottom: 0.5rem;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       .page-subtitle {

     

       14
       14
       +
       	font-size: 1.125rem;

     

       15
       15
       +
       	color: var(--text);

     

       16
       16
       +
       	opacity: 0.8;

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       .back-link {

     

       20
       20
       +
       	color: var(--paynes-gray);

     

       21
       21
       +
       	text-decoration: none;

     

       22
       22
       +
       	font-size: 0.875rem;

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       .mb-1 {

     

       26
       26
       +
       	margin-bottom: 1rem;

     

       27
       27
       +
       }

Compare changes