comparing b5be26c7dc1da2de8f45112f53cef3dd7176aaa1 and main on dunkirk.sh/thistle

+10

LICENSE.md

···

       1
       1
       +
       # The O'Saasy License

     

       2
       2
       +
       

     

       3
       3
       +
       Copyright © `2025` `Kieran Klukas`

     

       4
       4
       +
       

     

       5
       5
       +
       Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

     

       6
       6
       +
       

     

       7
       7
       +
       The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

     

       8
       8
       +
       No licensee or downstream recipient may use the Software (including any modified or derivative versions) to directly compete with the original Licensor by offering it to third parties as a hosted, managed, or Software-as-a-Service (SaaS) product or cloud service where the primary value of the service is the functionality of the Software itself.

     

       9
       9
       +
       

     

       10
       10
       +
       THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

+2 -1

README.md

···

       45
       45
        
       ```

     

       46
       46
        
       

     

       47
       47
        
       Or manually:

     

       48
       48
       +
       

     

       48
       49
        
       ```bash

     

       49
       50
        
       cd whisper-server

     

       50
       51
        
       pip install -r requirements.txt

     
···

       134
       135
        
       </p>

     

       135
       136
        
       

     

       136
       137
        
       <p align="center">

     

       137
       137
       -
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=MIT&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       138
       +
       	<a href="https://github.com/taciturnaxolotl/thistle/blob/main/LICENSE.md"><img src="https://img.shields.io/static/v1.svg?style=for-the-badge&label=License&message=O'Saasy&logoColor=d9e0ee&colorA=363a4f&colorB=b7bdf8"/></a>

     

       138
       139
        
       </p>

+39

scripts/remove-from-classes.ts

···

       1
       1
       +
       #!/usr/bin/env bun

     

       2
       2
       +
       

     

       3
       3
       +
       import db from "../src/db/schema";

     

       4
       4
       +
       

     

       5
       5
       +
       const email = process.argv[2];

     

       6
       6
       +
       

     

       7
       7
       +
       if (!email) {

     

       8
       8
       +
       	console.error("Usage: bun scripts/remove-from-classes.ts <email>");

     

       9
       9
       +
       	console.error("  Removes a user from all their enrolled classes");

     

       10
       10
       +
       	process.exit(1);

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       const user = db

     

       14
       14
       +
       	.query<{ id: number; email: string }, [string]>(

     

       15
       15
       +
       		"SELECT id, email FROM users WHERE email = ?",

     

       16
       16
       +
       	)

     

       17
       17
       +
       	.get(email);

     

       18
       18
       +
       

     

       19
       19
       +
       if (!user) {

     

       20
       20
       +
       	console.error(`User with email ${email} not found`);

     

       21
       21
       +
       	process.exit(1);

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // Get current enrollments

     

       25
       25
       +
       const enrollments = db

     

       26
       26
       +
       	.query<{ class_id: string }, [number]>(

     

       27
       27
       +
       		"SELECT class_id FROM class_members WHERE user_id = ?",

     

       28
       28
       +
       	)

     

       29
       29
       +
       	.all(user.id);

     

       30
       30
       +
       

     

       31
       31
       +
       if (enrollments.length === 0) {

     

       32
       32
       +
       	console.log(`User ${email} is not enrolled in any classes`);

     

       33
       33
       +
       	process.exit(0);

     

       34
       34
       +
       }

     

       35
       35
       +
       

     

       36
       36
       +
       // Remove from all classes

     

       37
       37
       +
       db.run("DELETE FROM class_members WHERE user_id = ?", [user.id]);

     

       38
       38
       +
       

     

       39
       39
       +
       console.log(`✅ Successfully removed ${email} from ${enrollments.length} class(es)`);

+215 -15

src/components/admin-classes.ts

···

       40
       40
        
       	@state() activeTab: "classes" | "waitlist" = "classes";

     

       41
       41
        
       	@state() approvingEntry: WaitlistEntry | null = null;

     

       42
       42
        
       	@state() showModal = false;

     

       43
       43
       +
       	@state() showClassSettingsModal = false;

     

       44
       44
       +
       	@state() editingClassId: string | null = null;

     

       45
       45
       +
       	@state() editingClassInfo: Class | null = null;

     

       46
       46
       +
       	@state() editingClassSections: { id: string; section_number: string }[] = [];

     

       47
       47
       +
       	@state() newSectionNumber = "";

     

       43
       48
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       49
       49
       +
       	@state() sections: string[] = [];

     

       44
       50
        
       	@state() editingClass = {

     

       45
       51
        
       		courseCode: "",

     

       46
       52
        
       		courseName: "",

     
···

       664
       670
        
       		this.showModal = true;

     

       665
       671
        
       	}

     

       666
       672
        
       

     

       673
       673
       +
       	private async handleEditSections(classId: string) {

     

       674
       674
       +
       		try {

     

       675
       675
       +
       			const response = await fetch(`/api/classes/${classId}`);

     

       676
       676
       +
       			if (!response.ok) throw new Error("Failed to load class");

     

       677
       677
       +
       			

     

       678
       678
       +
       			const data = await response.json();

     

       679
       679
       +
       			this.editingClassId = classId;

     

       680
       680
       +
       			this.editingClassInfo = data.class;

     

       681
       681
       +
       			this.editingClassSections = data.sections || [];

     

       682
       682
       +
       			this.newSectionNumber = "";

     

       683
       683
       +
       			this.showClassSettingsModal = true;

     

       684
       684
       +
       		} catch {

     

       685
       685
       +
       			this.error = "Failed to load class details";

     

       686
       686
       +
       		}

     

       687
       687
       +
       	}

     

       688
       688
       +
       

     

       689
       689
       +
       	private async handleAddSection() {

     

       690
       690
       +
       		if (!this.newSectionNumber.trim() || !this.editingClassId) return;

     

       691
       691
       +
       

     

       692
       692
       +
       		try {

     

       693
       693
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections`, {

     

       694
       694
       +
       				method: "POST",

     

       695
       695
       +
       				headers: { "Content-Type": "application/json" },

     

       696
       696
       +
       				body: JSON.stringify({ section_number: this.newSectionNumber.trim() }),

     

       697
       697
       +
       			});

     

       698
       698
       +
       

     

       699
       699
       +
       			if (!response.ok) {

     

       700
       700
       +
       				const data = await response.json();

     

       701
       701
       +
       				this.error = data.error || "Failed to add section";

     

       702
       702
       +
       				return;

     

       703
       703
       +
       			}

     

       704
       704
       +
       

     

       705
       705
       +
       			const newSection = await response.json();

     

       706
       706
       +
       			this.editingClassSections = [...this.editingClassSections, newSection];

     

       707
       707
       +
       			this.newSectionNumber = "";

     

       708
       708
       +
       		} catch {

     

       709
       709
       +
       			this.error = "Failed to add section";

     

       710
       710
       +
       		}

     

       711
       711
       +
       	}

     

       712
       712
       +
       

     

       713
       713
       +
       	private async handleDeleteSection(sectionId: string) {

     

       714
       714
       +
       		if (!this.editingClassId) return;

     

       715
       715
       +
       

     

       716
       716
       +
       		try {

     

       717
       717
       +
       			const response = await fetch(`/api/classes/${this.editingClassId}/sections/${sectionId}`, {

     

       718
       718
       +
       				method: "DELETE",

     

       719
       719
       +
       			});

     

       720
       720
       +
       

     

       721
       721
       +
       			if (!response.ok) {

     

       722
       722
       +
       				const data = await response.json();

     

       723
       723
       +
       				this.error = data.error || "Failed to delete section";

     

       724
       724
       +
       				return;

     

       725
       725
       +
       			}

     

       726
       726
       +
       

     

       727
       727
       +
       			this.editingClassSections = this.editingClassSections.filter(s => s.id !== sectionId);

     

       728
       728
       +
       		} catch {

     

       729
       729
       +
       			this.error = "Failed to delete section";

     

       730
       730
       +
       		}

     

       731
       731
       +
       	}

     

       732
       732
       +
       

     

       733
       733
       +
       	private handleCloseSectionsModal() {

     

       734
       734
       +
       		this.showClassSettingsModal = false;

     

       735
       735
       +
       		this.editingClassId = null;

     

       736
       736
       +
       		this.editingClassInfo = null;

     

       737
       737
       +
       		this.editingClassSections = [];

     

       738
       738
       +
       		this.newSectionNumber = "";

     

       739
       739
       +
       		this.loadData();

     

       740
       740
       +
       	}

     

       741
       741
       +
       

     

       742
       742
       +
       

     

       667
       743
        
       	private getFilteredClasses() {

     

       668
       744
        
       		if (!this.searchTerm) return this.classes;

     

       669
       745
        
       

     
···

       714
       790
        
       			}

     

       715
       791
        
       

     

       716
       792
        
             ${this.showModal ? this.renderApprovalModal() : ""}

     

       793
       793
       +
             ${this.showClassSettingsModal ? this.renderClassSettingsModal() : ""}

     

       717
       794
        
           `;

     

       718
       795
        
       	}

     

       719
       796
        
       

     
···

       743
       820
        
                 <div class="classes-grid">

     

       744
       821
        
                   ${filteredClasses.map(

     

       745
       822
        
       							(cls) => html`

     

       746
       746
       -
                     <div class="class-card ${cls.archived ? "archived" : ""}">

     

       823
       823
       +
                     <div 

     

       824
       824
       +
                       class="class-card ${cls.archived ? "archived" : ""}"

     

       825
       825
       +
                       @click=${() => this.handleEditSections(cls.id)}

     

       826
       826
       +
                       style="cursor: pointer;"

     

       827
       827
       +
                     >

     

       747
       828
        
                       <div class="class-header">

     

       748
       829
        
                         <div class="class-info">

     

       749
       830
        
                           <div class="course-code">${cls.course_code}</div>

     
···

       756
       837
        
                             ${cls.archived ? html`<span class="badge archived">Archived</span>` : ""}

     

       757
       838
        
                           </div>

     

       758
       839
        
                         </div>

     

       759
       759
       -
                         <div class="actions">

     

       760
       760
       -
                           <button

     

       761
       761
       -
                             class="btn-archive"

     

       762
       762
       -
                             @click=${() => this.handleToggleArchive(cls.id)}

     

       763
       763
       -
                           >

     

       764
       764
       -
                             ${cls.archived ? "Unarchive" : "Archive"}

     

       765
       765
       -
                           </button>

     

       766
       766
       -
                           <button

     

       767
       767
       -
                             class="btn-delete"

     

       768
       768
       -
                             @click=${() => this.handleDeleteClick(cls.id, "class")}

     

       769
       769
       -
                           >

     

       770
       770
       -
                             ${this.getDeleteButtonText(cls.id, "class")}

     

       771
       771
       -
                           </button>

     

       772
       772
       -
                         </div>

     

       773
       840
        
                       </div>

     

       774
       841
        
                     </div>

     

       775
       842
        
                   `,

     
···

       780
       847
        
           `;

     

       781
       848
        
       	}

     

       782
       849
        
       

     

       850
       850
       +
       	private renderClassSettingsModal() {

     

       851
       851
       +
       		if (!this.showClassSettingsModal || !this.editingClassInfo) return html``;

     

       852
       852
       +
       

     

       853
       853
       +
       		return html`

     

       854
       854
       +
             <div class="modal-overlay" @click=${this.handleCloseSectionsModal}>

     

       855
       855
       +
               <div class="modal" @click=${(e: Event) => e.stopPropagation()} style="max-width: 48rem;">

     

       856
       856
       +
                 <div class="modal-header">

     

       857
       857
       +
                   <h2 class="modal-title">${this.editingClassInfo.course_code} - ${this.editingClassInfo.name}</h2>

     

       858
       858
       +
                   <button class="close-btn" @click=${this.handleCloseSectionsModal} type="button">×</button>

     

       859
       859
       +
                 </div>

     

       860
       860
       +
       

     

       861
       861
       +
                 <div class="tabs" style="margin-bottom: 1.5rem;">

     

       862
       862
       +
                   <div style="display: flex; gap: 0.5rem; border-bottom: 2px solid var(--secondary);">

     

       863
       863
       +
                     <button

     

       864
       864
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: none; border-bottom: 2px solid var(--primary); font-weight: 600; cursor: pointer; margin-bottom: -2px;"

     

       865
       865
       +
                     >

     

       866
       866
       +
                       Sections

     

       867
       867
       +
                     </button>

     

       868
       868
       +
                   </div>

     

       869
       869
       +
                 </div>

     

       870
       870
       +
       

     

       871
       871
       +
                 <!-- Sections Tab -->

     

       872
       872
       +
                 <div style="margin-bottom: 1.5rem;">

     

       873
       873
       +
                   <h3 style="margin-bottom: 1rem; color: var(--text);">Manage Sections</h3>

     

       874
       874
       +
                   

     

       875
       875
       +
                   <div style="display: flex; gap: 0.75rem; margin-bottom: 1rem;">

     

       876
       876
       +
                     <input

     

       877
       877
       +
                       type="text"

     

       878
       878
       +
                       placeholder="Section number (e.g., 01, 02, A, B)"

     

       879
       879
       +
                       .value=${this.newSectionNumber}

     

       880
       880
       +
                       @input=${(e: Event) => {

     

       881
       881
       +
       									this.newSectionNumber = (e.target as HTMLInputElement).value;

     

       882
       882
       +
       								}}

     

       883
       883
       +
                       @keypress=${(e: KeyboardEvent) => {

     

       884
       884
       +
       									if (e.key === "Enter") {

     

       885
       885
       +
       										e.preventDefault();

     

       886
       886
       +
       										this.handleAddSection();

     

       887
       887
       +
       									}

     

       888
       888
       +
       								}}

     

       889
       889
       +
                       style="flex: 1; padding: 0.75rem; border: 2px solid var(--secondary); border-radius: 6px; font-size: 1rem; background: var(--background); color: var(--text);"

     

       890
       890
       +
                     />

     

       891
       891
       +
                     <button

     

       892
       892
       +
                       @click=${this.handleAddSection}

     

       893
       893
       +
                       ?disabled=${!this.newSectionNumber.trim()}

     

       894
       894
       +
                       style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer; white-space: nowrap;"

     

       895
       895
       +
                     >

     

       896
       896
       +
                       Add Section

     

       897
       897
       +
                     </button>

     

       898
       898
       +
                   </div>

     

       899
       899
       +
       

     

       900
       900
       +
                   ${

     

       901
       901
       +
       							this.editingClassSections.length === 0

     

       902
       902
       +
       								? html`<p style="color: var(--paynes-gray); text-align: center; padding: 2rem;">No sections yet. Add one above.</p>`

     

       903
       903
       +
       								: html`

     

       904
       904
       +
                       <div style="display: flex; flex-direction: column; gap: 0.5rem;">

     

       905
       905
       +
                         ${this.editingClassSections.map(

     

       906
       906
       +
       										(section) => html`

     

       907
       907
       +
                           <div style="display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: color-mix(in srgb, var(--secondary) 30%, transparent); border-radius: 6px;">

     

       908
       908
       +
                             <span style="font-weight: 500;">Section ${section.section_number}</span>

     

       909
       909
       +
                             <button

     

       910
       910
       +
                               @click=${(e: Event) => {

     

       911
       911
       +
       													e.stopPropagation();

     

       912
       912
       +
       													this.handleDeleteSection(section.id);

     

       913
       913
       +
       												}}

     

       914
       914
       +
                               style="padding: 0.5rem 1rem; background: transparent; color: red; border: 2px solid red; border-radius: 4px; font-size: 0.875rem; cursor: pointer;"

     

       915
       915
       +
                             >

     

       916
       916
       +
                               Delete

     

       917
       917
       +
                             </button>

     

       918
       918
       +
                           </div>

     

       919
       919
       +
                         `,

     

       920
       920
       +
       									)}

     

       921
       921
       +
                       </div>

     

       922
       922
       +
                     `

     

       923
       923
       +
       						}

     

       924
       924
       +
                 </div>

     

       925
       925
       +
       

     

       926
       926
       +
                 <!-- Actions -->

     

       927
       927
       +
                 <div style="display: flex; gap: 0.75rem; justify-content: space-between; padding-top: 1.5rem; border-top: 2px solid var(--secondary);">

     

       928
       928
       +
                   <div style="display: flex; gap: 0.75rem;">

     

       929
       929
       +
                     <button

     

       930
       930
       +
                       @click=${(e: Event) => {

     

       931
       931
       +
       									e.stopPropagation();

     

       932
       932
       +
       									this.handleToggleArchive(this.editingClassId!);

     

       933
       933
       +
       									this.handleCloseSectionsModal();

     

       934
       934
       +
       								}}

     

       935
       935
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: var(--primary); border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       936
       936
       +
                     >

     

       937
       937
       +
                       ${this.editingClassInfo.archived ? "Unarchive" : "Archive"} Class

     

       938
       938
       +
                     </button>

     

       939
       939
       +
                     <button

     

       940
       940
       +
                       @click=${(e: Event) => {

     

       941
       941
       +
       									e.stopPropagation();

     

       942
       942
       +
       									this.handleDeleteClick(this.editingClassId!, "class");

     

       943
       943
       +
       								}}

     

       944
       944
       +
                       style="padding: 0.75rem 1.5rem; background: transparent; color: red; border: 2px solid red; border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       945
       945
       +
                     >

     

       946
       946
       +
                       ${this.getDeleteButtonText(this.editingClassId!, "class")}

     

       947
       947
       +
                     </button>

     

       948
       948
       +
                   </div>

     

       949
       949
       +
                   <button

     

       950
       950
       +
                     @click=${this.handleCloseSectionsModal}

     

       951
       951
       +
                     style="padding: 0.75rem 1.5rem; background: var(--primary); color: white; border: 2px solid var(--primary); border-radius: 6px; font-weight: 500; cursor: pointer;"

     

       952
       952
       +
                   >

     

       953
       953
       +
                     Done

     

       954
       954
       +
                   </button>

     

       955
       955
       +
                 </div>

     

       956
       956
       +
       

     

       957
       957
       +
                 ${this.error ? html`<div style="color: red; margin-top: 1rem; padding: 0.75rem; background: color-mix(in srgb, red 10%, transparent); border-radius: 6px;">${this.error}</div>` : ""}

     

       958
       958
       +
               </div>

     

       959
       959
       +
             </div>

     

       960
       960
       +
           `;

     

       961
       961
       +
       	}

     

       962
       962
       +
       

     

       783
       963
        
       	private renderWaitlist() {

     

       784
       964
        
       		return html`

     

       785
       965
        
             ${

     
···

       865
       1045
        
       		this.meetingTimes = e.detail;

     

       866
       1046
        
       	}

     

       867
       1047
        
       

     

       1048
       1048
       +
       	private handleSectionsChange(e: Event) {

     

       1049
       1049
       +
       		const value = (e.target as HTMLInputElement).value;

     

       1050
       1050
       +
       		this.sections = value

     

       1051
       1051
       +
       			.split(",")

     

       1052
       1052
       +
       			.map((s) => s.trim())

     

       1053
       1053
       +
       			.filter((s) => s);

     

       1054
       1054
       +
       	}

     

       1055
       1055
       +
       

     

       868
       1056
        
       	private handleClassFieldInput(field: string, e: Event) {

     

       869
       1057
        
       		const value = (e.target as HTMLInputElement | HTMLSelectElement).value;

     

       870
       1058
        
       		this.editingClass = { ...this.editingClass, [field]: value };

     
···

       874
       1062
        
       		this.showModal = false;

     

       875
       1063
        
       		this.approvingEntry = null;

     

       876
       1064
        
       		this.meetingTimes = [];

     

       1065
       1065
       +
       		this.sections = [];

     

       877
       1066
        
       		this.editingClass = {

     

       878
       1067
        
       			courseCode: "",

     

       879
       1068
        
       			courseName: "",

     
···

       903
       1092
        
       					semester: this.editingClass.semester,

     

       904
       1093
        
       					year: this.editingClass.year,

     

       905
       1094
        
       					meeting_times: labels,

     

       1095
       1095
       +
       					sections: this.sections.length > 0 ? this.sections : undefined,

     

       906
       1096
        
       				}),

     

       907
       1097
        
       			});

     

       908
       1098
        
       

     
···

       1018
       1208
        
                       .value=${this.meetingTimes}

     

       1019
       1209
        
                       @change=${this.handleMeetingTimesChange}

     

       1020
       1210
        
                     ></meeting-time-picker>

     

       1211
       1211
       +
                   </div>

     

       1212
       1212
       +
                   <div class="form-group form-group-full">

     

       1213
       1213
       +
                     <label>Sections (optional)</label>

     

       1214
       1214
       +
                     <input

     

       1215
       1215
       +
                       type="text"

     

       1216
       1216
       +
                       placeholder="e.g., 01, 02, 03 or A, B, C"

     

       1217
       1217
       +
                       .value=${this.sections.join(", ")}

     

       1218
       1218
       +
                       @input=${this.handleSectionsChange}

     

       1219
       1219
       +
                     />

     

       1220
       1220
       +
                     <div class="help-text">Comma-separated list of section numbers. Leave blank if no sections.</div>

     

       1021
       1221
        
                   </div>

     

       1022
       1222
        
                 </div>

     

       1023
       1223

+112 -6

src/components/class-view.ts

···

       2
       2
        
       import { customElement, state } from "lit/decorators.js";

     

       3
       3
        
       import "./upload-recording-modal.ts";

     

       4
       4
        
       import "./vtt-viewer.ts";

     

       5
       5
       +
       import "./pending-recordings-view.ts";

     

       5
       6
        
       

     

       6
       7
        
       interface Class {

     

       7
       8
        
       	id: string;

     
···

       24
       25
        
       	id: string;

     

       25
       26
        
       	user_id: number;

     

       26
       27
        
       	meeting_time_id: string | null;

     

       28
       28
       +
       	section_id: string | null;

     

       27
       29
        
       	filename: string;

     

       28
       30
        
       	original_filename: string;

     

       29
       31
        
       	status:

     
···

       42
       44
        
       	audioUrl?: string;

     

       43
       45
        
       }

     

       44
       46
        
       

     

       47
       47
       +
       interface ClassSection {

     

       48
       48
       +
       	id: string;

     

       49
       49
       +
       	section_number: string;

     

       50
       50
       +
       }

     

       51
       51
       +
       

     

       45
       52
        
       @customElement("class-view")

     

       46
       53
        
       export class ClassView extends LitElement {

     

       47
       54
        
       	@state() classId = "";

     

       48
       55
        
       	@state() classInfo: Class | null = null;

     

       49
       56
        
       	@state() meetingTimes: MeetingTime[] = [];

     

       57
       57
       +
       	@state() sections: ClassSection[] = [];

     

       58
       58
       +
       	@state() userSection: string | null = null;

     

       59
       59
       +
       	@state() selectedSectionFilter: string | null = null;

     

       50
       60
        
       	@state() transcriptions: Transcription[] = [];

     

       51
       61
        
       	@state() isLoading = true;

     

       52
       62
        
       	@state() error: string | null = null;

     
···

       363
       373
        
       			const data = await response.json();

     

       364
       374
        
       			this.classInfo = data.class;

     

       365
       375
        
       			this.meetingTimes = data.meetingTimes || [];

     

       376
       376
       +
       			this.sections = data.sections || [];

     

       377
       377
       +
       			this.userSection = data.userSection || null;

     

       366
       378
        
       			this.transcriptions = data.transcriptions || [];

     

       379
       379
       +
       

     

       380
       380
       +
       			// Default to user's section for filtering

     

       381
       381
       +
       			if (this.userSection && !this.selectedSectionFilter) {

     

       382
       382
       +
       				this.selectedSectionFilter = this.userSection;

     

       383
       383
       +
       			}

     

       367
       384
        
       

     

       368
       385
        
       			// Load VTT for completed transcriptions

     

       369
       386
        
       			await this.loadVTTForCompleted();

     
···

       450
       467
        
       	}

     

       451
       468
        
       

     

       452
       469
        
       	private get filteredTranscriptions() {

     

       453
       453
       -
       		if (!this.searchQuery) return this.transcriptions;

     

       470
       470
       +
       		let filtered = this.transcriptions;

     

       471
       471
       +
       

     

       472
       472
       +
       		// Filter by selected section (or user's section by default)

     

       473
       473
       +
       		const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       474
       474
       +
       		

     

       475
       475
       +
       		// Only filter by section if:

     

       476
       476
       +
       		// 1. There are sections in the class

     

       477
       477
       +
       		// 2. User has a section OR has selected one

     

       478
       478
       +
       		if (this.sections.length > 0 && sectionFilter) {

     

       479
       479
       +
       			// For admins: show all transcriptions

     

       480
       480
       +
       			// For users: show their section + transcriptions with no section (legacy/unassigned)

     

       481
       481
       +
       			if (!this.isAdmin) {

     

       482
       482
       +
       				filtered = filtered.filter(

     

       483
       483
       +
       					(t) => t.section_id === sectionFilter || t.section_id === null,

     

       484
       484
       +
       				);

     

       485
       485
       +
       			}

     

       486
       486
       +
       		}

     

       487
       487
       +
       

     

       488
       488
       +
       		// Filter by search query

     

       489
       489
       +
       		if (this.searchQuery) {

     

       490
       490
       +
       			const query = this.searchQuery.toLowerCase();

     

       491
       491
       +
       			filtered = filtered.filter((t) =>

     

       492
       492
       +
       				t.original_filename.toLowerCase().includes(query),

     

       493
       493
       +
       			);

     

       494
       494
       +
       		}

     

       454
       495
        
       

     

       455
       455
       -
       		const query = this.searchQuery.toLowerCase();

     

       456
       456
       -
       		return this.transcriptions.filter((t) =>

     

       457
       457
       -
       			t.original_filename.toLowerCase().includes(query),

     

       458
       458
       -
       		);

     

       496
       496
       +
       		// Exclude pending recordings (they're shown in the voting section)

     

       497
       497
       +
       		filtered = filtered.filter((t) => t.status !== "pending");

     

       498
       498
       +
       

     

       499
       499
       +
       		return filtered;

     

       459
       500
        
       	}

     

       460
       501
        
       

     

       461
       502
        
       	private formatDate(timestamp: number): string {

     
···

       521
       562
        
                   <div class="course-code">${this.classInfo.course_code}</div>

     

       522
       563
        
                   <h1>${this.classInfo.name}</h1>

     

       523
       564
        
                   <div class="professor">Professor: ${this.classInfo.professor}</div>

     

       524
       524
       -
                   <div class="semester">${this.classInfo.semester} ${this.classInfo.year}</div>

     

       565
       565
       +
                   <div class="semester">

     

       566
       566
       +
                     ${this.classInfo.semester} ${this.classInfo.year}

     

       567
       567
       +
                     ${

     

       568
       568
       +
       								this.userSection

     

       569
       569
       +
       									? ` • Section ${this.sections.find((s) => s.id === this.userSection)?.section_number || ""}`

     

       570
       570
       +
       									: ""

     

       571
       571
       +
       							}

     

       572
       572
       +
                   </div>

     

       525
       573
        
                 </div>

     

       526
       574
        
               </div>

     

       527
       575
        
       

     
···

       549
       597
        
               `

     

       550
       598
        
       						: html`

     

       551
       599
        
               <div class="search-upload">

     

       600
       600
       +
                 ${

     

       601
       601
       +
       						this.sections.length > 1

     

       602
       602
       +
       							? html`

     

       603
       603
       +
                     <select

     

       604
       604
       +
                       style="padding: 0.5rem 0.75rem; border: 1px solid var(--secondary); border-radius: 4px; font-size: 0.875rem; color: var(--text); background: var(--background);"

     

       605
       605
       +
                       @change=${(e: Event) => {

     

       606
       606
       +
       									this.selectedSectionFilter =

     

       607
       607
       +
       										(e.target as HTMLSelectElement).value || null;

     

       608
       608
       +
       								}}

     

       609
       609
       +
                       .value=${this.selectedSectionFilter || ""}

     

       610
       610
       +
                     >

     

       611
       611
       +
                       ${this.sections.map(

     

       612
       612
       +
       									(s) =>

     

       613
       613
       +
       										html`<option value=${s.id} ?selected=${s.id === this.selectedSectionFilter}>${s.section_number}</option>`,

     

       614
       614
       +
       								)}

     

       615
       615
       +
                     </select>

     

       616
       616
       +
                   `

     

       617
       617
       +
       							: ""

     

       618
       618
       +
       					}

     

       552
       619
        
                 <input

     

       553
       620
        
                   type="text"

     

       554
       621
        
                   class="search-box"

     
···

       567
       634
        
                 </button>

     

       568
       635
        
               </div>

     

       569
       636
        
       

     

       637
       637
       +
               <!-- Pending Recordings for Voting -->

     

       638
       638
       +
               ${

     

       639
       639
       +
       					this.meetingTimes.map((meeting) => {

     

       640
       640
       +
       						// Apply section filtering to pending recordings

     

       641
       641
       +
       						const sectionFilter = this.selectedSectionFilter || this.userSection;

     

       642
       642
       +
       						

     

       643
       643
       +
       						const pendingCount = this.transcriptions.filter((t) => {

     

       644
       644
       +
       							if (t.meeting_time_id !== meeting.id || t.status !== "pending") {

     

       645
       645
       +
       								return false;

     

       646
       646
       +
       							}

     

       647
       647
       +
       							

     

       648
       648
       +
       							// Filter by section if applicable

     

       649
       649
       +
       							if (this.sections.length > 0 && sectionFilter) {

     

       650
       650
       +
       								// Show recordings from user's section or no section (unassigned)

     

       651
       651
       +
       								return t.section_id === sectionFilter || t.section_id === null;

     

       652
       652
       +
       							}

     

       653
       653
       +
       							

     

       654
       654
       +
       							return true;

     

       655
       655
       +
       						}).length;

     

       656
       656
       +
       

     

       657
       657
       +
       						// Only show if there are pending recordings

     

       658
       658
       +
       						if (pendingCount === 0) return "";

     

       659
       659
       +
       

     

       660
       660
       +
       						return html`

     

       661
       661
       +
                   <div style="margin-bottom: 2rem;">

     

       662
       662
       +
                     <pending-recordings-view

     

       663
       663
       +
                       .classId=${this.classId}

     

       664
       664
       +
                       .meetingTimeId=${meeting.id}

     

       665
       665
       +
                       .meetingTimeLabel=${meeting.label}

     

       666
       666
       +
                       .sectionId=${sectionFilter}

     

       667
       667
       +
                     ></pending-recordings-view>

     

       668
       668
       +
                   </div>

     

       669
       669
       +
                 `;

     

       670
       670
       +
       					})

     

       671
       671
       +
       				}

     

       672
       672
       +
       

     

       673
       673
       +
               <!-- Completed/Processing Transcriptions -->

     

       570
       674
        
               ${

     

       571
       675
        
       					this.filteredTranscriptions.length === 0

     

       572
       676
        
       						? html`

     
···

       631
       735
        
               ?open=${this.uploadModalOpen}

     

       632
       736
        
               .classId=${this.classId}

     

       633
       737
        
               .meetingTimes=${this.meetingTimes.map((m) => ({ id: m.id, label: m.label }))}

     

       738
       738
       +
               .sections=${this.sections}

     

       739
       739
       +
               .userSection=${this.userSection}

     

       634
       740
        
               @close=${this.handleModalClose}

     

       635
       741
        
               @upload-success=${this.handleUploadSuccess}

     

       636
       742
        
             ></upload-recording-modal>

src/components/classes-overview.ts

···

       232
       232
        
       	}

     

       233
       233
        
       

     

       234
       234
        
       	private async handleClassJoined() {

     

       235
       235
       +
       		this.showRegistrationModal = false;

     

       235
       236
        
       		await this.loadClasses();

     

       236
       237
        
       	}

     

       237
       238

+436

src/components/pending-recordings-view.ts

···

       1
       1
       +
       import { css, html, LitElement } from "lit";

     

       2
       2
       +
       import { customElement, property, state } from "lit/decorators.js";

     

       3
       3
       +
       

     

       4
       4
       +
       interface PendingRecording {

     

       5
       5
       +
       	id: string;

     

       6
       6
       +
       	user_id: number;

     

       7
       7
       +
       	filename: string;

     

       8
       8
       +
       	original_filename: string;

     

       9
       9
       +
       	vote_count: number;

     

       10
       10
       +
       	created_at: number;

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       interface RecordingsData {

     

       14
       14
       +
       	recordings: PendingRecording[];

     

       15
       15
       +
       	total_users: number;

     

       16
       16
       +
       	user_vote: string | null;

     

       17
       17
       +
       	vote_threshold: number;

     

       18
       18
       +
       	winning_recording_id: string | null;

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       @customElement("pending-recordings-view")

     

       22
       22
       +
       export class PendingRecordingsView extends LitElement {

     

       23
       23
       +
       	@property({ type: String }) classId = "";

     

       24
       24
       +
       	@property({ type: String }) meetingTimeId = "";

     

       25
       25
       +
       	@property({ type: String }) meetingTimeLabel = "";

     

       26
       26
       +
       	@property({ type: String }) sectionId: string | null = null;

     

       27
       27
       +
       

     

       28
       28
       +
       	@state() private recordings: PendingRecording[] = [];

     

       29
       29
       +
       	@state() private userVote: string | null = null;

     

       30
       30
       +
       	@state() private voteThreshold = 0;

     

       31
       31
       +
       	@state() private winningRecordingId: string | null = null;

     

       32
       32
       +
       	@state() private error: string | null = null;

     

       33
       33
       +
       	@state() private timeRemaining = "";

     

       34
       34
       +
       

     

       35
       35
       +
       	private refreshInterval?: number;

     

       36
       36
       +
       	private loadingInProgress = false;

     

       37
       37
       +
       

     

       38
       38
       +
       	static override styles = css`

     

       39
       39
       +
           :host {

     

       40
       40
       +
             display: block;

     

       41
       41
       +
             padding: 1rem;

     

       42
       42
       +
           }

     

       43
       43
       +
       

     

       44
       44
       +
           .container {

     

       45
       45
       +
             max-width: 56rem;

     

       46
       46
       +
             margin: 0 auto;

     

       47
       47
       +
           }

     

       48
       48
       +
       

     

       49
       49
       +
           h2 {

     

       50
       50
       +
             color: var(--text);

     

       51
       51
       +
             margin-bottom: 0.5rem;

     

       52
       52
       +
           }

     

       53
       53
       +
       

     

       54
       54
       +
           .info {

     

       55
       55
       +
             color: var(--paynes-gray);

     

       56
       56
       +
             font-size: 0.875rem;

     

       57
       57
       +
             margin-bottom: 1.5rem;

     

       58
       58
       +
           }

     

       59
       59
       +
       

     

       60
       60
       +
           .stats {

     

       61
       61
       +
             display: flex;

     

       62
       62
       +
             gap: 2rem;

     

       63
       63
       +
             margin-bottom: 1.5rem;

     

       64
       64
       +
             padding: 1rem;

     

       65
       65
       +
             background: color-mix(in srgb, var(--primary) 5%, transparent);

     

       66
       66
       +
             border-radius: 8px;

     

       67
       67
       +
           }

     

       68
       68
       +
       

     

       69
       69
       +
           .stat {

     

       70
       70
       +
             display: flex;

     

       71
       71
       +
             flex-direction: column;

     

       72
       72
       +
             gap: 0.25rem;

     

       73
       73
       +
           }

     

       74
       74
       +
       

     

       75
       75
       +
           .stat-label {

     

       76
       76
       +
             font-size: 0.75rem;

     

       77
       77
       +
             color: var(--paynes-gray);

     

       78
       78
       +
             text-transform: uppercase;

     

       79
       79
       +
             letter-spacing: 0.05em;

     

       80
       80
       +
           }

     

       81
       81
       +
       

     

       82
       82
       +
           .stat-value {

     

       83
       83
       +
             font-size: 1.5rem;

     

       84
       84
       +
             font-weight: 600;

     

       85
       85
       +
             color: var(--text);

     

       86
       86
       +
           }

     

       87
       87
       +
       

     

       88
       88
       +
           .recordings-list {

     

       89
       89
       +
             display: flex;

     

       90
       90
       +
             flex-direction: column;

     

       91
       91
       +
             gap: 1rem;

     

       92
       92
       +
           }

     

       93
       93
       +
       

     

       94
       94
       +
           .recording-card {

     

       95
       95
       +
             border: 2px solid var(--secondary);

     

       96
       96
       +
             border-radius: 8px;

     

       97
       97
       +
             padding: 1rem;

     

       98
       98
       +
             transition: all 0.2s;

     

       99
       99
       +
           }

     

       100
       100
       +
       

     

       101
       101
       +
           .recording-card.voted {

     

       102
       102
       +
             border-color: var(--accent);

     

       103
       103
       +
             background: color-mix(in srgb, var(--accent) 5%, transparent);

     

       104
       104
       +
           }

     

       105
       105
       +
       

     

       106
       106
       +
           .recording-card.winning {

     

       107
       107
       +
             border-color: var(--accent);

     

       108
       108
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       109
       109
       +
           }

     

       110
       110
       +
       

     

       111
       111
       +
           .recording-header {

     

       112
       112
       +
             display: flex;

     

       113
       113
       +
             justify-content: space-between;

     

       114
       114
       +
             align-items: center;

     

       115
       115
       +
             margin-bottom: 0.75rem;

     

       116
       116
       +
           }

     

       117
       117
       +
       

     

       118
       118
       +
           .recording-info {

     

       119
       119
       +
             flex: 1;

     

       120
       120
       +
           }

     

       121
       121
       +
       

     

       122
       122
       +
           .recording-name {

     

       123
       123
       +
             font-weight: 600;

     

       124
       124
       +
             color: var(--text);

     

       125
       125
       +
             margin-bottom: 0.25rem;

     

       126
       126
       +
           }

     

       127
       127
       +
       

     

       128
       128
       +
           .recording-meta {

     

       129
       129
       +
             font-size: 0.75rem;

     

       130
       130
       +
             color: var(--paynes-gray);

     

       131
       131
       +
           }

     

       132
       132
       +
       

     

       133
       133
       +
           .vote-section {

     

       134
       134
       +
             display: flex;

     

       135
       135
       +
             align-items: center;

     

       136
       136
       +
             gap: 1rem;

     

       137
       137
       +
           }

     

       138
       138
       +
       

     

       139
       139
       +
           .vote-count {

     

       140
       140
       +
             font-size: 1.25rem;

     

       141
       141
       +
             font-weight: 600;

     

       142
       142
       +
             color: var(--accent);

     

       143
       143
       +
             min-width: 3rem;

     

       144
       144
       +
             text-align: center;

     

       145
       145
       +
           }

     

       146
       146
       +
       

     

       147
       147
       +
           .vote-button {

     

       148
       148
       +
             padding: 0.5rem 1rem;

     

       149
       149
       +
             border-radius: 6px;

     

       150
       150
       +
             font-size: 0.875rem;

     

       151
       151
       +
             font-weight: 500;

     

       152
       152
       +
             cursor: pointer;

     

       153
       153
       +
             transition: all 0.2s;

     

       154
       154
       +
             border: 2px solid var(--secondary);

     

       155
       155
       +
             background: var(--background);

     

       156
       156
       +
             color: var(--text);

     

       157
       157
       +
           }

     

       158
       158
       +
       

     

       159
       159
       +
           .vote-button:hover:not(:disabled) {

     

       160
       160
       +
             border-color: var(--accent);

     

       161
       161
       +
             background: color-mix(in srgb, var(--accent) 10%, transparent);

     

       162
       162
       +
           }

     

       163
       163
       +
       

     

       164
       164
       +
           .vote-button.voted {

     

       165
       165
       +
             border-color: var(--accent);

     

       166
       166
       +
             background: var(--accent);

     

       167
       167
       +
             color: var(--white);

     

       168
       168
       +
           }

     

       169
       169
       +
       

     

       170
       170
       +
           .vote-button:disabled {

     

       171
       171
       +
             opacity: 0.5;

     

       172
       172
       +
             cursor: not-allowed;

     

       173
       173
       +
           }

     

       174
       174
       +
       

     

       175
       175
       +
           .delete-button {

     

       176
       176
       +
             padding: 0.5rem;

     

       177
       177
       +
             border: none;

     

       178
       178
       +
             background: transparent;

     

       179
       179
       +
             color: var(--paynes-gray);

     

       180
       180
       +
             cursor: pointer;

     

       181
       181
       +
             border-radius: 4px;

     

       182
       182
       +
             transition: all 0.2s;

     

       183
       183
       +
           }

     

       184
       184
       +
       

     

       185
       185
       +
           .delete-button:hover {

     

       186
       186
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       187
       187
       +
             color: red;

     

       188
       188
       +
           }

     

       189
       189
       +
       

     

       190
       190
       +
           .winning-badge {

     

       191
       191
       +
             background: var(--accent);

     

       192
       192
       +
             color: var(--white);

     

       193
       193
       +
             padding: 0.25rem 0.75rem;

     

       194
       194
       +
             border-radius: 12px;

     

       195
       195
       +
             font-size: 0.75rem;

     

       196
       196
       +
             font-weight: 600;

     

       197
       197
       +
           }

     

       198
       198
       +
       

     

       199
       199
       +
           .error {

     

       200
       200
       +
             background: color-mix(in srgb, red 10%, transparent);

     

       201
       201
       +
             border: 1px solid red;

     

       202
       202
       +
             color: red;

     

       203
       203
       +
             padding: 0.75rem;

     

       204
       204
       +
             border-radius: 4px;

     

       205
       205
       +
             margin-bottom: 1rem;

     

       206
       206
       +
             font-size: 0.875rem;

     

       207
       207
       +
           }

     

       208
       208
       +
       

     

       209
       209
       +
           .empty-state {

     

       210
       210
       +
             text-align: center;

     

       211
       211
       +
             padding: 3rem 1rem;

     

       212
       212
       +
             color: var(--paynes-gray);

     

       213
       213
       +
           }

     

       214
       214
       +
       

     

       215
       215
       +
           .audio-player {

     

       216
       216
       +
             margin-top: 0.75rem;

     

       217
       217
       +
           }

     

       218
       218
       +
       

     

       219
       219
       +
           audio {

     

       220
       220
       +
             width: 100%;

     

       221
       221
       +
             height: 2.5rem;

     

       222
       222
       +
           }

     

       223
       223
       +
         `;

     

       224
       224
       +
       

     

       225
       225
       +
       	override connectedCallback() {

     

       226
       226
       +
       		super.connectedCallback();

     

       227
       227
       +
       		this.loadRecordings();

     

       228
       228
       +
       		// Refresh every 10 seconds

     

       229
       229
       +
       		this.refreshInterval = setInterval(() => this.loadRecordings(), 10000);

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	override disconnectedCallback() {

     

       233
       233
       +
       		super.disconnectedCallback();

     

       234
       234
       +
       		if (this.refreshInterval) {

     

       235
       235
       +
       			clearInterval(this.refreshInterval);

     

       236
       236
       +
       		}

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	private async loadRecordings() {

     

       240
       240
       +
       		if (this.loadingInProgress) return;

     

       241
       241
       +
       

     

       242
       242
       +
       		this.loadingInProgress = true;

     

       243
       243
       +
       

     

       244
       244
       +
       		try {

     

       245
       245
       +
       			// Build URL with optional section_id parameter

     

       246
       246
       +
       			const url = new URL(

     

       247
       247
       +
       				`/api/classes/${this.classId}/meetings/${this.meetingTimeId}/recordings`,

     

       248
       248
       +
       				window.location.origin,

     

       249
       249
       +
       			);

     

       250
       250
       +
       			if (this.sectionId !== null) {

     

       251
       251
       +
       				url.searchParams.set("section_id", this.sectionId);

     

       252
       252
       +
       			}

     

       253
       253
       +
       

     

       254
       254
       +
       			const response = await fetch(url.toString());

     

       255
       255
       +
       

     

       256
       256
       +
       			if (!response.ok) {

     

       257
       257
       +
       				throw new Error("Failed to load recordings");

     

       258
       258
       +
       			}

     

       259
       259
       +
       

     

       260
       260
       +
       			const data: RecordingsData = await response.json();

     

       261
       261
       +
       			this.recordings = data.recordings;

     

       262
       262
       +
       			this.userVote = data.user_vote;

     

       263
       263
       +
       			this.voteThreshold = data.vote_threshold;

     

       264
       264
       +
       			this.winningRecordingId = data.winning_recording_id;

     

       265
       265
       +
       

     

       266
       266
       +
       			// Calculate time remaining for first recording

     

       267
       267
       +
       			if (this.recordings.length > 0 && this.recordings[0]) {

     

       268
       268
       +
       				const uploadedAt = this.recordings[0].created_at;

     

       269
       269
       +
       				const now = Date.now() / 1000;

     

       270
       270
       +
       				const elapsed = now - uploadedAt;

     

       271
       271
       +
       				const remaining = 30 * 60 - elapsed; // 30 minutes

     

       272
       272
       +
       

     

       273
       273
       +
       				if (remaining > 0) {

     

       274
       274
       +
       					const minutes = Math.floor(remaining / 60);

     

       275
       275
       +
       					const seconds = Math.floor(remaining % 60);

     

       276
       276
       +
       					this.timeRemaining = `${minutes}:${seconds.toString().padStart(2, "0")}`;

     

       277
       277
       +
       				} else {

     

       278
       278
       +
       					this.timeRemaining = "Auto-submitting...";

     

       279
       279
       +
       				}

     

       280
       280
       +
       			}

     

       281
       281
       +
       

     

       282
       282
       +
       			this.error = null;

     

       283
       283
       +
       		} catch (error) {

     

       284
       284
       +
       			this.error =

     

       285
       285
       +
       				error instanceof Error ? error.message : "Failed to load recordings";

     

       286
       286
       +
       		} finally {

     

       287
       287
       +
       			this.loadingInProgress = false;

     

       288
       288
       +
       		}

     

       289
       289
       +
       	}

     

       290
       290
       +
       

     

       291
       291
       +
       	private async handleVote(recordingId: string) {

     

       292
       292
       +
       		try {

     

       293
       293
       +
       			const response = await fetch(`/api/recordings/${recordingId}/vote`, {

     

       294
       294
       +
       				method: "POST",

     

       295
       295
       +
       			});

     

       296
       296
       +
       

     

       297
       297
       +
       			if (!response.ok) {

     

       298
       298
       +
       				throw new Error("Failed to vote");

     

       299
       299
       +
       			}

     

       300
       300
       +
       

     

       301
       301
       +
       			const data = await response.json();

     

       302
       302
       +
       

     

       303
       303
       +
       			// If a winner was selected, reload the page to show it in transcriptions

     

       304
       304
       +
       			if (data.winning_recording_id) {

     

       305
       305
       +
       				window.location.reload();

     

       306
       306
       +
       			} else {

     

       307
       307
       +
       				// Just reload recordings to show updated votes

     

       308
       308
       +
       				await this.loadRecordings();

     

       309
       309
       +
       			}

     

       310
       310
       +
       		} catch (error) {

     

       311
       311
       +
       			this.error =

     

       312
       312
       +
       				error instanceof Error ? error.message : "Failed to vote";

     

       313
       313
       +
       		}

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	private async handleDelete(recordingId: string) {

     

       317
       317
       +
       		if (!confirm("Delete this recording?")) {

     

       318
       318
       +
       			return;

     

       319
       319
       +
       		}

     

       320
       320
       +
       

     

       321
       321
       +
       		try {

     

       322
       322
       +
       			const response = await fetch(`/api/recordings/${recordingId}`, {

     

       323
       323
       +
       				method: "DELETE",

     

       324
       324
       +
       			});

     

       325
       325
       +
       

     

       326
       326
       +
       			if (!response.ok) {

     

       327
       327
       +
       				throw new Error("Failed to delete recording");

     

       328
       328
       +
       			}

     

       329
       329
       +
       

     

       330
       330
       +
       			await this.loadRecordings();

     

       331
       331
       +
       		} catch (error) {

     

       332
       332
       +
       			this.error =

     

       333
       333
       +
       				error instanceof Error ? error.message : "Failed to delete recording";

     

       334
       334
       +
       		}

     

       335
       335
       +
       	}

     

       336
       336
       +
       

     

       337
       337
       +
       	private formatTimeAgo(timestamp: number): string {

     

       338
       338
       +
       		const now = Date.now() / 1000;

     

       339
       339
       +
       		const diff = now - timestamp;

     

       340
       340
       +
       

     

       341
       341
       +
       		if (diff < 60) return "just now";

     

       342
       342
       +
       		if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;

     

       343
       343
       +
       		if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;

     

       344
       344
       +
       		return `${Math.floor(diff / 86400)}d ago`;

     

       345
       345
       +
       	}

     

       346
       346
       +
       

     

       347
       347
       +
       	override render() {

     

       348
       348
       +
       		return html`

     

       349
       349
       +
             <div class="container">

     

       350
       350
       +
               <h2>Pending Recordings - ${this.meetingTimeLabel}</h2>

     

       351
       351
       +
               <p class="info">

     

       352
       352
       +
                 Vote for the best quality recording. The winner will be automatically transcribed when 40% of class votes or after 30 minutes.

     

       353
       353
       +
               </p>

     

       354
       354
       +
       

     

       355
       355
       +
               ${this.error ? html`<div class="error">${this.error}</div>` : ""}

     

       356
       356
       +
       

     

       357
       357
       +
               ${

     

       358
       358
       +
       					this.recordings.length > 0

     

       359
       359
       +
       						? html`

     

       360
       360
       +
                   <div class="stats">

     

       361
       361
       +
                     <div class="stat">

     

       362
       362
       +
                       <div class="stat-label">Recordings</div>

     

       363
       363
       +
                       <div class="stat-value">${this.recordings.length}</div>

     

       364
       364
       +
                     </div>

     

       365
       365
       +
                     <div class="stat">

     

       366
       366
       +
                       <div class="stat-label">Vote Threshold</div>

     

       367
       367
       +
                       <div class="stat-value">${this.voteThreshold} votes</div>

     

       368
       368
       +
                     </div>

     

       369
       369
       +
                     <div class="stat">

     

       370
       370
       +
                       <div class="stat-label">Time Remaining</div>

     

       371
       371
       +
                       <div class="stat-value">${this.timeRemaining}</div>

     

       372
       372
       +
                     </div>

     

       373
       373
       +
                   </div>

     

       374
       374
       +
       

     

       375
       375
       +
                   <div class="recordings-list">

     

       376
       376
       +
                     ${this.recordings.map(

     

       377
       377
       +
       								(recording) => html`

     

       378
       378
       +
                       <div class="recording-card ${this.userVote === recording.id ? "voted" : ""} ${this.winningRecordingId === recording.id ? "winning" : ""}">

     

       379
       379
       +
                         <div class="recording-header">

     

       380
       380
       +
                           <div class="recording-info">

     

       381
       381
       +
                             <div class="recording-name">${recording.original_filename}</div>

     

       382
       382
       +
                             <div class="recording-meta">

     

       383
       383
       +
                               Uploaded ${this.formatTimeAgo(recording.created_at)}

     

       384
       384
       +
                             </div>

     

       385
       385
       +
                           </div>

     

       386
       386
       +
       

     

       387
       387
       +
                           <div class="vote-section">

     

       388
       388
       +
                             ${

     

       389
       389
       +
       												this.winningRecordingId === recording.id

     

       390
       390
       +
       													? html`<span class="winning-badge">✨ Selected</span>`

     

       391
       391
       +
       													: ""

     

       392
       392
       +
       											}

     

       393
       393
       +
                             

     

       394
       394
       +
                             <div class="vote-count">

     

       395
       395
       +
                               ${recording.vote_count} ${recording.vote_count === 1 ? "vote" : "votes"}

     

       396
       396
       +
                             </div>

     

       397
       397
       +
       

     

       398
       398
       +
                             <button

     

       399
       399
       +
                               class="vote-button ${this.userVote === recording.id ? "voted" : ""}"

     

       400
       400
       +
                               @click=${() => this.handleVote(recording.id)}

     

       401
       401
       +
                               ?disabled=${this.winningRecordingId !== null}

     

       402
       402
       +
                             >

     

       403
       403
       +
                               ${this.userVote === recording.id ? "✓ Voted" : "Vote"}

     

       404
       404
       +
                             </button>

     

       405
       405
       +
       

     

       406
       406
       +
                             <button

     

       407
       407
       +
                               class="delete-button"

     

       408
       408
       +
                               @click=${() => this.handleDelete(recording.id)}

     

       409
       409
       +
                               title="Delete recording"

     

       410
       410
       +
                             >

     

       411
       411
       +
                               🗑️

     

       412
       412
       +
                             </button>

     

       413
       413
       +
                           </div>

     

       414
       414
       +
                         </div>

     

       415
       415
       +
       

     

       416
       416
       +
                         <div class="audio-player">

     

       417
       417
       +
                           <audio controls preload="none">

     

       418
       418
       +
                             <source src="/api/transcriptions/${recording.id}/audio" type="audio/mpeg">

     

       419
       419
       +
                           </audio>

     

       420
       420
       +
                         </div>

     

       421
       421
       +
                       </div>

     

       422
       422
       +
                     `,

     

       423
       423
       +
       							)}

     

       424
       424
       +
                   </div>

     

       425
       425
       +
                 `

     

       426
       426
       +
       						: html`

     

       427
       427
       +
                   <div class="empty-state">

     

       428
       428
       +
                     <p>No recordings uploaded yet for this meeting time.</p>

     

       429
       429
       +
                     <p>Upload a recording to get started!</p>

     

       430
       430
       +
                   </div>

     

       431
       431
       +
                 `

     

       432
       432
       +
       				}

     

       433
       433
       +
             </div>

     

       434
       434
       +
           `;

     

       435
       435
       +
       	}

     

       436
       436
       +
       }

+70 -1

src/db/schema.ts

···

       1
       1
        
       import { Database } from "bun:sqlite";

     

       2
       2
        
       

     

       3
       3
        
       // Use test database when NODE_ENV is test

     

       4
       4
       -
       const dbPath = process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       4
       4
       +
       const dbPath =

     

       5
       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       5
       6
        
       export const db = new Database(dbPath);

     

       6
       7
        
       

     

       7
       8
        
       console.log(`[Database] Using database: ${dbPath}`);

     
···

       223
       224
        
             INSERT OR IGNORE INTO users (id, email, password_hash, name, avatar, role, created_at)

     

       224
       225
        
             VALUES (0, 'ghosty@thistle.internal', NULL, 'Ghosty', '👻', 'user', strftime('%s', 'now'));

     

       225
       226
        
           `,

     

       227
       227
       +
       	},

     

       228
       228
       +
       	{

     

       229
       229
       +
       		version: 2,

     

       230
       230
       +
       		name: "Add sections support to classes and class members",

     

       231
       231
       +
       		sql: `

     

       232
       232
       +
       			-- Add section_number to classes (nullable for existing classes)

     

       233
       233
       +
       			ALTER TABLE classes ADD COLUMN section_number TEXT;

     

       234
       234
       +
       

     

       235
       235
       +
       			-- Add section_id to class_members (nullable - NULL means default section)

     

       236
       236
       +
       			ALTER TABLE class_members ADD COLUMN section_id TEXT;

     

       237
       237
       +
       

     

       238
       238
       +
       			-- Create sections table to track all available sections for a class

     

       239
       239
       +
       			CREATE TABLE IF NOT EXISTS class_sections (

     

       240
       240
       +
       				id TEXT PRIMARY KEY,

     

       241
       241
       +
       				class_id TEXT NOT NULL,

     

       242
       242
       +
       				section_number TEXT NOT NULL,

     

       243
       243
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       244
       244
       +
       				FOREIGN KEY (class_id) REFERENCES classes(id) ON DELETE CASCADE,

     

       245
       245
       +
       				UNIQUE(class_id, section_number)

     

       246
       246
       +
       			);

     

       247
       247
       +
       

     

       248
       248
       +
       			CREATE INDEX IF NOT EXISTS idx_class_sections_class_id ON class_sections(class_id);

     

       249
       249
       +
       

     

       250
       250
       +
       			-- Add section_id to transcriptions to track which section uploaded it

     

       251
       251
       +
       			ALTER TABLE transcriptions ADD COLUMN section_id TEXT;

     

       252
       252
       +
       

     

       253
       253
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_section_id ON transcriptions(section_id);

     

       254
       254
       +
       		`,

     

       255
       255
       +
       	},

     

       256
       256
       +
       	{

     

       257
       257
       +
       		version: 3,

     

       258
       258
       +
       		name: "Add voting system for collaborative recording selection",

     

       259
       259
       +
       		sql: `

     

       260
       260
       +
       			-- Add vote count to transcriptions

     

       261
       261
       +
       			ALTER TABLE transcriptions ADD COLUMN vote_count INTEGER NOT NULL DEFAULT 0;

     

       262
       262
       +
       

     

       263
       263
       +
       			-- Add auto-submitted flag to track if transcription was auto-selected

     

       264
       264
       +
       			ALTER TABLE transcriptions ADD COLUMN auto_submitted BOOLEAN DEFAULT 0;

     

       265
       265
       +
       

     

       266
       266
       +
       			-- Create votes table to track who voted for which recording

     

       267
       267
       +
       			CREATE TABLE IF NOT EXISTS recording_votes (

     

       268
       268
       +
       				id TEXT PRIMARY KEY,

     

       269
       269
       +
       				transcription_id TEXT NOT NULL,

     

       270
       270
       +
       				user_id INTEGER NOT NULL,

     

       271
       271
       +
       				created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),

     

       272
       272
       +
       				FOREIGN KEY (transcription_id) REFERENCES transcriptions(id) ON DELETE CASCADE,

     

       273
       273
       +
       				FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

     

       274
       274
       +
       				UNIQUE(transcription_id, user_id)

     

       275
       275
       +
       			);

     

       276
       276
       +
       

     

       277
       277
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_transcription_id ON recording_votes(transcription_id);

     

       278
       278
       +
       			CREATE INDEX IF NOT EXISTS idx_recording_votes_user_id ON recording_votes(user_id);

     

       279
       279
       +
       		`,

     

       280
       280
       +
       	},

     

       281
       281
       +
       	{

     

       282
       282
       +
       		version: 4,

     

       283
       283
       +
       		name: "Add recording_date to transcriptions for chronological ordering",

     

       284
       284
       +
       		sql: `

     

       285
       285
       +
       			-- Add recording_date (timestamp when the recording was made, not uploaded)

     

       286
       286
       +
       			-- Defaults to created_at for existing records

     

       287
       287
       +
       			ALTER TABLE transcriptions ADD COLUMN recording_date INTEGER;

     

       288
       288
       +
       			

     

       289
       289
       +
       			-- Set recording_date to created_at for existing records

     

       290
       290
       +
       			UPDATE transcriptions SET recording_date = created_at WHERE recording_date IS NULL;

     

       291
       291
       +
       

     

       292
       292
       +
       			-- Create index for ordering by recording date

     

       293
       293
       +
       			CREATE INDEX IF NOT EXISTS idx_transcriptions_recording_date ON transcriptions(recording_date);

     

       294
       294
       +
       		`,

     

       226
       295
        
       	},

     

       227
       296
        
       ];

     

       228
       297

+213 -667

src/index.test.ts

···

       6
       6
        
       	expect,

     

       7
       7
        
       	test,

     

       8
       8
        
       } from "bun:test";

     

       9
       9
       -
       import { hashPasswordClient } from "./lib/client-auth";

     

       10
       9
        
       import type { Subprocess } from "bun";

     

       10
       10
       +
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
       11
        
       

     

       12
       12
        
       // Test server configuration

     

       13
       13
        
       const TEST_PORT = 3001;

     
···

       54
       54
        
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
       55
        
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
       56
        
       	const decoder = new TextDecoder();

     

       57
       57
       -
       	

     

       57
       57
       +
       

     

       58
       58
        
       	(async () => {

     

       59
       59
        
       		try {

     

       60
       60
        
       			while (true) {

     
···

       65
       65
        
       			}

     

       66
       66
        
       		} catch {}

     

       67
       67
        
       	})();

     

       68
       68
       -
       	

     

       68
       68
       +
       

     

       69
       69
        
       	(async () => {

     

       70
       70
        
       		try {

     

       71
       71
        
       			while (true) {

     
···

       118
       118
        
       	}

     

       119
       119
        
       

     

       120
       120
        
       	console.log("✓ Test server stopped and test database cleaned up");

     

       121
       121
       +
       });

     

       122
       122
       +
       

     

       123
       123
       +
       // Clear database between each test

     

       124
       124
       +
       beforeEach(async () => {

     

       125
       125
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       126
       +
       

     

       127
       127
       +
       	// Delete all data from tables (preserve schema)

     

       128
       128
       +
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
       129
       +
       	db.run("DELETE FROM email_change_tokens");

     

       130
       130
       +
       	db.run("DELETE FROM password_reset_tokens");

     

       131
       131
       +
       	db.run("DELETE FROM email_verification_tokens");

     

       132
       132
       +
       	db.run("DELETE FROM passkeys");

     

       133
       133
       +
       	db.run("DELETE FROM sessions");

     

       134
       134
       +
       	db.run("DELETE FROM subscriptions");

     

       135
       135
       +
       	db.run("DELETE FROM transcriptions");

     

       136
       136
       +
       	db.run("DELETE FROM class_members");

     

       137
       137
       +
       	db.run("DELETE FROM meeting_times");

     

       138
       138
       +
       	db.run("DELETE FROM classes");

     

       139
       139
       +
       	db.run("DELETE FROM class_waitlist");

     

       140
       140
       +
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       141
       +
       

     

       142
       142
       +
       	db.close();

     

       121
       143
        
       });

     

       122
       144
        
       

     

       123
       145
        
       // Test user credentials

     
···

       171
       193
        
       	});

     

       172
       194
        
       }

     

       173
       195
        
       

     

       196
       196
       +
       // Helper to register a user, verify email, and get session via login

     

       197
       197
       +
       async function registerAndLogin(user: {

     

       198
       198
       +
       	email: string;

     

       199
       199
       +
       	password: string;

     

       200
       200
       +
       	name?: string;

     

       201
       201
       +
       }): Promise<string> {

     

       202
       202
       +
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
       203
       +
       

     

       204
       204
       +
       	// Register the user

     

       205
       205
       +
       	const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       206
       206
       +
       		method: "POST",

     

       207
       207
       +
       		headers: { "Content-Type": "application/json" },

     

       208
       208
       +
       		body: JSON.stringify({

     

       209
       209
       +
       			email: user.email,

     

       210
       210
       +
       			password: hashedPassword,

     

       211
       211
       +
       			name: user.name || "Test User",

     

       212
       212
       +
       		}),

     

       213
       213
       +
       	});

     

       214
       214
       +
       

     

       215
       215
       +
       	if (registerResponse.status !== 201) {

     

       216
       216
       +
       		const error = await registerResponse.json();

     

       217
       217
       +
       		throw new Error(`Registration failed: ${JSON.stringify(error)}`);

     

       218
       218
       +
       	}

     

       219
       219
       +
       

     

       220
       220
       +
       	const registerData = await registerResponse.json();

     

       221
       221
       +
       	const userId = registerData.user.id;

     

       222
       222
       +
       

     

       223
       223
       +
       	// Mark email as verified directly in the database (test mode)

     

       224
       224
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       225
       225
       +
       	db.run("UPDATE users SET email_verified = 1 WHERE id = ?", [userId]);

     

       226
       226
       +
       	db.close();

     

       227
       227
       +
       

     

       228
       228
       +
       	// Now login to get a session

     

       229
       229
       +
       	const loginResponse = await fetch(`${BASE_URL}/api/auth/login`, {

     

       230
       230
       +
       		method: "POST",

     

       231
       231
       +
       		headers: { "Content-Type": "application/json" },

     

       232
       232
       +
       		body: JSON.stringify({

     

       233
       233
       +
       			email: user.email,

     

       234
       234
       +
       			password: hashedPassword,

     

       235
       235
       +
       		}),

     

       236
       236
       +
       	});

     

       237
       237
       +
       

     

       238
       238
       +
       	if (loginResponse.status !== 200) {

     

       239
       239
       +
       		const error = await loginResponse.json();

     

       240
       240
       +
       		throw new Error(`Login failed: ${JSON.stringify(error)}`);

     

       241
       241
       +
       	}

     

       242
       242
       +
       

     

       243
       243
       +
       	return extractSessionCookie(loginResponse);

     

       244
       244
       +
       }

     

       245
       245
       +
       

     

       246
       246
       +
       // Helper to add active subscription to a user

     

       247
       247
       +
       function addSubscription(userEmail: string): void {

     

       248
       248
       +
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       249
       +
       	const user = db

     

       250
       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       251
       +
       		.get(userEmail) as { id: number };

     

       252
       252
       +
       	if (!user) {

     

       253
       253
       +
       		db.close();

     

       254
       254
       +
       		throw new Error(`User ${userEmail} not found`);

     

       255
       255
       +
       	}

     

       256
       256
       +
       

     

       257
       257
       +
       	db.run(

     

       258
       258
       +
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
       260
       +
       	);

     

       261
       261
       +
       	db.close();

     

       262
       262
       +
       }

     

       263
       263
       +
       

     

       174
       264
        
       // All tests run against a fresh database, no cleanup needed

     

       175
       265
        
       

     

       176
       266
        
       describe("API Endpoints - Authentication", () => {

     
···

       191
       281
        
       				}),

     

       192
       282
        
       			});

     

       193
       283
        
       

     

       194
       194
       -
       			if (response.status !== 200) {

     

       284
       284
       +
       			if (response.status !== 201) {

     

       195
       285
        
       				const error = await response.json();

     

       196
       286
        
       				console.error("Registration failed:", response.status, error);

     

       197
       287
        
       			}

     

       198
       288
        
       

     

       199
       199
       -
       			expect(response.status).toBe(200);

     

       200
       200
       -
       			

     

       201
       201
       -
       			// Extract session before consuming response body

     

       202
       202
       -
       			const sessionCookie = extractSessionCookie(response);

     

       203
       203
       -
       			

     

       289
       289
       +
       			expect(response.status).toBe(201);

     

       290
       290
       +
       

     

       204
       291
        
       			const data = await response.json();

     

       205
       292
        
       			expect(data.user).toBeDefined();

     

       206
       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     

       207
       207
       -
       			expect(sessionCookie).toBeTruthy();

     

       294
       294
       +
       			expect(data.email_verification_required).toBe(true);

     

       208
       295
        
       		});

     

       209
       296
        
       

     

       210
       297
        
       		test("should reject registration with missing email", async () => {

     
···

       221
       308
        
       			expect(data.error).toBe("Email and password required");

     

       222
       309
        
       		});

     

       223
       310
        
       

     

       224
       224
       -
       		test(

     

       225
       225
       -
       			"should reject registration with invalid password format",

     

       226
       226
       -
       			async () => {

     

       227
       227
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       228
       228
       -
       					method: "POST",

     

       229
       229
       -
       					headers: { "Content-Type": "application/json" },

     

       230
       230
       -
       					body: JSON.stringify({

     

       231
       231
       -
       						email: TEST_USER.email,

     

       232
       232
       -
       						password: "short",

     

       233
       233
       -
       					}),

     

       234
       234
       -
       				});

     

       235
       235
       -
       

     

       236
       236
       -
       				expect(response.status).toBe(400);

     

       237
       237
       -
       				const data = await response.json();

     

       238
       238
       -
       				expect(data.error).toBe("Invalid password format");

     

       239
       239
       -
       			},

     

       240
       240
       -
       		);

     

       241
       241
       -
       

     

       242
       242
       -
       		test("should reject duplicate email registration", async () => {

     

       243
       243
       -
       			const hashedPassword = await clientHashPassword(

     

       244
       244
       -
       				TEST_USER.email,

     

       245
       245
       -
       				TEST_USER.password,

     

       246
       246
       -
       			);

     

       247
       247
       -
       

     

       248
       248
       -
       			// First registration

     

       249
       249
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       250
       250
       -
       				method: "POST",

     

       251
       251
       -
       				headers: { "Content-Type": "application/json" },

     

       252
       252
       -
       				body: JSON.stringify({

     

       253
       253
       -
       					email: TEST_USER.email,

     

       254
       254
       -
       					password: hashedPassword,

     

       255
       255
       -
       					name: TEST_USER.name,

     

       256
       256
       -
       				}),

     

       257
       257
       -
       			});

     

       258
       258
       -
       

     

       259
       259
       -
       			// Duplicate registration

     

       311
       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       260
       312
        
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       261
       313
        
       				method: "POST",

     

       262
       314
        
       				headers: { "Content-Type": "application/json" },

     

       263
       315
        
       				body: JSON.stringify({

     

       264
       316
        
       					email: TEST_USER.email,

     

       265
       265
       -
       					password: hashedPassword,

     

       266
       266
       -
       					name: TEST_USER.name,

     

       317
       317
       +
       					password: "short",

     

       267
       318
        
       				}),

     

       268
       319
        
       			});

     

       269
       320
        
       

     

       270
       321
        
       			expect(response.status).toBe(400);

     

       271
       322
        
       			const data = await response.json();

     

       272
       272
       -
       			expect(data.error).toBe("Email already registered");

     

       273
       273
       -
       		});

     

       274
       274
       -
       

     

       275
       275
       -
       		test("should enforce rate limiting on registration", async () => {

     

       276
       276
       -
       			const hashedPassword = await clientHashPassword(

     

       277
       277
       -
       				"test@example.com",

     

       278
       278
       -
       				"password",

     

       279
       279
       -
       			);

     

       280
       280
       -
       

     

       281
       281
       -
       			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       282
       282
       -
       			let rateLimitHit = false;

     

       283
       283
       -
       			for (let i = 0; i < 10; i++) {

     

       284
       284
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       285
       285
       -
       					method: "POST",

     

       286
       286
       -
       					headers: { "Content-Type": "application/json" },

     

       287
       287
       -
       					body: JSON.stringify({

     

       288
       288
       -
       						email: `test${i}@example.com`,

     

       289
       289
       -
       						password: hashedPassword,

     

       290
       290
       -
       					}),

     

       291
       291
       -
       				});

     

       292
       292
       -
       

     

       293
       293
       -
       				if (response.status === 429) {

     

       294
       294
       -
       					rateLimitHit = true;

     

       295
       295
       -
       					break;

     

       296
       296
       -
       				}

     

       297
       297
       -
       			}

     

       298
       298
       -
       

     

       299
       299
       -
       			// Verify that rate limiting was triggered

     

       300
       300
       -
       			expect(rateLimitHit).toBe(true);

     

       323
       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       301
       324
        
       		});

     

       302
       302
       -
       	});

     

       303
       325
        
       

     

       304
       304
       -
       	describe("POST /api/auth/login", () => {

     

       305
       305
       -
       		test("should login successfully with valid credentials", async () => {

     

       306
       306
       -
       			// Register user first

     

       326
       326
       +
       		test("should reject duplicate email registration", async () => {

     

       307
       327
        
       			const hashedPassword = await clientHashPassword(

     

       308
       328
        
       				TEST_USER.email,

     

       309
       329
        
       				TEST_USER.password,

     

       310
       330
        
       			);

     

       331
       331
       +
       

     

       332
       332
       +
       			// First registration

     

       311
       333
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       312
       334
        
       				method: "POST",

     

       313
       335
        
       				headers: { "Content-Type": "application/json" },

     
···

       318
       340
        
       				}),

     

       319
       341
        
       			});

     

       320
       342
        
       

     

       321
       321
       -
       			// Login

     

       322
       322
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       343
       343
       +
       			// Duplicate registration

     

       344
       344
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       323
       345
        
       				method: "POST",

     

       324
       346
        
       				headers: { "Content-Type": "application/json" },

     

       325
       347
        
       				body: JSON.stringify({

     

       326
       348
        
       					email: TEST_USER.email,

     

       327
       349
        
       					password: hashedPassword,

     

       350
       350
       +
       					name: TEST_USER.name,

     

       328
       351
        
       				}),

     

       329
       352
        
       			});

     

       330
       353
        
       

     

       331
       331
       -
       			expect(response.status).toBe(200);

     

       354
       354
       +
       			expect(response.status).toBe(409);

     

       332
       355
        
       			const data = await response.json();

     

       333
       333
       -
       			expect(data.user).toBeDefined();

     

       334
       334
       -
       			expect(data.user.email).toBe(TEST_USER.email);

     

       335
       335
       -
       			expect(extractSessionCookie(response)).toBeTruthy();

     

       356
       356
       +
       			expect(data.error).toBe("Email already registered");

     

       336
       357
        
       		});

     

       337
       358
        
       

     

       338
       338
       -
       		test("should reject login with invalid credentials", async () => {

     

       339
       339
       -
       			// Register user first

     

       359
       359
       +
       		test("should enforce rate limiting on registration", async () => {

     

       340
       360
        
       			const hashedPassword = await clientHashPassword(

     

       341
       341
       -
       				TEST_USER.email,

     

       342
       342
       -
       				TEST_USER.password,

     

       361
       361
       +
       				"ratelimit@example.com",

     

       362
       362
       +
       				"password",

     

       343
       363
        
       			);

     

       364
       364
       +
       

     

       365
       365
       +
       			// First registration succeeds

     

       344
       366
        
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       345
       367
        
       				method: "POST",

     

       346
       368
        
       				headers: { "Content-Type": "application/json" },

     

       347
       369
        
       				body: JSON.stringify({

     

       348
       348
       -
       					email: TEST_USER.email,

     

       370
       370
       +
       					email: "ratelimit@example.com",

     

       349
       371
        
       					password: hashedPassword,

     

       350
       372
        
       				}),

     

       351
       373
        
       			});

     

       352
       374
        
       

     

       353
       353
       -
       			// Login with wrong password

     

       354
       354
       -
       			const wrongPassword = await clientHashPassword(

     

       355
       355
       -
       				TEST_USER.email,

     

       356
       356
       -
       				"WrongPassword123!",

     

       357
       357
       -
       			);

     

       358
       358
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       359
       359
       -
       				method: "POST",

     

       360
       360
       -
       				headers: { "Content-Type": "application/json" },

     

       361
       361
       -
       				body: JSON.stringify({

     

       362
       362
       -
       					email: TEST_USER.email,

     

       363
       363
       -
       					password: wrongPassword,

     

       364
       364
       -
       				}),

     

       365
       365
       -
       			});

     

       366
       366
       -
       

     

       367
       367
       -
       			expect(response.status).toBe(401);

     

       368
       368
       -
       			const data = await response.json();

     

       369
       369
       -
       			expect(data.error).toBe("Invalid email or password");

     

       370
       370
       -
       		});

     

       371
       371
       -
       

     

       372
       372
       -
       		test("should reject login with missing fields", async () => {

     

       373
       373
       -
       			const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       374
       374
       -
       				method: "POST",

     

       375
       375
       -
       				headers: { "Content-Type": "application/json" },

     

       376
       376
       -
       				body: JSON.stringify({

     

       377
       377
       -
       					email: TEST_USER.email,

     

       378
       378
       -
       				}),

     

       379
       379
       -
       			});

     

       380
       380
       -
       

     

       381
       381
       -
       			expect(response.status).toBe(400);

     

       382
       382
       -
       			const data = await response.json();

     

       383
       383
       -
       			expect(data.error).toBe("Email and password required");

     

       384
       384
       -
       		});

     

       385
       385
       -
       

     

       386
       386
       -
       		test("should enforce rate limiting on login attempts", async () => {

     

       387
       387
       -
       			const hashedPassword = await clientHashPassword(

     

       388
       388
       -
       				TEST_USER.email,

     

       389
       389
       -
       				TEST_USER.password,

     

       390
       390
       -
       			);

     

       391
       391
       -
       

     

       392
       392
       -
       			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       375
       375
       +
       			// Try to register same email 10 more times (will fail with 400 but count toward rate limit)

     

       376
       376
       +
       			// Rate limit is 5 per 30 min from same IP

     

       393
       377
        
       			let rateLimitHit = false;

     

       394
       394
       -
       			for (let i = 0; i < 11; i++) {

     

       395
       395
       -
       				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       378
       378
       +
       			for (let i = 0; i < 10; i++) {

     

       379
       379
       +
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       396
       380
        
       					method: "POST",

     

       397
       381
        
       					headers: { "Content-Type": "application/json" },

     

       398
       382
        
       					body: JSON.stringify({

     

       399
       399
       -
       						email: TEST_USER.email,

     

       383
       383
       +
       						email: "ratelimit@example.com",

     

       400
       384
        
       						password: hashedPassword,

     

       401
       385
        
       					}),

     

       402
       386
        
       				});

     
···

       412
       396
        
       		});

     

       413
       397
        
       	});

     

       414
       398
        
       

     

       415
       415
       -
       	describe("POST /api/auth/logout", () => {

     

       416
       416
       -
       		test("should logout successfully", async () => {

     

       399
       399
       +
       	describe("POST /api/auth/login", () => {

     

       400
       400
       +
       		test("should login successfully with valid credentials", async () => {

     

       417
       401
        
       			// Register and login

     

       418
       418
       -
       			const hashedPassword = await clientHashPassword(

     

       419
       419
       -
       				TEST_USER.email,

     

       420
       420
       -
       				TEST_USER.password,

     

       421
       421
       -
       			);

     

       422
       422
       -
       			const loginResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       423
       423
       -
       				method: "POST",

     

       424
       424
       -
       				headers: { "Content-Type": "application/json" },

     

       425
       425
       -
       				body: JSON.stringify({

     

       426
       426
       -
       					email: TEST_USER.email,

     

       427
       427
       -
       					password: hashedPassword,

     

       428
       428
       -
       				}),

     

       429
       429
       -
       			});

     

       430
       430
       -
       			const sessionCookie = extractSessionCookie(loginResponse);

     

       431
       431
       -
       

     

       432
       432
       -
       			// Logout

     

       433
       433
       -
       			const response = await authRequest(

     

       434
       434
       -
       				`${BASE_URL}/api/auth/logout`,

     

       435
       435
       -
       				sessionCookie,

     

       436
       436
       -
       				{

     

       437
       437
       -
       					method: "POST",

     

       438
       438
       -
       				},

     

       439
       439
       -
       			);

     

       440
       440
       -
       

     

       441
       441
       -
       			expect(response.status).toBe(200);

     

       442
       442
       -
       			const data = await response.json();

     

       443
       443
       -
       			expect(data.success).toBe(true);

     

       444
       444
       -
       

     

       445
       445
       -
       			// Verify cookie is cleared

     

       446
       446
       -
       			const setCookie = response.headers.get("set-cookie");

     

       447
       447
       -
       			expect(setCookie).toContain("Max-Age=0");

     

       448
       448
       -
       		});

     

       449
       449
       -
       

     

       450
       450
       -
       		test("should logout even without valid session", async () => {

     

       451
       451
       -
       			const response = await fetch(`${BASE_URL}/api/auth/logout`, {

     

       452
       452
       -
       				method: "POST",

     

       453
       453
       -
       			});

     

       454
       454
       -
       

     

       455
       455
       -
       			expect(response.status).toBe(200);

     

       456
       456
       -
       			const data = await response.json();

     

       457
       457
       -
       			expect(data.success).toBe(true);

     

       458
       458
       -
       		});

     

       459
       459
       -
       	});

     

       460
       460
       -
       

     

       461
       461
       -
       	describe("GET /api/auth/me", () => {

     

       462
       462
       -
       		test(

     

       463
       463
       -
       			"should return current user info when authenticated",

     

       464
       464
       -
       			async () => {

     

       465
       465
       -
       				// Register user

     

       466
       466
       -
       				const hashedPassword = await clientHashPassword(

     

       467
       467
       -
       					TEST_USER.email,

     

       468
       468
       -
       					TEST_USER.password,

     

       469
       469
       -
       				);

     

       470
       470
       -
       				const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       471
       471
       -
       					method: "POST",

     

       472
       472
       -
       					headers: { "Content-Type": "application/json" },

     

       473
       473
       -
       					body: JSON.stringify({

     

       474
       474
       -
       						email: TEST_USER.email,

     

       475
       475
       -
       						password: hashedPassword,

     

       476
       476
       -
       						name: TEST_USER.name,

     

       477
       477
       -
       					}),

     

       478
       478
       -
       				});

     

       479
       479
       -
       				const sessionCookie = extractSessionCookie(registerResponse);

     

       480
       480
       -
       

     

       481
       481
       -
       				// Get current user

     

       482
       482
       -
       				const response = await authRequest(

     

       483
       483
       -
       					`${BASE_URL}/api/auth/me`,

     

       484
       484
       -
       					sessionCookie,

     

       485
       485
       -
       				);

     

       486
       486
       -
       

     

       487
       487
       -
       				expect(response.status).toBe(200);

     

       488
       488
       -
       				const data = await response.json();

     

       489
       489
       -
       				expect(data.email).toBe(TEST_USER.email);

     

       490
       490
       -
       				expect(data.name).toBe(TEST_USER.name);

     

       491
       491
       -
       				expect(data.role).toBeDefined();

     

       492
       492
       -
       			},

     

       493
       493
       -
       		);

     

       494
       494
       -
       

     

       495
       495
       -
       		test("should return 401 when not authenticated", async () => {

     

       496
       496
       -
       			const response = await fetch(`${BASE_URL}/api/auth/me`);

     

       497
       497
       -
       

     

       498
       498
       -
       			expect(response.status).toBe(401);

     

       499
       499
       -
       			const data = await response.json();

     

       500
       500
       -
       			expect(data.error).toBe("Not authenticated");

     

       501
       501
       -
       		});

     

       502
       502
       -
       

     

       503
       503
       -
       		test("should return 401 with invalid session", async () => {

     

       504
       504
       -
       			const response = await authRequest(

     

       505
       505
       -
       				`${BASE_URL}/api/auth/me`,

     

       506
       506
       -
       				"invalid-session",

     

       507
       507
       -
       			);

     

       508
       508
       -
       

     

       509
       509
       -
       			expect(response.status).toBe(401);

     

       510
       510
       -
       			const data = await response.json();

     

       511
       511
       -
       			expect(data.error).toBe("Invalid session");

     

       512
       512
       -
       		});

     

       513
       513
       -
       	});

     

       514
       514
       -
       });

     

       515
       515
       -
       

     

       516
       516
       -
       describe("API Endpoints - Session Management", () => {

     

       517
       517
       -
       	describe("GET /api/sessions", () => {

     

       518
       518
       -
       		test("should return user sessions", async () => {

     

       519
       519
       -
       			// Register user

     

       520
       520
       -
       			const hashedPassword = await clientHashPassword(

     

       521
       521
       -
       				TEST_USER.email,

     

       522
       522
       -
       				TEST_USER.password,

     

       523
       523
       -
       			);

     

       524
       524
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       525
       525
       -
       				method: "POST",

     

       526
       526
       -
       				headers: { "Content-Type": "application/json" },

     

       527
       527
       -
       				body: JSON.stringify({

     

       528
       528
       -
       					email: TEST_USER.email,

     

       529
       529
       -
       					password: hashedPassword,

     

       530
       530
       -
       				}),

     

       531
       531
       -
       			});

     

       532
       532
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       533
       533
       -
       

     

       534
       534
       -
       			// Get sessions

     

       535
       535
       -
       			const response = await authRequest(

     

       536
       536
       -
       				`${BASE_URL}/api/sessions`,

     

       537
       537
       -
       				sessionCookie,

     

       538
       538
       -
       			);

     

       539
       539
       -
       

     

       540
       540
       -
       			expect(response.status).toBe(200);

     

       541
       541
       -
       			const data = await response.json();

     

       542
       542
       -
       			expect(data.sessions).toBeDefined();

     

       543
       543
       -
       			expect(data.sessions.length).toBeGreaterThan(0);

     

       544
       544
       -
       			expect(data.sessions[0]).toHaveProperty("id");

     

       545
       545
       -
       			expect(data.sessions[0]).toHaveProperty("ip_address");

     

       546
       546
       -
       			expect(data.sessions[0]).toHaveProperty("user_agent");

     

       547
       547
       -
       		});

     

       548
       548
       -
       

     

       549
       549
       -
       		test("should require authentication", async () => {

     

       550
       550
       -
       			const response = await fetch(`${BASE_URL}/api/sessions`);

     

       551
       551
       -
       

     

       552
       552
       -
       			expect(response.status).toBe(401);

     

       553
       553
       -
       		});

     

       554
       554
       -
       	});

     

       555
       555
       -
       

     

       556
       556
       -
       	describe("DELETE /api/sessions", () => {

     

       557
       557
       -
       		test("should delete specific session", async () => {

     

       558
       558
       -
       			// Register user and create multiple sessions

     

       559
       559
       -
       			const hashedPassword = await clientHashPassword(

     

       560
       560
       -
       				TEST_USER.email,

     

       561
       561
       -
       				TEST_USER.password,

     

       562
       562
       -
       			);

     

       563
       563
       -
       			const session1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       564
       564
       -
       				method: "POST",

     

       565
       565
       -
       				headers: { "Content-Type": "application/json" },

     

       566
       566
       -
       				body: JSON.stringify({

     

       567
       567
       -
       					email: TEST_USER.email,

     

       568
       568
       -
       					password: hashedPassword,

     

       569
       569
       -
       				}),

     

       570
       570
       -
       			});

     

       571
       571
       -
       			const session1Cookie = extractSessionCookie(session1Response);

     

       572
       572
       -
       

     

       573
       573
       -
       			const session2Response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       574
       574
       -
       				method: "POST",

     

       575
       575
       -
       				headers: { "Content-Type": "application/json" },

     

       576
       576
       -
       				body: JSON.stringify({

     

       577
       577
       -
       					email: TEST_USER.email,

     

       578
       578
       -
       					password: hashedPassword,

     

       579
       579
       -
       				}),

     

       580
       580
       -
       			});

     

       581
       581
       -
       			const session2Cookie = extractSessionCookie(session2Response);

     

       582
       582
       -
       

     

       583
       583
       -
       			// Get sessions list

     

       584
       584
       -
       			const sessionsResponse = await authRequest(

     

       585
       585
       -
       				`${BASE_URL}/api/sessions`,

     

       586
       586
       -
       				session1Cookie,

     

       587
       587
       -
       			);

     

       588
       588
       -
       			const sessionsData = await sessionsResponse.json();

     

       589
       589
       -
       			const targetSessionId = sessionsData.sessions.find(

     

       590
       590
       -
       				(s: { id: string }) => s.id === session2Cookie,

     

       591
       591
       -
       			)?.id;

     

       592
       592
       -
       

     

       593
       593
       -
       			// Delete session 2

     

       594
       594
       -
       			const response = await authRequest(

     

       595
       595
       -
       				`${BASE_URL}/api/sessions`,

     

       596
       596
       -
       				session1Cookie,

     

       597
       597
       -
       				{

     

       598
       598
       -
       					method: "DELETE",

     

       599
       599
       -
       					headers: { "Content-Type": "application/json" },

     

       600
       600
       -
       					body: JSON.stringify({ sessionId: targetSessionId }),

     

       601
       601
       -
       				},

     

       602
       602
       -
       			);

     

       603
       603
       -
       

     

       604
       604
       -
       			expect(response.status).toBe(200);

     

       605
       605
       -
       			const data = await response.json();

     

       606
       606
       -
       			expect(data.success).toBe(true);

     

       607
       607
       -
       

     

       608
       608
       -
       			// Verify session 2 is deleted

     

       609
       609
       -
       			const verifyResponse = await authRequest(

     

       610
       610
       -
       				`${BASE_URL}/api/auth/me`,

     

       611
       611
       -
       				session2Cookie,

     

       612
       612
       -
       			);

     

       613
       613
       -
       			expect(verifyResponse.status).toBe(401);

     

       614
       614
       -
       		});

     

       615
       615
       -
       

     

       616
       616
       -
       		test("should not delete another user's session", async () => {

     

       617
       617
       -
       			// Register two users

     

       618
       618
       -
       			const hashedPassword1 = await clientHashPassword(

     

       619
       619
       -
       				TEST_USER.email,

     

       620
       620
       -
       				TEST_USER.password,

     

       621
       621
       -
       			);

     

       622
       622
       -
       			const user1Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       623
       623
       -
       				method: "POST",

     

       624
       624
       -
       				headers: { "Content-Type": "application/json" },

     

       625
       625
       -
       				body: JSON.stringify({

     

       626
       626
       -
       					email: TEST_USER.email,

     

       627
       627
       -
       					password: hashedPassword1,

     

       628
       628
       -
       				}),

     

       629
       629
       -
       			});

     

       630
       630
       -
       			const user1Cookie = extractSessionCookie(user1Response);

     

       631
       631
       -
       

     

       632
       632
       -
       			const hashedPassword2 = await clientHashPassword(

     

       633
       633
       -
       				TEST_USER_2.email,

     

       634
       634
       -
       				TEST_USER_2.password,

     

       635
       635
       -
       			);

     

       636
       636
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       637
       637
       -
       				method: "POST",

     

       638
       638
       -
       				headers: { "Content-Type": "application/json" },

     

       639
       639
       -
       				body: JSON.stringify({

     

       640
       640
       -
       					email: TEST_USER_2.email,

     

       641
       641
       -
       					password: hashedPassword2,

     

       642
       642
       -
       				}),

     

       643
       643
       -
       			});

     

       644
       644
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       645
       645
       -
       

     

       646
       646
       -
       			// Try to delete user2's session using user1's credentials

     

       647
       647
       -
       			const response = await authRequest(

     

       648
       648
       -
       				`${BASE_URL}/api/sessions`,

     

       649
       649
       -
       				user1Cookie,

     

       650
       650
       -
       				{

     

       651
       651
       -
       					method: "DELETE",

     

       652
       652
       -
       					headers: { "Content-Type": "application/json" },

     

       653
       653
       -
       					body: JSON.stringify({ sessionId: user2Cookie }),

     

       654
       654
       -
       				},

     

       655
       655
       -
       			);

     

       656
       656
       -
       

     

       657
       657
       -
       			expect(response.status).toBe(404);

     

       658
       658
       -
       		});

     

       659
       659
       -
       

     

       660
       660
       -
       		test("should not delete current session", async () => {

     

       661
       661
       -
       			// Register user

     

       662
       662
       -
       			const hashedPassword = await clientHashPassword(

     

       663
       663
       -
       				TEST_USER.email,

     

       664
       664
       -
       				TEST_USER.password,

     

       665
       665
       -
       			);

     

       666
       666
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       667
       667
       -
       				method: "POST",

     

       668
       668
       -
       				headers: { "Content-Type": "application/json" },

     

       669
       669
       -
       				body: JSON.stringify({

     

       670
       670
       -
       					email: TEST_USER.email,

     

       671
       671
       -
       					password: hashedPassword,

     

       672
       672
       -
       				}),

     

       673
       673
       -
       			});

     

       674
       674
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       402
       402
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       675
       403
        
       

     

       676
       404
        
       			// Try to delete own current session

     

       677
       405
        
       			const response = await authRequest(

     
···

       694
       422
        
       describe("API Endpoints - User Management", () => {

     

       695
       423
        
       	describe("DELETE /api/user", () => {

     

       696
       424
        
       		test("should delete user account", async () => {

     

       697
       697
       -
       			// Register user

     

       698
       698
       -
       			const hashedPassword = await clientHashPassword(

     

       699
       699
       -
       				TEST_USER.email,

     

       700
       700
       -
       				TEST_USER.password,

     

       701
       701
       -
       			);

     

       702
       702
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       703
       703
       -
       				method: "POST",

     

       704
       704
       -
       				headers: { "Content-Type": "application/json" },

     

       705
       705
       -
       				body: JSON.stringify({

     

       706
       706
       -
       					email: TEST_USER.email,

     

       707
       707
       -
       					password: hashedPassword,

     

       708
       708
       -
       				}),

     

       709
       709
       -
       			});

     

       710
       710
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       425
       425
       +
       			// Register and login

     

       426
       426
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       711
       427
        
       

     

       712
       428
        
       			// Delete account

     

       713
       429
        
       			const response = await authRequest(

     
···

       718
       434
        
       				},

     

       719
       435
        
       			);

     

       720
       436
        
       

     

       721
       721
       -
       			expect(response.status).toBe(200);

     

       722
       722
       -
       			const data = await response.json();

     

       723
       723
       -
       			expect(data.success).toBe(true);

     

       437
       437
       +
       			expect(response.status).toBe(204);

     

       724
       438
        
       

     

       725
       439
        
       			// Verify user is deleted

     

       726
       440
        
       			const verifyResponse = await authRequest(

     
···

       741
       455
        
       

     

       742
       456
        
       	describe("PUT /api/user/email", () => {

     

       743
       457
        
       		test("should update user email", async () => {

     

       744
       744
       -
       			// Register user

     

       745
       745
       -
       			const hashedPassword = await clientHashPassword(

     

       746
       746
       -
       				TEST_USER.email,

     

       747
       747
       -
       				TEST_USER.password,

     

       748
       748
       -
       			);

     

       749
       749
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       750
       750
       -
       				method: "POST",

     

       751
       751
       -
       				headers: { "Content-Type": "application/json" },

     

       752
       752
       -
       				body: JSON.stringify({

     

       753
       753
       -
       					email: TEST_USER.email,

     

       754
       754
       -
       					password: hashedPassword,

     

       755
       755
       -
       				}),

     

       756
       756
       -
       			});

     

       757
       757
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       458
       458
       +
       			// Register and login

     

       459
       459
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       758
       460
        
       

     

       759
       759
       -
       			// Update email

     

       461
       461
       +
       			// Update email - this creates a token but doesn't change email yet

     

       760
       462
        
       			const newEmail = "newemail@example.com";

     

       761
       463
        
       			const response = await authRequest(

     

       762
       464
        
       				`${BASE_URL}/api/user/email`,

     
···

       772
       474
        
       			const data = await response.json();

     

       773
       475
        
       			expect(data.success).toBe(true);

     

       774
       476
        
       

     

       477
       477
       +
       			// Manually complete the email change in the database (simulating verification)

     

       478
       478
       +
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       479
       +
       			const tokenData = db

     

       480
       480
       +
       				.query(

     

       481
       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       482
       +
       				)

     

       483
       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       485
       +
       				tokenData.new_email,

     

       486
       486
       +
       				tokenData.user_id,

     

       487
       487
       +
       			]);

     

       488
       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       489
       +
       				tokenData.user_id,

     

       490
       490
       +
       			]);

     

       491
       491
       +
       			db.close();

     

       492
       492
       +
       

     

       775
       493
        
       			// Verify email updated

     

       776
       494
        
       			const meResponse = await authRequest(

     

       777
       495
        
       				`${BASE_URL}/api/auth/me`,

     
···

       783
       501
        
       

     

       784
       502
        
       		test("should reject duplicate email", async () => {

     

       785
       503
        
       			// Register two users

     

       786
       786
       -
       			const hashedPassword1 = await clientHashPassword(

     

       787
       787
       -
       				TEST_USER.email,

     

       788
       788
       -
       				TEST_USER.password,

     

       789
       789
       -
       			);

     

       790
       790
       -
       			await fetch(`${BASE_URL}/api/auth/register`, {

     

       791
       791
       -
       				method: "POST",

     

       792
       792
       -
       				headers: { "Content-Type": "application/json" },

     

       793
       793
       -
       				body: JSON.stringify({

     

       794
       794
       -
       					email: TEST_USER.email,

     

       795
       795
       -
       					password: hashedPassword1,

     

       796
       796
       -
       				}),

     

       797
       797
       -
       			});

     

       798
       798
       -
       

     

       799
       799
       -
       			const hashedPassword2 = await clientHashPassword(

     

       800
       800
       -
       				TEST_USER_2.email,

     

       801
       801
       -
       				TEST_USER_2.password,

     

       802
       802
       -
       			);

     

       803
       803
       -
       			const user2Response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       804
       804
       -
       				method: "POST",

     

       805
       805
       -
       				headers: { "Content-Type": "application/json" },

     

       806
       806
       -
       				body: JSON.stringify({

     

       807
       807
       -
       					email: TEST_USER_2.email,

     

       808
       808
       -
       					password: hashedPassword2,

     

       809
       809
       -
       				}),

     

       810
       810
       -
       			});

     

       811
       811
       -
       			const user2Cookie = extractSessionCookie(user2Response);

     

       504
       504
       +
       			await registerAndLogin(TEST_USER);

     

       505
       505
       +
       			const user2Cookie = await registerAndLogin(TEST_USER_2);

     

       812
       506
        
       

     

       813
       507
        
       			// Try to update user2's email to user1's email

     

       814
       508
        
       			const response = await authRequest(

     
···

       821
       515
        
       				},

     

       822
       516
        
       			);

     

       823
       517
        
       

     

       824
       824
       -
       			expect(response.status).toBe(400);

     

       518
       518
       +
       			expect(response.status).toBe(409);

     

       825
       519
        
       			const data = await response.json();

     

       826
       520
        
       			expect(data.error).toBe("Email already in use");

     

       827
       521
        
       		});

     
···

       829
       523
        
       

     

       830
       524
        
       	describe("PUT /api/user/password", () => {

     

       831
       525
        
       		test("should update user password", async () => {

     

       832
       832
       -
       			// Register user

     

       833
       833
       -
       			const hashedPassword = await clientHashPassword(

     

       834
       834
       -
       				TEST_USER.email,

     

       835
       835
       -
       				TEST_USER.password,

     

       836
       836
       -
       			);

     

       837
       837
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       838
       838
       -
       				method: "POST",

     

       839
       839
       -
       				headers: { "Content-Type": "application/json" },

     

       840
       840
       -
       				body: JSON.stringify({

     

       841
       841
       -
       					email: TEST_USER.email,

     

       842
       842
       -
       					password: hashedPassword,

     

       843
       843
       -
       				}),

     

       844
       844
       -
       			});

     

       845
       845
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       526
       526
       +
       			// Register and login

     

       527
       527
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       846
       528
        
       

     

       847
       529
        
       			// Update password

     

       848
       530
        
       			const newPassword = await clientHashPassword(

     
···

       876
       558
        
       		});

     

       877
       559
        
       

     

       878
       560
        
       		test("should reject invalid password format", async () => {

     

       879
       879
       -
       			// Register user

     

       880
       880
       -
       			const hashedPassword = await clientHashPassword(

     

       881
       881
       -
       				TEST_USER.email,

     

       882
       882
       -
       				TEST_USER.password,

     

       883
       883
       -
       			);

     

       884
       884
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       885
       885
       -
       				method: "POST",

     

       886
       886
       -
       				headers: { "Content-Type": "application/json" },

     

       887
       887
       -
       				body: JSON.stringify({

     

       888
       888
       -
       					email: TEST_USER.email,

     

       889
       889
       -
       					password: hashedPassword,

     

       890
       890
       -
       				}),

     

       891
       891
       -
       			});

     

       892
       892
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       561
       561
       +
       			// Register and login

     

       562
       562
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       893
       563
        
       

     

       894
       564
        
       			// Try to update with invalid format

     

       895
       565
        
       			const response = await authRequest(

     
···

       910
       580
        
       

     

       911
       581
        
       	describe("PUT /api/user/name", () => {

     

       912
       582
        
       		test("should update user name", async () => {

     

       913
       913
       -
       			// Register user

     

       914
       914
       -
       			const hashedPassword = await clientHashPassword(

     

       915
       915
       -
       				TEST_USER.email,

     

       916
       916
       -
       				TEST_USER.password,

     

       917
       917
       -
       			);

     

       918
       918
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       919
       919
       -
       				method: "POST",

     

       920
       920
       -
       				headers: { "Content-Type": "application/json" },

     

       921
       921
       -
       				body: JSON.stringify({

     

       922
       922
       -
       					email: TEST_USER.email,

     

       923
       923
       -
       					password: hashedPassword,

     

       924
       924
       -
       					name: TEST_USER.name,

     

       925
       925
       -
       				}),

     

       926
       926
       -
       			});

     

       927
       927
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       583
       583
       +
       			// Register and login

     

       584
       584
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       928
       585
        
       

     

       929
       586
        
       			// Update name

     

       930
       587
        
       			const newName = "Updated Name";

     
···

       939
       596
        
       			);

     

       940
       597
        
       

     

       941
       598
        
       			expect(response.status).toBe(200);

     

       942
       942
       -
       			const data = await response.json();

     

       943
       943
       -
       			expect(data.success).toBe(true);

     

       944
       599
        
       

     

       945
       600
        
       			// Verify name updated

     

       946
       601
        
       			const meResponse = await authRequest(

     
···

       952
       607
        
       		});

     

       953
       608
        
       

     

       954
       609
        
       		test("should reject missing name", async () => {

     

       955
       955
       -
       			// Register user

     

       956
       956
       -
       			const hashedPassword = await clientHashPassword(

     

       957
       957
       -
       				TEST_USER.email,

     

       958
       958
       -
       				TEST_USER.password,

     

       959
       959
       -
       			);

     

       960
       960
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       961
       961
       -
       				method: "POST",

     

       962
       962
       -
       				headers: { "Content-Type": "application/json" },

     

       963
       963
       -
       				body: JSON.stringify({

     

       964
       964
       -
       					email: TEST_USER.email,

     

       965
       965
       -
       					password: hashedPassword,

     

       966
       966
       -
       				}),

     

       967
       967
       -
       			});

     

       968
       968
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       610
       610
       +
       			// Register and login

     

       611
       611
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       969
       612
        
       

     

       970
       613
        
       			const response = await authRequest(

     

       971
       614
        
       				`${BASE_URL}/api/user/name`,

     
···

       983
       626
        
       

     

       984
       627
        
       	describe("PUT /api/user/avatar", () => {

     

       985
       628
        
       		test("should update user avatar", async () => {

     

       986
       986
       -
       			// Register user

     

       987
       987
       -
       			const hashedPassword = await clientHashPassword(

     

       988
       988
       -
       				TEST_USER.email,

     

       989
       989
       -
       				TEST_USER.password,

     

       990
       990
       -
       			);

     

       991
       991
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       992
       992
       -
       				method: "POST",

     

       993
       993
       -
       				headers: { "Content-Type": "application/json" },

     

       994
       994
       -
       				body: JSON.stringify({

     

       995
       995
       -
       					email: TEST_USER.email,

     

       996
       996
       -
       					password: hashedPassword,

     

       997
       997
       -
       				}),

     

       998
       998
       -
       			});

     

       999
       999
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       629
       629
       +
       			// Register and login

     

       630
       630
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       1000
       631
        
       

     

       1001
       632
        
       			// Update avatar

     

       1002
       633
        
       			const newAvatar = "👨‍💻";

     
···

       1027
       658
        
       

     

       1028
       659
        
       describe("API Endpoints - Health", () => {

     

       1029
       660
        
       	describe("GET /api/health", () => {

     

       1030
       1030
       -
       		test(

     

       1031
       1031
       -
       			"should return service health status with details",

     

       1032
       1032
       -
       			async () => {

     

       1033
       1033
       -
       				const response = await fetch(`${BASE_URL}/api/health`);

     

       661
       661
       +
       		test("should return service health status with details", async () => {

     

       662
       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       1034
       663
        
       

     

       1035
       1035
       -
       				expect(response.status).toBe(200);

     

       1036
       1036
       -
       				const data = await response.json();

     

       1037
       1037
       -
       				expect(data).toHaveProperty("status");

     

       1038
       1038
       -
       				expect(data).toHaveProperty("timestamp");

     

       1039
       1039
       -
       				expect(data).toHaveProperty("services");

     

       1040
       1040
       -
       				expect(data.services).toHaveProperty("database");

     

       1041
       1041
       -
       				expect(data.services).toHaveProperty("whisper");

     

       1042
       1042
       -
       				expect(data.services).toHaveProperty("storage");

     

       1043
       1043
       -
       			},

     

       1044
       1044
       -
       		);

     

       664
       664
       +
       			expect(response.status).toBe(200);

     

       665
       665
       +
       			const data = await response.json();

     

       666
       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       672
       +
       		});

     

       1045
       673
        
       	});

     

       1046
       674
        
       });

     

       1047
       675
        
       

     

       1048
       676
        
       describe("API Endpoints - Transcriptions", () => {

     

       1049
       677
        
       	describe("GET /api/transcriptions", () => {

     

       1050
       678
        
       		test("should return user transcriptions", async () => {

     

       1051
       1051
       -
       			// Register user

     

       1052
       1052
       -
       			const hashedPassword = await clientHashPassword(

     

       1053
       1053
       -
       				TEST_USER.email,

     

       1054
       1054
       -
       				TEST_USER.password,

     

       1055
       1055
       -
       			);

     

       1056
       1056
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1057
       1057
       -
       				method: "POST",

     

       1058
       1058
       -
       				headers: { "Content-Type": "application/json" },

     

       1059
       1059
       -
       				body: JSON.stringify({

     

       1060
       1060
       -
       					email: TEST_USER.email,

     

       1061
       1061
       -
       					password: hashedPassword,

     

       1062
       1062
       -
       				}),

     

       1063
       1063
       -
       			});

     

       1064
       1064
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       679
       679
       +
       			// Register and login

     

       680
       680
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       681
       +
       

     

       682
       682
       +
       			// Add subscription

     

       683
       683
       +
       			addSubscription(TEST_USER.email);

     

       1065
       684
        
       

     

       1066
       685
        
       			// Get transcriptions

     

       1067
       686
        
       			const response = await authRequest(

     
···

       1084
       703
        
       

     

       1085
       704
        
       	describe("POST /api/transcriptions", () => {

     

       1086
       705
        
       		test("should upload audio file and start transcription", async () => {

     

       1087
       1087
       -
       			// Register user

     

       1088
       1088
       -
       			const hashedPassword = await clientHashPassword(

     

       1089
       1089
       -
       				TEST_USER.email,

     

       1090
       1090
       -
       				TEST_USER.password,

     

       1091
       1091
       -
       			);

     

       1092
       1092
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1093
       1093
       -
       				method: "POST",

     

       1094
       1094
       -
       				headers: { "Content-Type": "application/json" },

     

       1095
       1095
       -
       				body: JSON.stringify({

     

       1096
       1096
       -
       					email: TEST_USER.email,

     

       1097
       1097
       -
       					password: hashedPassword,

     

       1098
       1098
       -
       				}),

     

       1099
       1099
       -
       			});

     

       1100
       1100
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       706
       706
       +
       			// Register and login

     

       707
       707
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       708
       +
       

     

       709
       709
       +
       			// Add subscription

     

       710
       710
       +
       			addSubscription(TEST_USER.email);

     

       1101
       711
        
       

     

       1102
       712
        
       			// Create a test audio file

     

       1103
       713
        
       			const audioBlob = new Blob(["fake audio data"], { type: "audio/mp3" });

     
···

       1115
       725
        
       				},

     

       1116
       726
        
       			);

     

       1117
       727
        
       

     

       1118
       1118
       -
       			expect(response.status).toBe(200);

     

       728
       728
       +
       			expect(response.status).toBe(201);

     

       1119
       729
        
       			const data = await response.json();

     

       1120
       730
        
       			expect(data.id).toBeDefined();

     

       1121
       731
        
       			expect(data.message).toContain("Upload successful");

     

       1122
       732
        
       		});

     

       1123
       733
        
       

     

       1124
       734
        
       		test("should reject non-audio files", async () => {

     

       1125
       1125
       -
       			// Register user

     

       1126
       1126
       -
       			const hashedPassword = await clientHashPassword(

     

       1127
       1127
       -
       				TEST_USER.email,

     

       1128
       1128
       -
       				TEST_USER.password,

     

       1129
       1129
       -
       			);

     

       1130
       1130
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1131
       1131
       -
       				method: "POST",

     

       1132
       1132
       -
       				headers: { "Content-Type": "application/json" },

     

       1133
       1133
       -
       				body: JSON.stringify({

     

       1134
       1134
       -
       					email: TEST_USER.email,

     

       1135
       1135
       -
       					password: hashedPassword,

     

       1136
       1136
       -
       				}),

     

       1137
       1137
       -
       			});

     

       1138
       1138
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       735
       735
       +
       			// Register and login

     

       736
       736
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       737
       +
       

     

       738
       738
       +
       			// Add subscription

     

       739
       739
       +
       			addSubscription(TEST_USER.email);

     

       1139
       740
        
       

     

       1140
       741
        
       			// Try to upload non-audio file

     

       1141
       742
        
       			const textBlob = new Blob(["text file"], { type: "text/plain" });

     
···

       1155
       756
        
       		});

     

       1156
       757
        
       

     

       1157
       758
        
       		test("should reject files exceeding size limit", async () => {

     

       1158
       1158
       -
       			// Register user

     

       1159
       1159
       -
       			const hashedPassword = await clientHashPassword(

     

       1160
       1160
       -
       				TEST_USER.email,

     

       1161
       1161
       -
       				TEST_USER.password,

     

       1162
       1162
       -
       			);

     

       1163
       1163
       -
       			const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1164
       1164
       -
       				method: "POST",

     

       1165
       1165
       -
       				headers: { "Content-Type": "application/json" },

     

       1166
       1166
       -
       				body: JSON.stringify({

     

       1167
       1167
       -
       					email: TEST_USER.email,

     

       1168
       1168
       -
       					password: hashedPassword,

     

       1169
       1169
       -
       				}),

     

       1170
       1170
       -
       			});

     

       1171
       1171
       -
       			const sessionCookie = extractSessionCookie(registerResponse);

     

       759
       759
       +
       			// Register and login

     

       760
       760
       +
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       761
       +
       

     

       762
       762
       +
       			// Add subscription

     

       763
       763
       +
       			addSubscription(TEST_USER.email);

     

       1172
       764
        
       

     

       1173
       765
        
       			// Create a file larger than 100MB (the actual limit)

     

       1174
       766
        
       			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], {

     
···

       1212
       804
        
       	let userId: number;

     

       1213
       805
        
       

     

       1214
       806
        
       	beforeEach(async () => {

     

       1215
       1215
       -
       

     

       1216
       807
        
       		// Create admin user

     

       1217
       1217
       -
       		const adminHash = await clientHashPassword(

     

       1218
       1218
       -
       			TEST_ADMIN.email,

     

       1219
       1219
       -
       			TEST_ADMIN.password,

     

       1220
       1220
       -
       		);

     

       1221
       1221
       -
       		const adminResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1222
       1222
       -
       			method: "POST",

     

       1223
       1223
       -
       			headers: { "Content-Type": "application/json" },

     

       1224
       1224
       -
       			body: JSON.stringify({

     

       1225
       1225
       -
       				email: TEST_ADMIN.email,

     

       1226
       1226
       -
       				password: adminHash,

     

       1227
       1227
       -
       				name: TEST_ADMIN.name,

     

       1228
       1228
       -
       			}),

     

       1229
       1229
       -
       		});

     

       1230
       1230
       -
       		adminCookie = extractSessionCookie(adminResponse);

     

       808
       808
       +
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       1231
       809
        
       

     

       1232
       810
        
       		// Manually set admin role in database

     

       811
       811
       +
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       1233
       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     

       1234
       813
        
       			TEST_ADMIN.email,

     

       1235
       814
        
       		]);

     

       1236
       815
        
       

     

       1237
       816
        
       		// Create regular user

     

       1238
       1238
       -
       		const userHash = await clientHashPassword(

     

       1239
       1239
       -
       			TEST_USER.email,

     

       1240
       1240
       -
       			TEST_USER.password,

     

       1241
       1241
       -
       		);

     

       1242
       1242
       -
       		const userResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1243
       1243
       -
       			method: "POST",

     

       1244
       1244
       -
       			headers: { "Content-Type": "application/json" },

     

       1245
       1245
       -
       			body: JSON.stringify({

     

       1246
       1246
       -
       				email: TEST_USER.email,

     

       1247
       1247
       -
       				password: userHash,

     

       1248
       1248
       -
       				name: TEST_USER.name,

     

       1249
       1249
       -
       			}),

     

       1250
       1250
       -
       		});

     

       1251
       1251
       -
       		userCookie = extractSessionCookie(userResponse);

     

       817
       817
       +
       		userCookie = await registerAndLogin(TEST_USER);

     

       1252
       818
        
       

     

       1253
       819
        
       		// Get user ID

     

       1254
       820
        
       		const userIdResult = db

     

       1255
       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       1256
       822
        
       			.get(TEST_USER.email);

     

       1257
       823
        
       		userId = userIdResult?.id;

     

       824
       824
       +
       

     

       825
       825
       +
       		db.close();

     

       1258
       826
        
       	});

     

       1259
       827
        
       

     

       1260
       828
        
       	describe("GET /api/admin/users", () => {

     
···

       1318
       886
        
       				},

     

       1319
       887
        
       			);

     

       1320
       888
        
       

     

       1321
       1321
       -
       			expect(response.status).toBe(200);

     

       1322
       1322
       -
       			const data = await response.json();

     

       1323
       1323
       -
       			expect(data.success).toBe(true);

     

       889
       889
       +
       			expect(response.status).toBe(204);

     

       1324
       890
        
       

     

       1325
       891
        
       			// Verify user is deleted

     

       1326
       892
        
       			const verifyResponse = await authRequest(

     
···

       1356
       922
        
       			);

     

       1357
       923
        
       

     

       1358
       924
        
       			expect(response.status).toBe(200);

     

       1359
       1359
       -
       			const data = await response.json();

     

       1360
       1360
       -
       			expect(data.success).toBe(true);

     

       1361
       925
        
       

     

       1362
       926
        
       			// Verify role updated

     

       1363
       927
        
       			const meResponse = await authRequest(

     
···

       1470
       1034
        
       				},

     

       1471
       1035
        
       			);

     

       1472
       1036
        
       

     

       1473
       1473
       -
       			expect(response.status).toBe(400);

     

       1037
       1037
       +
       			expect(response.status).toBe(409);

     

       1474
       1038
        
       			const data = await response.json();

     

       1475
       1039
        
       			expect(data.error).toBe("Email already in use");

     

       1476
       1040
        
       		});

     
···

       1499
       1063
        
       				},

     

       1500
       1064
        
       			);

     

       1501
       1065
        
       

     

       1502
       1502
       -
       			expect(response.status).toBe(200);

     

       1503
       1503
       -
       			const data = await response.json();

     

       1504
       1504
       -
       			expect(data.success).toBe(true);

     

       1066
       1066
       +
       			expect(response.status).toBe(204);

     

       1505
       1067
        
       

     

       1506
       1068
        
       			// Verify sessions are deleted

     

       1507
       1069
        
       			const verifyResponse = await authRequest(

     
···

       1517
       1079
        
       	let sessionCookie: string;

     

       1518
       1080
        
       

     

       1519
       1081
        
       	beforeEach(async () => {

     

       1520
       1520
       -
       

     

       1521
       1521
       -
       		// Register user

     

       1522
       1522
       -
       		const hashedPassword = await clientHashPassword(

     

       1523
       1523
       -
       			TEST_USER.email,

     

       1524
       1524
       -
       			TEST_USER.password,

     

       1525
       1525
       -
       		);

     

       1526
       1526
       -
       		const registerResponse = await fetch(`${BASE_URL}/api/auth/register`, {

     

       1527
       1527
       -
       			method: "POST",

     

       1528
       1528
       -
       			headers: { "Content-Type": "application/json" },

     

       1529
       1529
       -
       			body: JSON.stringify({

     

       1530
       1530
       -
       				email: TEST_USER.email,

     

       1531
       1531
       -
       				password: hashedPassword,

     

       1532
       1532
       -
       			}),

     

       1533
       1533
       -
       		});

     

       1534
       1534
       -
       		sessionCookie = extractSessionCookie(registerResponse);

     

       1082
       1082
       +
       		// Register and login

     

       1083
       1083
       +
       		sessionCookie = await registerAndLogin(TEST_USER);

     

       1535
       1084
        
       	});

     

       1536
       1085
        
       

     

       1537
       1086
        
       	describe("GET /api/passkeys", () => {

     
···

       1555
       1104
        
       	});

     

       1556
       1105
        
       

     

       1557
       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1558
       1558
       -
       		test(

     

       1559
       1559
       -
       			"should return registration options for authenticated user",

     

       1560
       1560
       -
       			async () => {

     

       1561
       1561
       -
       				const response = await authRequest(

     

       1562
       1562
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1563
       1563
       -
       					sessionCookie,

     

       1564
       1564
       -
       					{

     

       1565
       1565
       -
       						method: "POST",

     

       1566
       1566
       -
       					},

     

       1567
       1567
       -
       				);

     

       1107
       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       1108
       +
       			const response = await authRequest(

     

       1109
       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       1110
       +
       				sessionCookie,

     

       1111
       1111
       +
       				{

     

       1112
       1112
       +
       					method: "POST",

     

       1113
       1113
       +
       				},

     

       1114
       1114
       +
       			);

     

       1568
       1115
        
       

     

       1569
       1569
       -
       				expect(response.status).toBe(200);

     

       1570
       1570
       -
       				const data = await response.json();

     

       1571
       1571
       -
       				expect(data).toHaveProperty("challenge");

     

       1572
       1572
       -
       				expect(data).toHaveProperty("rp");

     

       1573
       1573
       -
       				expect(data).toHaveProperty("user");

     

       1574
       1574
       -
       			},

     

       1575
       1575
       -
       		);

     

       1116
       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       1117
       +
       			const data = await response.json();

     

       1118
       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       1121
       +
       		});

     

       1576
       1122
        
       

     

       1577
       1123
        
       		test("should require authentication", async () => {

     

       1578
       1124
        
       			const response = await fetch(

+814 -374

src/index.ts

···

       48
       48
        
       	getClassById,

     

       49
       49
        
       	getClassesForUser,

     

       50
       50
        
       	getClassMembers,

     

       51
       51
       +
       	getClassSections,

     

       52
       52
       +
       	getMeetingById,

     

       51
       53
        
       	getMeetingTimesForClass,

     

       52
       54
        
       	getTranscriptionsForClass,

     

       55
       55
       +
       	getUserSection,

     

       53
       56
        
       	isUserEnrolledInClass,

     

       54
       57
        
       	joinClass,

     

       55
       58
        
       	removeUserFromClass,

     

       56
       59
        
       	searchClassesByCourseCode,

     

       57
       60
        
       	toggleClassArchive,

     

       58
       61
        
       	updateMeetingTime,

     

       62
       62
       +
       	createClassSection,

     

       59
       63
        
       } from "./lib/classes";

     

       60
       64
        
       import { sendEmail } from "./lib/email";

     

       61
       65
        
       import {

     
···

       87
       91
        
       	type TranscriptionUpdate,

     

       88
       92
        
       	WhisperServiceManager,

     

       89
       93
        
       } from "./lib/transcription";

     

       94
       94
       +
       import {

     

       95
       95
       +
       	findMatchingMeetingTime,

     

       96
       96
       +
       	getDayName,

     

       97
       97
       +
       } from "./lib/audio-metadata";

     

       98
       98
       +
       import {

     

       99
       99
       +
       	checkAutoSubmit,

     

       100
       100
       +
       	deletePendingRecording,

     

       101
       101
       +
       	getEnrolledUserCount,

     

       102
       102
       +
       	getPendingRecordings,

     

       103
       103
       +
       	getUserVoteForMeeting,

     

       104
       104
       +
       	markAsAutoSubmitted,

     

       105
       105
       +
       	removeVote,

     

       106
       106
       +
       	voteForRecording,

     

       107
       107
       +
       } from "./lib/voting";

     

       90
       108
        
       import {

     

       91
       109
        
       	validateClassId,

     

       92
       110
        
       	validateCourseCode,

     
···

       174
       192
        
       	email: string,

     

       175
       193
        
       ): Promise<void> {

     

       176
       194
        
       	// Skip Polar sync in test mode

     

       177
       177
       -
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_POLAR_SYNC === "true") {

     

       195
       195
       +
       	if (

     

       196
       196
       +
       		process.env.NODE_ENV === "test" ||

     

       197
       197
       +
       		process.env.SKIP_POLAR_SYNC === "true"

     

       198
       198
       +
       	) {

     

       178
       199
        
       		return;

     

       179
       200
        
       	}

     

       180
       201
        
       

     
···

       304
       325
        
       );

     

       305
       326
        
       

     

       306
       327
        
       const server = Bun.serve({

     

       307
       307
       -
       	port: process.env.NODE_ENV === "test" 

     

       308
       308
       -
       		? 3001 

     

       309
       309
       -
       		: (process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000),

     

       328
       328
       +
       	port:

     

       329
       329
       +
       		process.env.NODE_ENV === "test"

     

       330
       330
       +
       			? 3001

     

       331
       331
       +
       			: process.env.PORT

     

       332
       332
       +
       				? Number.parseInt(process.env.PORT, 10)

     

       333
       333
       +
       				: 3000,

     

       310
       334
        
       	idleTimeout: 120, // 120 seconds for SSE connections

     

       311
       335
        
       	routes: {

     

       312
       336
        
       		"/": indexHTML,

     
···

       399
       423
        
       							email_verification_required: true,

     

       400
       424
        
       							verification_code_sent_at: sentAt,

     

       401
       425
        
       						},

     

       402
       402
       -
       						{ status: 200 },

     

       426
       426
       +
       						{ status: 201 },

     

       403
       427
        
       					);

     

       404
       428
        
       				} catch (err: unknown) {

     

       405
       429
        
       					const error = err as { message?: string };

     

       406
       430
        
       					if (error.message?.includes("UNIQUE constraint failed")) {

     

       407
       431
        
       						return Response.json(

     

       408
       432
        
       							{ error: "Email already registered" },

     

       409
       409
       -
       							{ status: 400 },

     

       433
       433
       +
       							{ status: 409 },

     

       410
       434
        
       						);

     

       411
       435
        
       					}

     

       412
       436
        
       					console.error("[Auth] Registration error:", err);

     
···

       869
       893
        
       		},

     

       870
       894
        
       		"/api/auth/me": {

     

       871
       895
        
       			GET: (req) => {

     

       872
       872
       -
       				const sessionId = getSessionFromRequest(req);

     

       873
       873
       -
       				if (!sessionId) {

     

       874
       874
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       875
       875
       -
       				}

     

       876
       876
       -
       				const user = getUserBySession(sessionId);

     

       877
       877
       -
       				if (!user) {

     

       878
       878
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       879
       879
       -
       				}

     

       896
       896
       +
       				try {

     

       897
       897
       +
       					const user = requireAuth(req);

     

       880
       898
        
       

     

       881
       881
       -
       				// Check subscription status

     

       882
       882
       -
       				const subscription = db

     

       883
       883
       -
       					.query<{ status: string }, [number]>(

     

       884
       884
       -
       						"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       885
       885
       -
       					)

     

       886
       886
       -
       					.get(user.id);

     

       899
       899
       +
       					// Check subscription status

     

       900
       900
       +
       					const subscription = db

     

       901
       901
       +
       						.query<{ status: string }, [number]>(

     

       902
       902
       +
       							"SELECT status FROM subscriptions WHERE user_id = ? AND status IN ('active', 'trialing', 'past_due') ORDER BY created_at DESC LIMIT 1",

     

       903
       903
       +
       						)

     

       904
       904
       +
       						.get(user.id);

     

       887
       905
        
       

     

       888
       888
       -
       				// Get notification preferences

     

       889
       889
       -
       				const prefs = db

     

       890
       890
       -
       					.query<{ email_notifications_enabled: number }, [number]>(

     

       891
       891
       -
       						"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       892
       892
       -
       					)

     

       893
       893
       -
       					.get(user.id);

     

       906
       906
       +
       					// Get notification preferences

     

       907
       907
       +
       					const prefs = db

     

       908
       908
       +
       						.query<{ email_notifications_enabled: number }, [number]>(

     

       909
       909
       +
       							"SELECT email_notifications_enabled FROM users WHERE id = ?",

     

       910
       910
       +
       						)

     

       911
       911
       +
       						.get(user.id);

     

       894
       912
        
       

     

       895
       895
       -
       				return Response.json({

     

       896
       896
       -
       					email: user.email,

     

       897
       897
       -
       					name: user.name,

     

       898
       898
       -
       					avatar: user.avatar,

     

       899
       899
       -
       					created_at: user.created_at,

     

       900
       900
       -
       					role: user.role,

     

       901
       901
       -
       					has_subscription: !!subscription,

     

       902
       902
       -
       					email_verified: isEmailVerified(user.id),

     

       903
       903
       -
       					email_notifications_enabled: prefs?.email_notifications_enabled === 1,

     

       904
       904
       -
       				});

     

       913
       913
       +
       					return Response.json({

     

       914
       914
       +
       						email: user.email,

     

       915
       915
       +
       						name: user.name,

     

       916
       916
       +
       						avatar: user.avatar,

     

       917
       917
       +
       						created_at: user.created_at,

     

       918
       918
       +
       						role: user.role,

     

       919
       919
       +
       						has_subscription: !!subscription,

     

       920
       920
       +
       						email_verified: isEmailVerified(user.id),

     

       921
       921
       +
       						email_notifications_enabled:

     

       922
       922
       +
       							prefs?.email_notifications_enabled === 1,

     

       923
       923
       +
       					});

     

       924
       924
       +
       				} catch (err) {

     

       925
       925
       +
       					return handleError(err);

     

       926
       926
       +
       				}

     

       905
       927
        
       			},

     

       906
       928
        
       		},

     

       907
       929
        
       		"/api/passkeys/register/options": {

     
···

       1067
       1089
        
       					}

     

       1068
       1090
        
       

     

       1069
       1091
        
       					updatePasskeyName(passkeyId, user.id, name);

     

       1070
       1070
       -
       					return Response.json({ success: true });

     

       1092
       1092
       +
       					return new Response(null, { status: 204 });

     

       1071
       1093
        
       				} catch (err) {

     

       1072
       1094
        
       					return handleError(err);

     

       1073
       1095
        
       				}

     
···

       1083
       1105
        
       

     

       1084
       1106
        
       					const passkeyId = req.params.id;

     

       1085
       1107
        
       					deletePasskey(passkeyId, user.id);

     

       1086
       1086
       -
       					return Response.json({ success: true });

     

       1108
       1108
       +
       					return new Response(null, { status: 204 });

     

       1087
       1109
        
       				} catch (err) {

     

       1088
       1110
        
       					return handleError(err);

     

       1089
       1111
        
       				}

     
···

       1091
       1113
        
       		},

     

       1092
       1114
        
       		"/api/sessions": {

     

       1093
       1115
        
       			GET: (req) => {

     

       1094
       1094
       -
       				const sessionId = getSessionFromRequest(req);

     

       1095
       1095
       -
       				if (!sessionId) {

     

       1096
       1096
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1097
       1097
       -
       				}

     

       1098
       1098
       -
       				const user = getUserBySession(sessionId);

     

       1099
       1099
       -
       				if (!user) {

     

       1100
       1100
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1116
       1116
       +
       				try {

     

       1117
       1117
       +
       					const sessionId = getSessionFromRequest(req);

     

       1118
       1118
       +
       					if (!sessionId) {

     

       1119
       1119
       +
       						return Response.json(

     

       1120
       1120
       +
       							{ error: "Not authenticated" },

     

       1121
       1121
       +
       							{ status: 401 },

     

       1122
       1122
       +
       						);

     

       1123
       1123
       +
       					}

     

       1124
       1124
       +
       					const user = getUserBySession(sessionId);

     

       1125
       1125
       +
       					if (!user) {

     

       1126
       1126
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1127
       1127
       +
       					}

     

       1128
       1128
       +
       					const sessions = getUserSessionsForUser(user.id);

     

       1129
       1129
       +
       					return Response.json({

     

       1130
       1130
       +
       						sessions: sessions.map((s) => ({

     

       1131
       1131
       +
       							id: s.id,

     

       1132
       1132
       +
       							ip_address: s.ip_address,

     

       1133
       1133
       +
       							user_agent: s.user_agent,

     

       1134
       1134
       +
       							created_at: s.created_at,

     

       1135
       1135
       +
       							expires_at: s.expires_at,

     

       1136
       1136
       +
       							is_current: s.id === sessionId,

     

       1137
       1137
       +
       						})),

     

       1138
       1138
       +
       					});

     

       1139
       1139
       +
       				} catch (err) {

     

       1140
       1140
       +
       					return handleError(err);

     

       1101
       1141
        
       				}

     

       1102
       1102
       -
       				const sessions = getUserSessionsForUser(user.id);

     

       1103
       1103
       -
       				return Response.json({

     

       1104
       1104
       -
       					sessions: sessions.map((s) => ({

     

       1105
       1105
       -
       						id: s.id,

     

       1106
       1106
       -
       						ip_address: s.ip_address,

     

       1107
       1107
       -
       						user_agent: s.user_agent,

     

       1108
       1108
       -
       						created_at: s.created_at,

     

       1109
       1109
       -
       						expires_at: s.expires_at,

     

       1110
       1110
       -
       						is_current: s.id === sessionId,

     

       1111
       1111
       -
       					})),

     

       1112
       1112
       -
       				});

     

       1113
       1142
        
       			},

     

       1114
       1143
        
       			DELETE: async (req) => {

     

       1115
       1115
       -
       				const currentSessionId = getSessionFromRequest(req);

     

       1116
       1116
       -
       				if (!currentSessionId) {

     

       1117
       1117
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1118
       1118
       -
       				}

     

       1119
       1119
       -
       				const user = getUserBySession(currentSessionId);

     

       1120
       1120
       -
       				if (!user) {

     

       1121
       1121
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1122
       1122
       -
       				}

     

       1144
       1144
       +
       				try {

     

       1145
       1145
       +
       					const currentSessionId = getSessionFromRequest(req);

     

       1146
       1146
       +
       					if (!currentSessionId) {

     

       1147
       1147
       +
       						return Response.json(

     

       1148
       1148
       +
       							{ error: "Not authenticated" },

     

       1149
       1149
       +
       							{ status: 401 },

     

       1150
       1150
       +
       						);

     

       1151
       1151
       +
       					}

     

       1152
       1152
       +
       					const user = getUserBySession(currentSessionId);

     

       1153
       1153
       +
       					if (!user) {

     

       1154
       1154
       +
       						return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1155
       1155
       +
       					}

     

       1123
       1156
        
       

     

       1124
       1124
       -
       				const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1125
       1125
       -
       					ip: { max: 20, windowSeconds: 60 * 60 },

     

       1126
       1126
       -
       				});

     

       1127
       1127
       -
       				if (rateLimitError) return rateLimitError;

     

       1157
       1157
       +
       					const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1158
       1158
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       1159
       1159
       +
       					});

     

       1160
       1160
       +
       					if (rateLimitError) return rateLimitError;

     

       1128
       1161
        
       

     

       1129
       1129
       -
       				const body = await req.json();

     

       1130
       1130
       -
       				const targetSessionId = body.sessionId;

     

       1131
       1131
       -
       				if (!targetSessionId) {

     

       1132
       1132
       -
       					return Response.json(

     

       1133
       1133
       -
       						{ error: "Session ID required" },

     

       1134
       1134
       -
       						{ status: 400 },

     

       1135
       1135
       -
       					);

     

       1136
       1136
       -
       				}

     

       1137
       1137
       -
       				// Prevent deleting current session

     

       1138
       1138
       -
       				if (targetSessionId === currentSessionId) {

     

       1139
       1139
       -
       					return Response.json(

     

       1140
       1140
       -
       						{ error: "Cannot kill current session. Use logout instead." },

     

       1141
       1141
       -
       						{ status: 400 },

     

       1142
       1142
       -
       					);

     

       1143
       1143
       -
       				}

     

       1144
       1144
       -
       				// Verify the session belongs to the user

     

       1145
       1145
       -
       				const targetSession = getSession(targetSessionId);

     

       1146
       1146
       -
       				if (!targetSession || targetSession.user_id !== user.id) {

     

       1147
       1147
       -
       					return Response.json({ error: "Session not found" }, { status: 404 });

     

       1162
       1162
       +
       					const body = await req.json();

     

       1163
       1163
       +
       					const targetSessionId = body.sessionId;

     

       1164
       1164
       +
       					if (!targetSessionId) {

     

       1165
       1165
       +
       						return Response.json(

     

       1166
       1166
       +
       							{ error: "Session ID required" },

     

       1167
       1167
       +
       							{ status: 400 },

     

       1168
       1168
       +
       						);

     

       1169
       1169
       +
       					}

     

       1170
       1170
       +
       					// Prevent deleting current session

     

       1171
       1171
       +
       					if (targetSessionId === currentSessionId) {

     

       1172
       1172
       +
       						return Response.json(

     

       1173
       1173
       +
       							{ error: "Cannot kill current session. Use logout instead." },

     

       1174
       1174
       +
       							{ status: 400 },

     

       1175
       1175
       +
       						);

     

       1176
       1176
       +
       					}

     

       1177
       1177
       +
       					// Verify the session belongs to the user

     

       1178
       1178
       +
       					const targetSession = getSession(targetSessionId);

     

       1179
       1179
       +
       					if (!targetSession || targetSession.user_id !== user.id) {

     

       1180
       1180
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1181
       1181
       +
       					}

     

       1182
       1182
       +
       					deleteSession(targetSessionId);

     

       1183
       1183
       +
       					return new Response(null, { status: 204 });

     

       1184
       1184
       +
       				} catch (err) {

     

       1185
       1185
       +
       					return handleError(err);

     

       1148
       1186
        
       				}

     

       1149
       1149
       -
       				deleteSession(targetSessionId);

     

       1150
       1150
       -
       				return Response.json({ success: true });

     

       1151
       1187
        
       			},

     

       1152
       1188
        
       		},

     

       1153
       1189
        
       		"/api/user": {

     

       1154
       1190
        
       			DELETE: async (req) => {

     

       1155
       1155
       -
       				const sessionId = getSessionFromRequest(req);

     

       1156
       1156
       -
       				if (!sessionId) {

     

       1157
       1157
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1158
       1158
       -
       				}

     

       1159
       1159
       -
       				const user = getUserBySession(sessionId);

     

       1160
       1160
       -
       				if (!user) {

     

       1161
       1161
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1162
       1162
       -
       				}

     

       1191
       1191
       +
       				try {

     

       1192
       1192
       +
       					const user = requireAuth(req);

     

       1163
       1193
        
       

     

       1164
       1164
       -
       				// Rate limiting

     

       1165
       1165
       -
       				const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1166
       1166
       -
       					ip: { max: 3, windowSeconds: 60 * 60 },

     

       1167
       1167
       -
       				});

     

       1168
       1168
       -
       				if (rateLimitError) return rateLimitError;

     

       1194
       1194
       +
       					// Rate limiting

     

       1195
       1195
       +
       					const rateLimitError = enforceRateLimit(req, "delete-user", {

     

       1196
       1196
       +
       						ip: { max: 3, windowSeconds: 60 * 60 },

     

       1197
       1197
       +
       					});

     

       1198
       1198
       +
       					if (rateLimitError) return rateLimitError;

     

       1169
       1199
        
       

     

       1170
       1170
       -
       				await deleteUser(user.id);

     

       1171
       1171
       -
       				return Response.json(

     

       1172
       1172
       -
       					{ success: true },

     

       1173
       1173
       -
       					{

     

       1200
       1200
       +
       					await deleteUser(user.id);

     

       1201
       1201
       +
       					return new Response(null, {

     

       1202
       1202
       +
       						status: 204,

     

       1174
       1203
        
       						headers: {

     

       1175
       1204
        
       							"Set-Cookie":

     

       1176
       1205
        
       								"session=; HttpOnly; Secure; Path=/; Max-Age=0; SameSite=Lax",

     

       1177
       1206
        
       						},

     

       1178
       1178
       -
       					},

     

       1179
       1179
       -
       				);

     

       1207
       1207
       +
       					});

     

       1208
       1208
       +
       				} catch (err) {

     

       1209
       1209
       +
       					return handleError(err);

     

       1210
       1210
       +
       				}

     

       1180
       1211
        
       			},

     

       1181
       1212
        
       		},

     

       1182
       1213
        
       		"/api/user/email": {

     

       1183
       1214
        
       			PUT: async (req) => {

     

       1184
       1184
       -
       				const sessionId = getSessionFromRequest(req);

     

       1185
       1185
       -
       				if (!sessionId) {

     

       1186
       1186
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1187
       1187
       -
       				}

     

       1188
       1188
       -
       				const user = getUserBySession(sessionId);

     

       1189
       1189
       -
       				if (!user) {

     

       1190
       1190
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1191
       1191
       -
       				}

     

       1215
       1215
       +
       				try {

     

       1216
       1216
       +
       					const user = requireAuth(req);

     

       1192
       1217
        
       

     

       1193
       1193
       -
       				// Rate limiting

     

       1194
       1194
       -
       				const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1195
       1195
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1196
       1196
       -
       				});

     

       1197
       1197
       -
       				if (rateLimitError) return rateLimitError;

     

       1218
       1218
       +
       					// Rate limiting

     

       1219
       1219
       +
       					const rateLimitError = enforceRateLimit(req, "update-email", {

     

       1220
       1220
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1221
       1221
       +
       					});

     

       1222
       1222
       +
       					if (rateLimitError) return rateLimitError;

     

       1198
       1223
        
       

     

       1199
       1199
       -
       				const body = await req.json();

     

       1200
       1200
       -
       				const { email } = body;

     

       1201
       1201
       -
       				if (!email) {

     

       1202
       1202
       -
       					return Response.json({ error: "Email required" }, { status: 400 });

     

       1203
       1203
       -
       				}

     

       1224
       1224
       +
       					const body = await req.json();

     

       1225
       1225
       +
       					const { email } = body;

     

       1226
       1226
       +
       					if (!email) {

     

       1227
       1227
       +
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       1228
       1228
       +
       					}

     

       1204
       1229
        
       

     

       1205
       1205
       -
       				// Check if email is already in use

     

       1206
       1206
       -
       				const existingUser = getUserByEmail(email);

     

       1207
       1207
       -
       				if (existingUser) {

     

       1208
       1208
       -
       					return Response.json(

     

       1209
       1209
       -
       						{ error: "Email already in use" },

     

       1210
       1210
       -
       						{ status: 400 },

     

       1211
       1211
       -
       					);

     

       1212
       1212
       -
       				}

     

       1230
       1230
       +
       					// Check if email is already in use

     

       1231
       1231
       +
       					const existingUser = getUserByEmail(email);

     

       1232
       1232
       +
       					if (existingUser) {

     

       1233
       1233
       +
       						return Response.json(

     

       1234
       1234
       +
       							{ error: "Email already in use" },

     

       1235
       1235
       +
       							{ status: 409 },

     

       1236
       1236
       +
       						);

     

       1237
       1237
       +
       					}

     

       1213
       1238
        
       

     

       1214
       1214
       -
       				try {

     

       1215
       1215
       -
       					// Create email change token

     

       1216
       1216
       -
       					const token = createEmailChangeToken(user.id, email);

     

       1239
       1239
       +
       					try {

     

       1240
       1240
       +
       						// Create email change token

     

       1241
       1241
       +
       						const token = createEmailChangeToken(user.id, email);

     

       1217
       1242
        
       

     

       1218
       1218
       -
       					// Send verification email to the CURRENT address

     

       1219
       1219
       -
       					const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1220
       1220
       -
       					const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1243
       1243
       +
       						// Send verification email to the CURRENT address

     

       1244
       1244
       +
       						const origin = process.env.ORIGIN || "http://localhost:3000";

     

       1245
       1245
       +
       						const verifyUrl = `${origin}/api/user/email/verify?token=${token}`;

     

       1221
       1246
        
       

     

       1222
       1222
       -
       					await sendEmail({

     

       1223
       1223
       -
       						to: user.email,

     

       1224
       1224
       -
       						subject: "Verify your email change",

     

       1225
       1225
       -
       						html: emailChangeTemplate({

     

       1226
       1226
       -
       							name: user.name,

     

       1227
       1227
       -
       							currentEmail: user.email,

     

       1228
       1228
       -
       							newEmail: email,

     

       1229
       1229
       -
       							verifyLink: verifyUrl,

     

       1230
       1230
       -
       						}),

     

       1231
       1231
       -
       					});

     

       1247
       1247
       +
       						await sendEmail({

     

       1248
       1248
       +
       							to: user.email,

     

       1249
       1249
       +
       							subject: "Verify your email change",

     

       1250
       1250
       +
       							html: emailChangeTemplate({

     

       1251
       1251
       +
       								name: user.name,

     

       1252
       1252
       +
       								currentEmail: user.email,

     

       1253
       1253
       +
       								newEmail: email,

     

       1254
       1254
       +
       								verifyLink: verifyUrl,

     

       1255
       1255
       +
       							}),

     

       1256
       1256
       +
       						});

     

       1232
       1257
        
       

     

       1233
       1233
       -
       					return Response.json({

     

       1234
       1234
       -
       						success: true,

     

       1235
       1235
       -
       						message: `Verification email sent to ${user.email}`,

     

       1236
       1236
       -
       						pendingEmail: email,

     

       1237
       1237
       -
       					});

     

       1238
       1238
       -
       				} catch (error) {

     

       1239
       1239
       -
       					console.error(

     

       1240
       1240
       -
       						"[Email] Failed to send email change verification:",

     

       1241
       1241
       -
       						error,

     

       1242
       1242
       -
       					);

     

       1243
       1243
       -
       					return Response.json(

     

       1244
       1244
       -
       						{ error: "Failed to send verification email" },

     

       1245
       1245
       -
       						{ status: 500 },

     

       1246
       1246
       -
       					);

     

       1258
       1258
       +
       						return Response.json({

     

       1259
       1259
       +
       							success: true,

     

       1260
       1260
       +
       							message: `Verification email sent to ${user.email}`,

     

       1261
       1261
       +
       							pendingEmail: email,

     

       1262
       1262
       +
       						});

     

       1263
       1263
       +
       					} catch (error) {

     

       1264
       1264
       +
       						console.error(

     

       1265
       1265
       +
       							"[Email] Failed to send email change verification:",

     

       1266
       1266
       +
       							error,

     

       1267
       1267
       +
       						);

     

       1268
       1268
       +
       						return Response.json(

     

       1269
       1269
       +
       							{ error: "Failed to send verification email" },

     

       1270
       1270
       +
       							{ status: 500 },

     

       1271
       1271
       +
       						);

     

       1272
       1272
       +
       					}

     

       1273
       1273
       +
       				} catch (err) {

     

       1274
       1274
       +
       					return handleError(err);

     

       1247
       1275
        
       				}

     

       1248
       1276
        
       			},

     

       1249
       1277
        
       		},

     
···

       1291
       1319
        
       		},

     

       1292
       1320
        
       		"/api/user/password": {

     

       1293
       1321
        
       			PUT: async (req) => {

     

       1294
       1294
       -
       				const sessionId = getSessionFromRequest(req);

     

       1295
       1295
       -
       				if (!sessionId) {

     

       1296
       1296
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1297
       1297
       -
       				}

     

       1298
       1298
       -
       				const user = getUserBySession(sessionId);

     

       1299
       1299
       -
       				if (!user) {

     

       1300
       1300
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1301
       1301
       -
       				}

     

       1322
       1322
       +
       				try {

     

       1323
       1323
       +
       					const user = requireAuth(req);

     

       1302
       1324
        
       

     

       1303
       1303
       -
       				// Rate limiting

     

       1304
       1304
       -
       				const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1305
       1305
       -
       					ip: { max: 5, windowSeconds: 60 * 60 },

     

       1306
       1306
       -
       				});

     

       1307
       1307
       -
       				if (rateLimitError) return rateLimitError;

     

       1325
       1325
       +
       					// Rate limiting

     

       1326
       1326
       +
       					const rateLimitError = enforceRateLimit(req, "update-password", {

     

       1327
       1327
       +
       						ip: { max: 5, windowSeconds: 60 * 60 },

     

       1328
       1328
       +
       					});

     

       1329
       1329
       +
       					if (rateLimitError) return rateLimitError;

     

       1308
       1330
        
       

     

       1309
       1309
       -
       				const body = await req.json();

     

       1310
       1310
       -
       				const { password } = body;

     

       1311
       1311
       -
       				if (!password) {

     

       1312
       1312
       -
       					return Response.json({ error: "Password required" }, { status: 400 });

     

       1313
       1313
       -
       				}

     

       1314
       1314
       -
       				// Validate password format (client-side hashed PBKDF2)

     

       1315
       1315
       -
       				const passwordValidation = validatePasswordHash(password);

     

       1316
       1316
       -
       				if (!passwordValidation.valid) {

     

       1317
       1317
       -
       					return Response.json(

     

       1318
       1318
       -
       						{ error: passwordValidation.error },

     

       1319
       1319
       -
       						{ status: 400 },

     

       1320
       1320
       -
       					);

     

       1321
       1321
       -
       				}

     

       1322
       1322
       -
       				try {

     

       1323
       1323
       -
       					await updateUserPassword(user.id, password);

     

       1324
       1324
       -
       					return Response.json({ success: true });

     

       1325
       1325
       -
       				} catch {

     

       1326
       1326
       -
       					return Response.json(

     

       1327
       1327
       -
       						{ error: "Failed to update password" },

     

       1328
       1328
       -
       						{ status: 500 },

     

       1329
       1329
       -
       					);

     

       1331
       1331
       +
       					const body = await req.json();

     

       1332
       1332
       +
       					const { password } = body;

     

       1333
       1333
       +
       					if (!password) {

     

       1334
       1334
       +
       						return Response.json(

     

       1335
       1335
       +
       							{ error: "Password required" },

     

       1336
       1336
       +
       							{ status: 400 },

     

       1337
       1337
       +
       						);

     

       1338
       1338
       +
       					}

     

       1339
       1339
       +
       					// Validate password format (client-side hashed PBKDF2)

     

       1340
       1340
       +
       					const passwordValidation = validatePasswordHash(password);

     

       1341
       1341
       +
       					if (!passwordValidation.valid) {

     

       1342
       1342
       +
       						return Response.json(

     

       1343
       1343
       +
       							{ error: passwordValidation.error },

     

       1344
       1344
       +
       							{ status: 400 },

     

       1345
       1345
       +
       						);

     

       1346
       1346
       +
       					}

     

       1347
       1347
       +
       					try {

     

       1348
       1348
       +
       						await updateUserPassword(user.id, password);

     

       1349
       1349
       +
       						return Response.json({ success: true });

     

       1350
       1350
       +
       					} catch {

     

       1351
       1351
       +
       						return Response.json(

     

       1352
       1352
       +
       							{ error: "Failed to update password" },

     

       1353
       1353
       +
       							{ status: 500 },

     

       1354
       1354
       +
       						);

     

       1355
       1355
       +
       					}

     

       1356
       1356
       +
       				} catch (err) {

     

       1357
       1357
       +
       					return handleError(err);

     

       1330
       1358
        
       				}

     

       1331
       1359
        
       			},

     

       1332
       1360
        
       		},

     

       1333
       1361
        
       		"/api/user/name": {

     

       1334
       1362
        
       			PUT: async (req) => {

     

       1335
       1335
       -
       				const sessionId = getSessionFromRequest(req);

     

       1336
       1336
       -
       				if (!sessionId) {

     

       1337
       1337
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1338
       1338
       -
       				}

     

       1339
       1339
       -
       				const user = getUserBySession(sessionId);

     

       1340
       1340
       -
       				if (!user) {

     

       1341
       1341
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1342
       1342
       -
       				}

     

       1363
       1363
       +
       				try {

     

       1364
       1364
       +
       					const user = requireAuth(req);

     

       1343
       1365
        
       

     

       1344
       1344
       -
       				const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1345
       1345
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1346
       1346
       -
       				});

     

       1347
       1347
       -
       				if (rateLimitError) return rateLimitError;

     

       1366
       1366
       +
       					const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1367
       1367
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1368
       1368
       +
       					});

     

       1369
       1369
       +
       					if (rateLimitError) return rateLimitError;

     

       1348
       1370
        
       

     

       1349
       1349
       -
       				const body = await req.json();

     

       1350
       1350
       -
       				const { name } = body;

     

       1351
       1351
       -
       				if (!name) {

     

       1352
       1352
       -
       					return Response.json({ error: "Name required" }, { status: 400 });

     

       1353
       1353
       -
       				}

     

       1354
       1354
       -
       				try {

     

       1355
       1355
       -
       					updateUserName(user.id, name);

     

       1356
       1356
       -
       					return Response.json({ success: true });

     

       1357
       1357
       -
       				} catch {

     

       1358
       1358
       -
       					return Response.json(

     

       1359
       1359
       -
       						{ error: "Failed to update name" },

     

       1360
       1360
       -
       						{ status: 500 },

     

       1361
       1361
       -
       					);

     

       1371
       1371
       +
       					const body = await req.json();

     

       1372
       1372
       +
       					const { name } = body;

     

       1373
       1373
       +
       					if (!name) {

     

       1374
       1374
       +
       						return Response.json({ error: "Name required" }, { status: 400 });

     

       1375
       1375
       +
       					}

     

       1376
       1376
       +
       					try {

     

       1377
       1377
       +
       						updateUserName(user.id, name);

     

       1378
       1378
       +
       						return Response.json({ success: true });

     

       1379
       1379
       +
       					} catch {

     

       1380
       1380
       +
       						return Response.json(

     

       1381
       1381
       +
       							{ error: "Failed to update name" },

     

       1382
       1382
       +
       							{ status: 500 },

     

       1383
       1383
       +
       						);

     

       1384
       1384
       +
       					}

     

       1385
       1385
       +
       				} catch (err) {

     

       1386
       1386
       +
       					return handleError(err);

     

       1362
       1387
        
       				}

     

       1363
       1388
        
       			},

     

       1364
       1389
        
       		},

     

       1365
       1390
        
       		"/api/user/avatar": {

     

       1366
       1391
        
       			PUT: async (req) => {

     

       1367
       1367
       -
       				const sessionId = getSessionFromRequest(req);

     

       1368
       1368
       -
       				if (!sessionId) {

     

       1369
       1369
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1370
       1370
       -
       				}

     

       1371
       1371
       -
       				const user = getUserBySession(sessionId);

     

       1372
       1372
       -
       				if (!user) {

     

       1373
       1373
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1374
       1374
       -
       				}

     

       1392
       1392
       +
       				try {

     

       1393
       1393
       +
       					const user = requireAuth(req);

     

       1375
       1394
        
       

     

       1376
       1376
       -
       				const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1377
       1377
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1378
       1378
       -
       				});

     

       1379
       1379
       -
       				if (rateLimitError) return rateLimitError;

     

       1395
       1395
       +
       					const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1396
       1396
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1397
       1397
       +
       					});

     

       1398
       1398
       +
       					if (rateLimitError) return rateLimitError;

     

       1380
       1399
        
       

     

       1381
       1381
       -
       				const body = await req.json();

     

       1382
       1382
       -
       				const { avatar } = body;

     

       1383
       1383
       -
       				if (!avatar) {

     

       1384
       1384
       -
       					return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1385
       1385
       -
       				}

     

       1386
       1386
       -
       				try {

     

       1387
       1387
       -
       					updateUserAvatar(user.id, avatar);

     

       1388
       1388
       -
       					return Response.json({ success: true });

     

       1389
       1389
       -
       				} catch {

     

       1390
       1390
       -
       					return Response.json(

     

       1391
       1391
       -
       						{ error: "Failed to update avatar" },

     

       1392
       1392
       -
       						{ status: 500 },

     

       1393
       1393
       -
       					);

     

       1400
       1400
       +
       					const body = await req.json();

     

       1401
       1401
       +
       					const { avatar } = body;

     

       1402
       1402
       +
       					if (!avatar) {

     

       1403
       1403
       +
       						return Response.json({ error: "Avatar required" }, { status: 400 });

     

       1404
       1404
       +
       					}

     

       1405
       1405
       +
       					try {

     

       1406
       1406
       +
       						updateUserAvatar(user.id, avatar);

     

       1407
       1407
       +
       						return Response.json({ success: true });

     

       1408
       1408
       +
       					} catch {

     

       1409
       1409
       +
       						return Response.json(

     

       1410
       1410
       +
       							{ error: "Failed to update avatar" },

     

       1411
       1411
       +
       							{ status: 500 },

     

       1412
       1412
       +
       						);

     

       1413
       1413
       +
       					}

     

       1414
       1414
       +
       				} catch (err) {

     

       1415
       1415
       +
       					return handleError(err);

     

       1394
       1416
        
       				}

     

       1395
       1417
        
       			},

     

       1396
       1418
        
       		},

     

       1397
       1419
        
       		"/api/user/notifications": {

     

       1398
       1420
        
       			PUT: async (req) => {

     

       1399
       1399
       -
       				const sessionId = getSessionFromRequest(req);

     

       1400
       1400
       -
       				if (!sessionId) {

     

       1401
       1401
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1402
       1402
       -
       				}

     

       1403
       1403
       -
       				const user = getUserBySession(sessionId);

     

       1404
       1404
       -
       				if (!user) {

     

       1405
       1405
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1406
       1406
       -
       				}

     

       1421
       1421
       +
       				try {

     

       1422
       1422
       +
       					const user = requireAuth(req);

     

       1407
       1423
        
       

     

       1408
       1408
       -
       				const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1409
       1409
       -
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1410
       1410
       -
       				});

     

       1411
       1411
       -
       				if (rateLimitError) return rateLimitError;

     

       1424
       1424
       +
       					const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1425
       1425
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       1426
       1426
       +
       					});

     

       1427
       1427
       +
       					if (rateLimitError) return rateLimitError;

     

       1412
       1428
        
       

     

       1413
       1413
       -
       				const body = await req.json();

     

       1414
       1414
       -
       				const { email_notifications_enabled } = body;

     

       1415
       1415
       -
       				if (typeof email_notifications_enabled !== "boolean") {

     

       1416
       1416
       -
       					return Response.json(

     

       1417
       1417
       -
       						{ error: "email_notifications_enabled must be a boolean" },

     

       1418
       1418
       -
       						{ status: 400 },

     

       1419
       1419
       -
       					);

     

       1420
       1420
       -
       				}

     

       1421
       1421
       -
       				try {

     

       1422
       1422
       -
       					db.run(

     

       1423
       1423
       -
       						"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1424
       1424
       -
       						[email_notifications_enabled ? 1 : 0, user.id],

     

       1425
       1425
       -
       					);

     

       1426
       1426
       -
       					return Response.json({ success: true });

     

       1427
       1427
       -
       				} catch {

     

       1428
       1428
       -
       					return Response.json(

     

       1429
       1429
       -
       						{ error: "Failed to update notification settings" },

     

       1430
       1430
       -
       						{ status: 500 },

     

       1431
       1431
       -
       					);

     

       1429
       1429
       +
       					const body = await req.json();

     

       1430
       1430
       +
       					const { email_notifications_enabled } = body;

     

       1431
       1431
       +
       					if (typeof email_notifications_enabled !== "boolean") {

     

       1432
       1432
       +
       						return Response.json(

     

       1433
       1433
       +
       							{ error: "email_notifications_enabled must be a boolean" },

     

       1434
       1434
       +
       							{ status: 400 },

     

       1435
       1435
       +
       						);

     

       1436
       1436
       +
       					}

     

       1437
       1437
       +
       					try {

     

       1438
       1438
       +
       						db.run(

     

       1439
       1439
       +
       							"UPDATE users SET email_notifications_enabled = ? WHERE id = ?",

     

       1440
       1440
       +
       							[email_notifications_enabled ? 1 : 0, user.id],

     

       1441
       1441
       +
       						);

     

       1442
       1442
       +
       						return Response.json({ success: true });

     

       1443
       1443
       +
       					} catch {

     

       1444
       1444
       +
       						return Response.json(

     

       1445
       1445
       +
       							{ error: "Failed to update notification settings" },

     

       1446
       1446
       +
       							{ status: 500 },

     

       1447
       1447
       +
       						);

     

       1448
       1448
       +
       					}

     

       1449
       1449
       +
       				} catch (err) {

     

       1450
       1450
       +
       					return handleError(err);

     

       1432
       1451
        
       				}

     

       1433
       1452
        
       			},

     

       1434
       1453
        
       		},

     

       1435
       1454
        
       		"/api/billing/checkout": {

     

       1436
       1455
        
       			POST: async (req) => {

     

       1437
       1437
       -
       				const sessionId = getSessionFromRequest(req);

     

       1438
       1438
       -
       				if (!sessionId) {

     

       1439
       1439
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1440
       1440
       -
       				}

     

       1441
       1441
       -
       				const user = getUserBySession(sessionId);

     

       1442
       1442
       -
       				if (!user) {

     

       1443
       1443
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1444
       1444
       -
       				}

     

       1456
       1456
       +
       				try {

     

       1457
       1457
       +
       					const user = requireAuth(req);

     

       1445
       1458
        
       

     

       1446
       1446
       -
       				try {

     

       1447
       1459
        
       					const { polar } = await import("./lib/polar");

     

       1448
       1460
        
       

     

       1449
       1461
        
       					// Validated at startup

     
···

       1462
       1474
        
       					});

     

       1463
       1475
        
       

     

       1464
       1476
        
       					return Response.json({ url: checkout.url });

     

       1465
       1465
       -
       				} catch (error) {

     

       1466
       1466
       -
       					console.error("Failed to create checkout:", error);

     

       1467
       1467
       -
       					return Response.json(

     

       1468
       1468
       -
       						{ error: "Failed to create checkout session" },

     

       1469
       1469
       -
       						{ status: 500 },

     

       1470
       1470
       -
       					);

     

       1477
       1477
       +
       				} catch (err) {

     

       1478
       1478
       +
       					return handleError(err);

     

       1471
       1479
        
       				}

     

       1472
       1480
        
       			},

     

       1473
       1481
        
       		},

     

       1474
       1482
        
       		"/api/billing/subscription": {

     

       1475
       1483
        
       			GET: async (req) => {

     

       1476
       1476
       -
       				const sessionId = getSessionFromRequest(req);

     

       1477
       1477
       -
       				if (!sessionId) {

     

       1478
       1478
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1479
       1479
       -
       				}

     

       1480
       1480
       -
       				const user = getUserBySession(sessionId);

     

       1481
       1481
       -
       				if (!user) {

     

       1482
       1482
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1483
       1483
       -
       				}

     

       1484
       1484
       +
       				try {

     

       1485
       1485
       +
       					const user = requireAuth(req);

     

       1484
       1486
        
       

     

       1485
       1485
       -
       				try {

     

       1486
       1487
        
       					// Get subscription from database

     

       1487
       1488
        
       					const subscription = db

     

       1488
       1489
        
       						.query<

     
···

       1505
       1506
        
       					}

     

       1506
       1507
        
       

     

       1507
       1508
        
       					return Response.json({ subscription });

     

       1508
       1508
       -
       				} catch (error) {

     

       1509
       1509
       -
       					console.error("Failed to fetch subscription:", error);

     

       1510
       1510
       -
       					return Response.json(

     

       1511
       1511
       -
       						{ error: "Failed to fetch subscription" },

     

       1512
       1512
       -
       						{ status: 500 },

     

       1513
       1513
       -
       					);

     

       1509
       1509
       +
       				} catch (err) {

     

       1510
       1510
       +
       					return handleError(err);

     

       1514
       1511
        
       				}

     

       1515
       1512
        
       			},

     

       1516
       1513
        
       		},

     

       1517
       1514
        
       		"/api/billing/portal": {

     

       1518
       1515
        
       			POST: async (req) => {

     

       1519
       1519
       -
       				const sessionId = getSessionFromRequest(req);

     

       1520
       1520
       -
       				if (!sessionId) {

     

       1521
       1521
       -
       					return Response.json({ error: "Not authenticated" }, { status: 401 });

     

       1522
       1522
       -
       				}

     

       1523
       1523
       -
       				const user = getUserBySession(sessionId);

     

       1524
       1524
       -
       				if (!user) {

     

       1525
       1525
       -
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1526
       1526
       -
       				}

     

       1516
       1516
       +
       				try {

     

       1517
       1517
       +
       					const user = requireAuth(req);

     

       1527
       1518
        
       

     

       1528
       1528
       -
       				try {

     

       1529
       1519
        
       					const { polar } = await import("./lib/polar");

     

       1530
       1520
        
       

     

       1531
       1521
        
       					// Get subscription to find customer ID

     
···

       1553
       1543
        
       					});

     

       1554
       1544
        
       

     

       1555
       1545
        
       					return Response.json({ url: session.customerPortalUrl });

     

       1556
       1556
       -
       				} catch (error) {

     

       1557
       1557
       -
       					console.error("Failed to create portal session:", error);

     

       1558
       1558
       -
       					return Response.json(

     

       1559
       1559
       -
       						{ error: "Failed to create portal session" },

     

       1560
       1560
       -
       						{ status: 500 },

     

       1561
       1561
       -
       					);

     

       1546
       1546
       +
       				} catch (err) {

     

       1547
       1547
       +
       					return handleError(err);

     

       1562
       1548
        
       				}

     

       1563
       1549
        
       			},

     

       1564
       1550
        
       		},

     
···

       1693
       1679
        
       

     

       1694
       1680
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1695
       1681
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1696
       1696
       -
       						return Response.json(

     

       1697
       1697
       -
       							{ error: "Transcription not found" },

     

       1698
       1698
       -
       							{ status: 404 },

     

       1699
       1699
       -
       						);

     

       1682
       1682
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1700
       1683
        
       					}

     

       1701
       1684
        
       

     

       1702
       1685
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1936
       1919
        
       

     

       1937
       1920
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       1938
       1921
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       1939
       1939
       -
       						return Response.json(

     

       1940
       1940
       -
       							{ error: "Transcription not found" },

     

       1941
       1941
       -
       							{ status: 404 },

     

       1942
       1942
       -
       						);

     

       1922
       1922
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       1943
       1923
        
       					}

     

       1944
       1924
        
       

     

       1945
       1925
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       1955
       1935
        
       					if (transcription.status !== "completed") {

     

       1956
       1936
        
       						return Response.json(

     

       1957
       1937
        
       							{ error: "Transcription not completed yet" },

     

       1958
       1958
       -
       							{ status: 400 },

     

       1938
       1938
       +
       							{ status: 409 },

     

       1959
       1939
        
       						);

     

       1960
       1940
        
       					}

     

       1961
       1941
        
       

     
···

       2044
       2024
        
       

     

       2045
       2025
        
       					// Allow access if: owner, admin, or enrolled in the class

     

       2046
       2026
        
       					if (!isOwner && !isAdmin && !isClassMember) {

     

       2047
       2047
       -
       						return Response.json(

     

       2048
       2048
       -
       							{ error: "Transcription not found" },

     

       2049
       2049
       -
       							{ status: 404 },

     

       2050
       2050
       -
       						);

     

       2027
       2027
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2051
       2028
        
       					}

     

       2052
       2029
        
       

     

       2053
       2030
        
       					// Require subscription only if accessing own transcription (not class)

     
···

       2119
       2096
        
       				}

     

       2120
       2097
        
       			},

     

       2121
       2098
        
       		},

     

       2099
       2099
       +
       		"/api/transcriptions/detect-meeting-time": {

     

       2100
       2100
       +
       			POST: async (req) => {

     

       2101
       2101
       +
       				try {

     

       2102
       2102
       +
       					const user = requireAuth(req);

     

       2103
       2103
       +
       

     

       2104
       2104
       +
       					const formData = await req.formData();

     

       2105
       2105
       +
       					const file = formData.get("audio") as File;

     

       2106
       2106
       +
       					const classId = formData.get("class_id") as string | null;

     

       2107
       2107
       +
       					const fileTimestampStr = formData.get("file_timestamp") as

     

       2108
       2108
       +
       						| string

     

       2109
       2109
       +
       						| null;

     

       2110
       2110
       +
       

     

       2111
       2111
       +
       					if (!file) throw ValidationErrors.missingField("audio");

     

       2112
       2112
       +
       					if (!classId) throw ValidationErrors.missingField("class_id");

     

       2113
       2113
       +
       

     

       2114
       2114
       +
       					// Verify user is enrolled in the class

     

       2115
       2115
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2116
       2116
       +
       					if (!enrolled && user.role !== "admin") {

     

       2117
       2117
       +
       						return Response.json(

     

       2118
       2118
       +
       							{ error: "Not enrolled in this class" },

     

       2119
       2119
       +
       							{ status: 403 },

     

       2120
       2120
       +
       						);

     

       2121
       2121
       +
       					}

     

       2122
       2122
       +
       

     

       2123
       2123
       +
       					let creationDate: Date | null = null;

     

       2124
       2124
       +
       

     

       2125
       2125
       +
       					// Use client-provided timestamp (from File.lastModified)

     

       2126
       2126
       +
       					if (fileTimestampStr) {

     

       2127
       2127
       +
       						const timestamp = Number.parseInt(fileTimestampStr, 10);

     

       2128
       2128
       +
       						if (!Number.isNaN(timestamp)) {

     

       2129
       2129
       +
       							creationDate = new Date(timestamp);

     

       2130
       2130
       +
       							console.log(

     

       2131
       2131
       +
       								`[Upload] Using file timestamp: ${creationDate.toISOString()}`,

     

       2132
       2132
       +
       							);

     

       2133
       2133
       +
       						}

     

       2134
       2134
       +
       					}

     

       2135
       2135
       +
       

     

       2136
       2136
       +
       					if (!creationDate) {

     

       2137
       2137
       +
       						return Response.json({

     

       2138
       2138
       +
       							detected: false,

     

       2139
       2139
       +
       							meeting_time_id: null,

     

       2140
       2140
       +
       							message: "Could not extract creation date from file",

     

       2141
       2141
       +
       						});

     

       2142
       2142
       +
       					}

     

       2143
       2143
       +
       

     

       2144
       2144
       +
       					// Get meeting times for this class

     

       2145
       2145
       +
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       2146
       2146
       +
       

     

       2147
       2147
       +
       					if (meetingTimes.length === 0) {

     

       2148
       2148
       +
       						return Response.json({

     

       2149
       2149
       +
       							detected: false,

     

       2150
       2150
       +
       							meeting_time_id: null,

     

       2151
       2151
       +
       							message: "No meeting times configured for this class",

     

       2152
       2152
       +
       						});

     

       2153
       2153
       +
       					}

     

       2154
       2154
       +
       

     

       2155
       2155
       +
       					// Find matching meeting time based on day of week

     

       2156
       2156
       +
       					const matchedId = findMatchingMeetingTime(

     

       2157
       2157
       +
       						creationDate,

     

       2158
       2158
       +
       						meetingTimes,

     

       2159
       2159
       +
       					);

     

       2160
       2160
       +
       

     

       2161
       2161
       +
       					if (matchedId) {

     

       2162
       2162
       +
       						const dayName = getDayName(creationDate);

     

       2163
       2163
       +
       						return Response.json({

     

       2164
       2164
       +
       							detected: true,

     

       2165
       2165
       +
       							meeting_time_id: matchedId,

     

       2166
       2166
       +
       							day: dayName,

     

       2167
       2167
       +
       							date: creationDate.toISOString(),

     

       2168
       2168
       +
       						});

     

       2169
       2169
       +
       					}

     

       2170
       2170
       +
       

     

       2171
       2171
       +
       					const dayName = getDayName(creationDate);

     

       2172
       2172
       +
       					return Response.json({

     

       2173
       2173
       +
       						detected: false,

     

       2174
       2174
       +
       						meeting_time_id: null,

     

       2175
       2175
       +
       						day: dayName,

     

       2176
       2176
       +
       						date: creationDate.toISOString(),

     

       2177
       2177
       +
       						message: `No meeting time matches ${dayName}`,

     

       2178
       2178
       +
       					});

     

       2179
       2179
       +
       				} catch (error) {

     

       2180
       2180
       +
       					return handleError(error);

     

       2181
       2181
       +
       				}

     

       2182
       2182
       +
       			},

     

       2183
       2183
       +
       		},

     

       2184
       2184
       +
       		"/api/transcriptions/:id/meeting-time": {

     

       2185
       2185
       +
       			PATCH: async (req) => {

     

       2186
       2186
       +
       				try {

     

       2187
       2187
       +
       					const user = requireAuth(req);

     

       2188
       2188
       +
       					const transcriptionId = req.params.id;

     

       2189
       2189
       +
       

     

       2190
       2190
       +
       					const body = await req.json();

     

       2191
       2191
       +
       					const meetingTimeId = body.meeting_time_id;

     

       2192
       2192
       +
       					const sectionId = body.section_id;

     

       2193
       2193
       +
       

     

       2194
       2194
       +
       					if (!meetingTimeId) {

     

       2195
       2195
       +
       						return Response.json(

     

       2196
       2196
       +
       							{ error: "meeting_time_id required" },

     

       2197
       2197
       +
       							{ status: 400 },

     

       2198
       2198
       +
       						);

     

       2199
       2199
       +
       					}

     

       2200
       2200
       +
       

     

       2201
       2201
       +
       					// Verify transcription ownership

     

       2202
       2202
       +
       					const transcription = db

     

       2203
       2203
       +
       						.query<

     

       2204
       2204
       +
       							{ id: string; user_id: number; class_id: string | null },

     

       2205
       2205
       +
       							[string]

     

       2206
       2206
       +
       						>("SELECT id, user_id, class_id FROM transcriptions WHERE id = ?")

     

       2207
       2207
       +
       						.get(transcriptionId);

     

       2208
       2208
       +
       

     

       2209
       2209
       +
       					if (!transcription) {

     

       2210
       2210
       +
       						return Response.json(

     

       2211
       2211
       +
       							{ error: "Transcription not found" },

     

       2212
       2212
       +
       							{ status: 404 },

     

       2213
       2213
       +
       						);

     

       2214
       2214
       +
       					}

     

       2215
       2215
       +
       

     

       2216
       2216
       +
       					if (transcription.user_id !== user.id && user.role !== "admin") {

     

       2217
       2217
       +
       						return Response.json({ error: "Forbidden" }, { status: 403 });

     

       2218
       2218
       +
       					}

     

       2219
       2219
       +
       

     

       2220
       2220
       +
       					// Verify meeting time belongs to the class

     

       2221
       2221
       +
       					if (transcription.class_id) {

     

       2222
       2222
       +
       						const meetingTime = db

     

       2223
       2223
       +
       							.query<{ id: string }, [string, string]>(

     

       2224
       2224
       +
       								"SELECT id FROM meeting_times WHERE id = ? AND class_id = ?",

     

       2225
       2225
       +
       							)

     

       2226
       2226
       +
       							.get(meetingTimeId, transcription.class_id);

     

       2227
       2227
       +
       

     

       2228
       2228
       +
       						if (!meetingTime) {

     

       2229
       2229
       +
       							return Response.json(

     

       2230
       2230
       +
       								{

     

       2231
       2231
       +
       									error:

     

       2232
       2232
       +
       										"Meeting time does not belong to the class for this transcription",

     

       2233
       2233
       +
       								},

     

       2234
       2234
       +
       								{ status: 400 },

     

       2235
       2235
       +
       							);

     

       2236
       2236
       +
       						}

     

       2237
       2237
       +
       					}

     

       2238
       2238
       +
       

     

       2239
       2239
       +
       					// Update meeting time and optionally section_id

     

       2240
       2240
       +
       					if (sectionId !== undefined) {

     

       2241
       2241
       +
       						db.run(

     

       2242
       2242
       +
       							"UPDATE transcriptions SET meeting_time_id = ?, section_id = ? WHERE id = ?",

     

       2243
       2243
       +
       							[meetingTimeId, sectionId, transcriptionId],

     

       2244
       2244
       +
       						);

     

       2245
       2245
       +
       					} else {

     

       2246
       2246
       +
       						db.run(

     

       2247
       2247
       +
       							"UPDATE transcriptions SET meeting_time_id = ? WHERE id = ?",

     

       2248
       2248
       +
       							[meetingTimeId, transcriptionId],

     

       2249
       2249
       +
       						);

     

       2250
       2250
       +
       					}

     

       2251
       2251
       +
       

     

       2252
       2252
       +
       					return Response.json({

     

       2253
       2253
       +
       						success: true,

     

       2254
       2254
       +
       						message: "Meeting time updated successfully",

     

       2255
       2255
       +
       					});

     

       2256
       2256
       +
       				} catch (error) {

     

       2257
       2257
       +
       					return handleError(error);

     

       2258
       2258
       +
       				}

     

       2259
       2259
       +
       			},

     

       2260
       2260
       +
       		},

     

       2261
       2261
       +
       		"/api/classes/:classId/meetings/:meetingTimeId/recordings": {

     

       2262
       2262
       +
       			GET: async (req) => {

     

       2263
       2263
       +
       				try {

     

       2264
       2264
       +
       					const user = requireAuth(req);

     

       2265
       2265
       +
       					const classId = req.params.classId;

     

       2266
       2266
       +
       					const meetingTimeId = req.params.meetingTimeId;

     

       2267
       2267
       +
       

     

       2268
       2268
       +
       					// Verify user is enrolled in the class

     

       2269
       2269
       +
       					const enrolled = isUserEnrolledInClass(user.id, classId);

     

       2270
       2270
       +
       					if (!enrolled && user.role !== "admin") {

     

       2271
       2271
       +
       						return Response.json(

     

       2272
       2272
       +
       							{ error: "Not enrolled in this class" },

     

       2273
       2273
       +
       							{ status: 403 },

     

       2274
       2274
       +
       						);

     

       2275
       2275
       +
       					}

     

       2276
       2276
       +
       

     

       2277
       2277
       +
       					// Get section filter from query params or use user's section

     

       2278
       2278
       +
       					const url = new URL(req.url);

     

       2279
       2279
       +
       					const sectionParam = url.searchParams.get("section_id");

     

       2280
       2280
       +
       					const sectionFilter =

     

       2281
       2281
       +
       						sectionParam !== null

     

       2282
       2282
       +
       							? sectionParam || null // empty string becomes null

     

       2283
       2283
       +
       							: user.role === "admin"

     

       2284
       2284
       +
       								? null

     

       2285
       2285
       +
       								: getUserSection(user.id, classId);

     

       2286
       2286
       +
       

     

       2287
       2287
       +
       					const recordings = getPendingRecordings(

     

       2288
       2288
       +
       						classId,

     

       2289
       2289
       +
       						meetingTimeId,

     

       2290
       2290
       +
       						sectionFilter,

     

       2291
       2291
       +
       					);

     

       2292
       2292
       +
       					const totalUsers = getEnrolledUserCount(classId);

     

       2293
       2293
       +
       					const userVote = getUserVoteForMeeting(

     

       2294
       2294
       +
       						user.id,

     

       2295
       2295
       +
       						classId,

     

       2296
       2296
       +
       						meetingTimeId,

     

       2297
       2297
       +
       					);

     

       2298
       2298
       +
       

     

       2299
       2299
       +
       					// Check if any recording should be auto-submitted

     

       2300
       2300
       +
       					const winningId = checkAutoSubmit(

     

       2301
       2301
       +
       						classId,

     

       2302
       2302
       +
       						meetingTimeId,

     

       2303
       2303
       +
       						sectionFilter,

     

       2304
       2304
       +
       					);

     

       2305
       2305
       +
       

     

       2306
       2306
       +
       					return Response.json({

     

       2307
       2307
       +
       						recordings,

     

       2308
       2308
       +
       						total_users: totalUsers,

     

       2309
       2309
       +
       						user_vote: userVote,

     

       2310
       2310
       +
       						vote_threshold: Math.ceil(totalUsers * 0.4),

     

       2311
       2311
       +
       						winning_recording_id: winningId,

     

       2312
       2312
       +
       					});

     

       2313
       2313
       +
       				} catch (error) {

     

       2314
       2314
       +
       					return handleError(error);

     

       2315
       2315
       +
       				}

     

       2316
       2316
       +
       			},

     

       2317
       2317
       +
       		},

     

       2318
       2318
       +
       		"/api/recordings/:id/vote": {

     

       2319
       2319
       +
       			POST: async (req) => {

     

       2320
       2320
       +
       				try {

     

       2321
       2321
       +
       					const user = requireAuth(req);

     

       2322
       2322
       +
       					const recordingId = req.params.id;

     

       2323
       2323
       +
       

     

       2324
       2324
       +
       					// Verify user is enrolled in the recording's class

     

       2325
       2325
       +
       					const recording = db

     

       2326
       2326
       +
       						.query<

     

       2327
       2327
       +
       							{ class_id: string; meeting_time_id: string; status: string },

     

       2328
       2328
       +
       							[string]

     

       2329
       2329
       +
       						>(

     

       2330
       2330
       +
       							"SELECT class_id, meeting_time_id, status FROM transcriptions WHERE id = ?",

     

       2331
       2331
       +
       						)

     

       2332
       2332
       +
       						.get(recordingId);

     

       2333
       2333
       +
       

     

       2334
       2334
       +
       					if (!recording) {

     

       2335
       2335
       +
       						return Response.json(

     

       2336
       2336
       +
       							{ error: "Recording not found" },

     

       2337
       2337
       +
       							{ status: 404 },

     

       2338
       2338
       +
       						);

     

       2339
       2339
       +
       					}

     

       2340
       2340
       +
       

     

       2341
       2341
       +
       					if (recording.status !== "pending") {

     

       2342
       2342
       +
       						return Response.json(

     

       2343
       2343
       +
       							{ error: "Can only vote on pending recordings" },

     

       2344
       2344
       +
       							{ status: 400 },

     

       2345
       2345
       +
       						);

     

       2346
       2346
       +
       					}

     

       2347
       2347
       +
       

     

       2348
       2348
       +
       					const enrolled = isUserEnrolledInClass(user.id, recording.class_id);

     

       2349
       2349
       +
       					if (!enrolled && user.role !== "admin") {

     

       2350
       2350
       +
       						return Response.json(

     

       2351
       2351
       +
       							{ error: "Not enrolled in this class" },

     

       2352
       2352
       +
       							{ status: 403 },

     

       2353
       2353
       +
       						);

     

       2354
       2354
       +
       					}

     

       2355
       2355
       +
       

     

       2356
       2356
       +
       					// Remove existing vote for this meeting time

     

       2357
       2357
       +
       					const existingVote = getUserVoteForMeeting(

     

       2358
       2358
       +
       						user.id,

     

       2359
       2359
       +
       						recording.class_id,

     

       2360
       2360
       +
       						recording.meeting_time_id,

     

       2361
       2361
       +
       					);

     

       2362
       2362
       +
       					if (existingVote) {

     

       2363
       2363
       +
       						removeVote(existingVote, user.id);

     

       2364
       2364
       +
       					}

     

       2365
       2365
       +
       

     

       2366
       2366
       +
       					// Add new vote

     

       2367
       2367
       +
       					const success = voteForRecording(recordingId, user.id);

     

       2368
       2368
       +
       

     

       2369
       2369
       +
       					// Get user's section for auto-submit check

     

       2370
       2370
       +
       					const userSection =

     

       2371
       2371
       +
       						user.role === "admin"

     

       2372
       2372
       +
       							? null

     

       2373
       2373
       +
       							: getUserSection(user.id, recording.class_id);

     

       2374
       2374
       +
       

     

       2375
       2375
       +
       					// Check if auto-submit threshold reached

     

       2376
       2376
       +
       					const winningId = checkAutoSubmit(

     

       2377
       2377
       +
       						recording.class_id,

     

       2378
       2378
       +
       						recording.meeting_time_id,

     

       2379
       2379
       +
       						userSection,

     

       2380
       2380
       +
       					);

     

       2381
       2381
       +
       					if (winningId) {

     

       2382
       2382
       +
       						markAsAutoSubmitted(winningId);

     

       2383
       2383
       +
       						// Start transcription

     

       2384
       2384
       +
       						const winningRecording = db

     

       2385
       2385
       +
       							.query<{ filename: string }, [string]>(

     

       2386
       2386
       +
       								"SELECT filename FROM transcriptions WHERE id = ?",

     

       2387
       2387
       +
       							)

     

       2388
       2388
       +
       							.get(winningId);

     

       2389
       2389
       +
       						if (winningRecording) {

     

       2390
       2390
       +
       							whisperService.startTranscription(

     

       2391
       2391
       +
       								winningId,

     

       2392
       2392
       +
       								winningRecording.filename,

     

       2393
       2393
       +
       							);

     

       2394
       2394
       +
       						}

     

       2395
       2395
       +
       					}

     

       2396
       2396
       +
       

     

       2397
       2397
       +
       					return Response.json({

     

       2398
       2398
       +
       						success,

     

       2399
       2399
       +
       						winning_recording_id: winningId,

     

       2400
       2400
       +
       					});

     

       2401
       2401
       +
       				} catch (error) {

     

       2402
       2402
       +
       					return handleError(error);

     

       2403
       2403
       +
       				}

     

       2404
       2404
       +
       			},

     

       2405
       2405
       +
       		},

     

       2406
       2406
       +
       		"/api/recordings/:id": {

     

       2407
       2407
       +
       			DELETE: async (req) => {

     

       2408
       2408
       +
       				try {

     

       2409
       2409
       +
       					const user = requireAuth(req);

     

       2410
       2410
       +
       					const recordingId = req.params.id;

     

       2411
       2411
       +
       

     

       2412
       2412
       +
       					const success = deletePendingRecording(

     

       2413
       2413
       +
       						recordingId,

     

       2414
       2414
       +
       						user.id,

     

       2415
       2415
       +
       						user.role === "admin",

     

       2416
       2416
       +
       					);

     

       2417
       2417
       +
       

     

       2418
       2418
       +
       					if (!success) {

     

       2419
       2419
       +
       						return Response.json(

     

       2420
       2420
       +
       							{ error: "Cannot delete this recording" },

     

       2421
       2421
       +
       							{ status: 403 },

     

       2422
       2422
       +
       						);

     

       2423
       2423
       +
       					}

     

       2424
       2424
       +
       

     

       2425
       2425
       +
       					return new Response(null, { status: 204 });

     

       2426
       2426
       +
       				} catch (error) {

     

       2427
       2427
       +
       					return handleError(error);

     

       2428
       2428
       +
       				}

     

       2429
       2429
       +
       			},

     

       2430
       2430
       +
       		},

     

       2122
       2431
        
       		"/api/transcriptions": {

     

       2123
       2432
        
       			GET: async (req) => {

     

       2124
       2433
        
       				try {

     
···

       2261
       2570
        
       					const formData = await req.formData();

     

       2262
       2571
        
       					const file = formData.get("audio") as File;

     

       2263
       2572
        
       					const classId = formData.get("class_id") as string | null;

     

       2264
       2264
       -
       					const meetingTimeId = formData.get("meeting_time_id") as

     

       2573
       2573
       +
       					const sectionId = formData.get("section_id") as string | null;

     

       2574
       2574
       +
       					const recordingDateStr = formData.get("recording_date") as

     

       2265
       2575
        
       						| string

     

       2266
       2576
        
       						| null;

     

       2267
       2577
        
       

     
···

       2330
       2640
        
       					const uploadDir = "./uploads";

     

       2331
       2641
        
       					await Bun.write(`${uploadDir}/${filename}`, file);

     

       2332
       2642
        
       

     

       2333
       2333
       -
       					// Create database record

     

       2643
       2643
       +
       					// Parse recording date (default to current time if not provided)

     

       2644
       2644
       +
       					const recordingDate = recordingDateStr

     

       2645
       2645
       +
       						? Number.parseInt(recordingDateStr, 10)

     

       2646
       2646
       +
       						: Math.floor(Date.now() / 1000);

     

       2647
       2647
       +
       

     

       2648
       2648
       +
       					// Create database record (without meeting_time_id - will be set later via PATCH)

     

       2334
       2649
        
       					db.run(

     

       2335
       2335
       -
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, filename, original_filename, status) VALUES (?, ?, ?, ?, ?, ?, ?)",

     

       2650
       2650
       +
       						"INSERT INTO transcriptions (id, user_id, class_id, meeting_time_id, section_id, filename, original_filename, status, recording_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",

     

       2336
       2651
        
       						[

     

       2337
       2652
        
       							transcriptionId,

     

       2338
       2653
        
       							user.id,

     

       2339
       2654
        
       							classId,

     

       2340
       2340
       -
       							meetingTimeId,

     

       2655
       2655
       +
       							null, // meeting_time_id will be set via PATCH endpoint

     

       2656
       2656
       +
       							sectionId,

     

       2341
       2657
        
       							filename,

     

       2342
       2658
        
       							file.name,

     

       2343
       2659
        
       							"pending",

     

       2660
       2660
       +
       							recordingDate,

     

       2344
       2661
        
       						],

     

       2345
       2662
        
       					);

     

       2346
       2663
        
       

     

       2347
       2664
        
       					// Don't auto-start transcription - admin will select recordings

     

       2348
       2665
        
       					// whisperService.startTranscription(transcriptionId, filename);

     

       2349
       2666
        
       

     

       2350
       2350
       -
       					return Response.json({

     

       2351
       2351
       -
       						id: transcriptionId,

     

       2352
       2352
       -
       						message: "Upload successful",

     

       2353
       2353
       -
       					});

     

       2667
       2667
       +
       					return Response.json(

     

       2668
       2668
       +
       						{

     

       2669
       2669
       +
       							id: transcriptionId,

     

       2670
       2670
       +
       							message: "Upload successful",

     

       2671
       2671
       +
       						},

     

       2672
       2672
       +
       						{ status: 201 },

     

       2673
       2673
       +
       					);

     

       2354
       2674
        
       				} catch (error) {

     

       2355
       2675
        
       					return handleError(error);

     

       2356
       2676
        
       				}

     
···

       2422
       2742
        
       					requireAdmin(req);

     

       2423
       2743
        
       					const id = req.params.id;

     

       2424
       2744
        
       					deleteWaitlistEntry(id);

     

       2425
       2425
       -
       					return Response.json({ success: true });

     

       2745
       2745
       +
       					return new Response(null, { status: 204 });

     

       2426
       2746
        
       				} catch (error) {

     

       2427
       2747
        
       					return handleError(error);

     

       2428
       2748
        
       				}

     
···

       2434
       2754
        
       					requireAdmin(req);

     

       2435
       2755
        
       					const transcriptionId = req.params.id;

     

       2436
       2756
        
       					deleteTranscription(transcriptionId);

     

       2437
       2437
       -
       					return Response.json({ success: true });

     

       2757
       2757
       +
       					return new Response(null, { status: 204 });

     

       2438
       2758
        
       				} catch (error) {

     

       2439
       2759
        
       					return handleError(error);

     

       2440
       2760
        
       				}

     
···

       2449
       2769
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       2450
       2770
        
       					}

     

       2451
       2771
        
       					await deleteUser(userId);

     

       2452
       2452
       -
       					return Response.json({ success: true });

     

       2772
       2772
       +
       					return new Response(null, { status: 204 });

     

       2453
       2773
        
       				} catch (error) {

     

       2454
       2774
        
       					return handleError(error);

     

       2455
       2775
        
       				}

     
···

       2699
       3019
        
       

     

       2700
       3020
        
       					const { passkeyId } = req.params;

     

       2701
       3021
        
       					deletePasskey(passkeyId, userId);

     

       2702
       2702
       -
       					return Response.json({ success: true });

     

       3022
       3022
       +
       					return new Response(null, { status: 204 });

     

       2703
       3023
        
       				} catch (error) {

     

       2704
       3024
        
       					return handleError(error);

     

       2705
       3025
        
       				}

     
···

       2765
       3085
        
       					if (existing) {

     

       2766
       3086
        
       						return Response.json(

     

       2767
       3087
        
       							{ error: "Email already in use" },

     

       2768
       2768
       -
       							{ status: 400 },

     

       3088
       3088
       +
       							{ status: 409 },

     

       2769
       3089
        
       						);

     

       2770
       3090
        
       					}

     

       2771
       3091
        
       

     
···

       2850
       3170
        
       					}

     

       2851
       3171
        
       

     

       2852
       3172
        
       					deleteAllUserSessions(userId);

     

       2853
       2853
       -
       					return Response.json({ success: true });

     

       3173
       3173
       +
       					return new Response(null, { status: 204 });

     

       2854
       3174
        
       				} catch (error) {

     

       2855
       3175
        
       					return handleError(error);

     

       2856
       3176
        
       				}

     
···

       2875
       3195
        
       						);

     

       2876
       3196
        
       					}

     

       2877
       3197
        
       

     

       2878
       2878
       -
       					return Response.json({ success: true });

     

       3198
       3198
       +
       					return new Response(null, { status: 204 });

     

       2879
       3199
        
       				} catch (error) {

     

       2880
       3200
        
       					return handleError(error);

     

       2881
       3201
        
       				}

     
···

       2952
       3272
        
       						cursor,

     

       2953
       3273
        
       					);

     

       2954
       3274
        
       

     

       2955
       2955
       -
       					// For admin, return flat array. For users, group by semester/year

     

       2956
       2956
       -
       					if (user.role === "admin") {

     

       2957
       2957
       -
       						return Response.json(result.data);

     

       2958
       2958
       -
       					}

     

       2959
       2959
       -
       

     

       2960
       2960
       -
       					// Group by semester/year for regular users

     

       3275
       3275
       +
       					// Group by semester/year for all users

     

       2961
       3276
        
       					const grouped: Record<

     

       2962
       3277
        
       						string,

     

       2963
       3278
        
       						Array<{

     
···

       3056
       3371
        
       						semester,

     

       3057
       3372
        
       						year,

     

       3058
       3373
        
       						meeting_times,

     

       3374
       3374
       +
       						sections: body.sections,

     

       3059
       3375
        
       					});

     

       3060
       3376
        
       

     

       3061
       3061
       -
       					return Response.json(newClass);

     

       3377
       3377
       +
       					return Response.json(newClass, { status: 201 });

     

       3062
       3378
        
       				} catch (error) {

     

       3063
       3379
        
       					return handleError(error);

     

       3064
       3380
        
       				}

     
···

       3085
       3401
        
       						.all(user.id)

     

       3086
       3402
        
       						.map((row) => row.class_id);

     

       3087
       3403
        
       

     

       3088
       3088
       -
       					// Add is_enrolled flag to each class

     

       3404
       3404
       +
       					// Add is_enrolled flag and sections to each class

     

       3089
       3405
        
       					const classesWithEnrollment = classes.map((cls) => ({

     

       3090
       3406
        
       						...cls,

     

       3091
       3407
        
       						is_enrolled: enrolledClassIds.includes(cls.id),

     

       3408
       3408
       +
       						sections: getClassSections(cls.id),

     

       3092
       3409
        
       					}));

     

       3093
       3410
        
       

     

       3094
       3411
        
       					return Response.json({ classes: classesWithEnrollment });

     
···

       3103
       3420
        
       					const user = requireAuth(req);

     

       3104
       3421
        
       					const body = await req.json();

     

       3105
       3422
        
       					const classId = body.class_id;

     

       3423
       3423
       +
       					const sectionId = body.section_id || null;

     

       3106
       3424
        
       

     

       3107
       3425
        
       					const classIdValidation = validateClassId(classId);

     

       3108
       3426
        
       					if (!classIdValidation.valid) {

     
···

       3112
       3430
        
       						);

     

       3113
       3431
        
       					}

     

       3114
       3432
        
       

     

       3115
       3115
       -
       					const result = joinClass(classId, user.id);

     

       3433
       3433
       +
       					const result = joinClass(classId, user.id, sectionId);

     

       3116
       3434
        
       

     

       3117
       3435
        
       					if (!result.success) {

     

       3118
       3436
        
       						return Response.json({ error: result.error }, { status: 400 });

     

       3119
       3437
        
       					}

     

       3120
       3438
        
       

     

       3121
       3121
       -
       					return Response.json({ success: true });

     

       3439
       3439
       +
       					return new Response(null, { status: 204 });

     

       3122
       3440
        
       				} catch (error) {

     

       3123
       3441
        
       					return handleError(error);

     

       3124
       3442
        
       				}

     
···

       3194
       3512
        
       						meetingTimes || null,

     

       3195
       3513
        
       					);

     

       3196
       3514
        
       

     

       3197
       3197
       -
       					return Response.json({ success: true, id });

     

       3515
       3515
       +
       					return Response.json({ success: true, id }, { status: 201 });

     

       3198
       3516
        
       				} catch (error) {

     

       3199
       3517
        
       					return handleError(error);

     

       3200
       3518
        
       				}

     
···

       3221
       3539
        
       					}

     

       3222
       3540
        
       

     

       3223
       3541
        
       					const meetingTimes = getMeetingTimesForClass(classId);

     

       3542
       3542
       +
       					const sections = getClassSections(classId);

     

       3224
       3543
        
       					const transcriptions = getTranscriptionsForClass(classId);

     

       3544
       3544
       +
       					const userSection = getUserSection(user.id, classId);

     

       3225
       3545
        
       

     

       3226
       3546
        
       					return Response.json({

     

       3227
       3547
        
       						class: classInfo,

     

       3228
       3548
        
       						meetingTimes,

     

       3549
       3549
       +
       						sections,

     

       3550
       3550
       +
       						userSection,

     

       3229
       3551
        
       						transcriptions,

     

       3230
       3552
        
       					});

     

       3231
       3553
        
       				} catch (error) {

     
···

       3237
       3559
        
       					requireAdmin(req);

     

       3238
       3560
        
       					const classId = req.params.id;

     

       3239
       3561
        
       

     

       3562
       3562
       +
       					// Verify class exists

     

       3563
       3563
       +
       					const existingClass = getClassById(classId);

     

       3564
       3564
       +
       					if (!existingClass) {

     

       3565
       3565
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3566
       3566
       +
       					}

     

       3567
       3567
       +
       

     

       3240
       3568
        
       					deleteClass(classId);

     

       3241
       3241
       -
       					return Response.json({ success: true });

     

       3569
       3569
       +
       					return new Response(null, { status: 204 });

     

       3242
       3570
        
       				} catch (error) {

     

       3243
       3571
        
       					return handleError(error);

     

       3244
       3572
        
       				}

     
···

       3259
       3587
        
       						);

     

       3260
       3588
        
       					}

     

       3261
       3589
        
       

     

       3590
       3590
       +
       					// Verify class exists

     

       3591
       3591
       +
       					const existingClass = getClassById(classId);

     

       3592
       3592
       +
       					if (!existingClass) {

     

       3593
       3593
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3594
       3594
       +
       					}

     

       3595
       3595
       +
       

     

       3262
       3596
        
       					toggleClassArchive(classId, archived);

     

       3263
       3263
       -
       					return Response.json({ success: true });

     

       3597
       3597
       +
       					return new Response(null, { status: 204 });

     

       3264
       3598
        
       				} catch (error) {

     

       3265
       3599
        
       					return handleError(error);

     

       3266
       3600
        
       				}

     
···

       3289
       3623
        
       						return Response.json({ error: "Email required" }, { status: 400 });

     

       3290
       3624
        
       					}

     

       3291
       3625
        
       

     

       3626
       3626
       +
       					// Verify class exists

     

       3627
       3627
       +
       					const existingClass = getClassById(classId);

     

       3628
       3628
       +
       					if (!existingClass) {

     

       3629
       3629
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3630
       3630
       +
       					}

     

       3631
       3631
       +
       

     

       3292
       3632
        
       					const user = getUserByEmail(email);

     

       3293
       3633
        
       					if (!user) {

     

       3294
       3634
        
       						return Response.json({ error: "User not found" }, { status: 404 });

     

       3295
       3635
        
       					}

     

       3296
       3636
        
       

     

       3297
       3637
        
       					enrollUserInClass(user.id, classId);

     

       3298
       3298
       -
       					return Response.json({ success: true });

     

       3638
       3638
       +
       					return new Response(null, { status: 201 });

     

       3299
       3639
        
       				} catch (error) {

     

       3300
       3640
        
       					return handleError(error);

     

       3301
       3641
        
       				}

     
···

       3312
       3652
        
       						return Response.json({ error: "Invalid user ID" }, { status: 400 });

     

       3313
       3653
        
       					}

     

       3314
       3654
        
       

     

       3655
       3655
       +
       					// Verify class exists

     

       3656
       3656
       +
       					const existingClass = getClassById(classId);

     

       3657
       3657
       +
       					if (!existingClass) {

     

       3658
       3658
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3659
       3659
       +
       					}

     

       3660
       3660
       +
       

     

       3315
       3661
        
       					removeUserFromClass(userId, classId);

     

       3316
       3316
       -
       					return Response.json({ success: true });

     

       3662
       3662
       +
       					return new Response(null, { status: 204 });

     

       3317
       3663
        
       				} catch (error) {

     

       3318
       3664
        
       					return handleError(error);

     

       3319
       3665
        
       				}

     
···

       3351
       3697
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3352
       3698
        
       					}

     

       3353
       3699
        
       

     

       3700
       3700
       +
       					// Verify class exists

     

       3701
       3701
       +
       					const existingClass = getClassById(classId);

     

       3702
       3702
       +
       					if (!existingClass) {

     

       3703
       3703
       +
       						return Response.json({ error: "Class not found" }, { status: 404 });

     

       3704
       3704
       +
       					}

     

       3705
       3705
       +
       

     

       3354
       3706
        
       					const meetingTime = createMeetingTime(classId, label);

     

       3355
       3355
       -
       					return Response.json(meetingTime);

     

       3707
       3707
       +
       					return Response.json(meetingTime, { status: 201 });

     

       3708
       3708
       +
       				} catch (error) {

     

       3709
       3709
       +
       					return handleError(error);

     

       3710
       3710
       +
       				}

     

       3711
       3711
       +
       			},

     

       3712
       3712
       +
       		},

     

       3713
       3713
       +
       		"/api/classes/:id/sections": {

     

       3714
       3714
       +
       			POST: async (req) => {

     

       3715
       3715
       +
       				try {

     

       3716
       3716
       +
       					requireAdmin(req);

     

       3717
       3717
       +
       					const classId = req.params.id;

     

       3718
       3718
       +
       					const body = await req.json();

     

       3719
       3719
       +
       					const { section_number } = body;

     

       3720
       3720
       +
       

     

       3721
       3721
       +
       					if (!section_number) {

     

       3722
       3722
       +
       						return Response.json({ error: "Section number required" }, { status: 400 });

     

       3723
       3723
       +
       					}

     

       3724
       3724
       +
       

     

       3725
       3725
       +
       					const section = createClassSection(classId, section_number);

     

       3726
       3726
       +
       					return Response.json(section);

     

       3727
       3727
       +
       				} catch (error) {

     

       3728
       3728
       +
       					return handleError(error);

     

       3729
       3729
       +
       				}

     

       3730
       3730
       +
       			},

     

       3731
       3731
       +
       		},

     

       3732
       3732
       +
       		"/api/classes/:classId/sections/:sectionId": {

     

       3733
       3733
       +
       			DELETE: async (req) => {

     

       3734
       3734
       +
       				try {

     

       3735
       3735
       +
       					requireAdmin(req);

     

       3736
       3736
       +
       					const sectionId = req.params.sectionId;

     

       3737
       3737
       +
       

     

       3738
       3738
       +
       					// Check if any students are in this section

     

       3739
       3739
       +
       					const studentsInSection = db

     

       3740
       3740
       +
       						.query<{ count: number }, [string]>(

     

       3741
       3741
       +
       							"SELECT COUNT(*) as count FROM class_members WHERE section_id = ?",

     

       3742
       3742
       +
       						)

     

       3743
       3743
       +
       						.get(sectionId);

     

       3744
       3744
       +
       

     

       3745
       3745
       +
       					if (studentsInSection && studentsInSection.count > 0) {

     

       3746
       3746
       +
       						return Response.json(

     

       3747
       3747
       +
       							{ error: "Cannot delete section with enrolled students" },

     

       3748
       3748
       +
       							{ status: 400 },

     

       3749
       3749
       +
       						);

     

       3750
       3750
       +
       					}

     

       3751
       3751
       +
       

     

       3752
       3752
       +
       					db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       3753
       3753
       +
       					return new Response(null, { status: 204 });

     

       3356
       3754
        
       				} catch (error) {

     

       3357
       3755
        
       					return handleError(error);

     

       3358
       3756
        
       				}

     
···

       3370
       3768
        
       						return Response.json({ error: "Label required" }, { status: 400 });

     

       3371
       3769
        
       					}

     

       3372
       3770
        
       

     

       3771
       3771
       +
       					// Verify meeting exists

     

       3772
       3772
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3773
       3773
       +
       					if (!existingMeeting) {

     

       3774
       3774
       +
       						return Response.json(

     

       3775
       3775
       +
       							{ error: "Meeting not found" },

     

       3776
       3776
       +
       							{ status: 404 },

     

       3777
       3777
       +
       						);

     

       3778
       3778
       +
       					}

     

       3779
       3779
       +
       

     

       3373
       3780
        
       					updateMeetingTime(meetingId, label);

     

       3374
       3374
       -
       					return Response.json({ success: true });

     

       3781
       3781
       +
       					return new Response(null, { status: 204 });

     

       3375
       3782
        
       				} catch (error) {

     

       3376
       3783
        
       					return handleError(error);

     

       3377
       3784
        
       				}

     
···

       3381
       3788
        
       					requireAdmin(req);

     

       3382
       3789
        
       					const meetingId = req.params.id;

     

       3383
       3790
        
       

     

       3791
       3791
       +
       					// Verify meeting exists

     

       3792
       3792
       +
       					const existingMeeting = getMeetingById(meetingId);

     

       3793
       3793
       +
       					if (!existingMeeting) {

     

       3794
       3794
       +
       						return Response.json(

     

       3795
       3795
       +
       							{ error: "Meeting not found" },

     

       3796
       3796
       +
       							{ status: 404 },

     

       3797
       3797
       +
       						);

     

       3798
       3798
       +
       					}

     

       3799
       3799
       +
       

     

       3384
       3800
        
       					deleteMeetingTime(meetingId);

     

       3385
       3385
       -
       					return Response.json({ success: true });

     

       3801
       3801
       +
       					return new Response(null, { status: 204 });

     

       3386
       3802
        
       				} catch (error) {

     

       3387
       3803
        
       					return handleError(error);

     

       3388
       3804
        
       				}

     
···

       3430
       3846
        
       						transcription.filename,

     

       3431
       3847
        
       					);

     

       3432
       3848
        
       

     

       3433
       3433
       -
       					return Response.json({ success: true });

     

       3849
       3849
       +
       					return new Response(null, { status: 204 });

     

       3434
       3850
        
       				} catch (error) {

     

       3435
       3851
        
       					return handleError(error);

     

       3436
       3852
        
       				}

     

       3437
       3853
        
       			},

     

       3438
       3854
        
       		},

     

       3439
       3855
        
       	},

     

       3440
       3440
       -
       	development: {

     

       3441
       3441
       -
       		hmr: true,

     

       3442
       3442
       -
       		console: true,

     

       3856
       3856
       +
       	development: process.env.NODE_ENV === "dev",

     

       3857
       3857
       +
       	fetch(req, server) {

     

       3858
       3858
       +
       		const response = server.fetch(req);

     

       3859
       3859
       +
       

     

       3860
       3860
       +
       		// Add security headers to all responses

     

       3861
       3861
       +
       		if (response instanceof Response) {

     

       3862
       3862
       +
       			const headers = new Headers(response.headers);

     

       3863
       3863
       +
       			headers.set("Permissions-Policy", "interest-cohort=()");

     

       3864
       3864
       +
       			headers.set("X-Content-Type-Options", "nosniff");

     

       3865
       3865
       +
       			headers.set("X-Frame-Options", "DENY");

     

       3866
       3866
       +
       			headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

     

       3867
       3867
       +
       

     

       3868
       3868
       +
       			// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)

     

       3869
       3869
       +
       			// and script-src 'self' for bundled scripts

     

       3870
       3870
       +
       			headers.set(

     

       3871
       3871
       +
       				"Content-Security-Policy",

     

       3872
       3872
       +
       				"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",

     

       3873
       3873
       +
       			);

     

       3874
       3874
       +
       

     

       3875
       3875
       +
       			return new Response(response.body, {

     

       3876
       3876
       +
       				status: response.status,

     

       3877
       3877
       +
       				statusText: response.statusText,

     

       3878
       3878
       +
       				headers,

     

       3879
       3879
       +
       			});

     

       3880
       3880
       +
       		}

     

       3881
       3881
       +
       

     

       3882
       3882
       +
       		return response;

     

       3443
       3883
        
       	},

     

       3444
       3884
        
       });

     

       3445
       3885
        
       console.log(`🪻 Thistle running at http://localhost:${server.port}`);

+55

src/lib/audio-metadata.integration.test.ts

···

       1
       1
       +
       import { afterAll, describe, expect, test } from "bun:test";

     

       2
       2
       +
       import { extractAudioCreationDate } from "./audio-metadata";

     

       3
       3
       +
       

     

       4
       4
       +
       describe("extractAudioCreationDate (integration)", () => {

     

       5
       5
       +
       	const testAudioPath = "./test-audio-sample.m4a";

     

       6
       6
       +
       

     

       7
       7
       +
       	// Clean up test file after tests

     

       8
       8
       +
       	afterAll(async () => {

     

       9
       9
       +
       		try {

     

       10
       10
       +
       			await Bun.file(testAudioPath).exists().then(async (exists) => {

     

       11
       11
       +
       				if (exists) {

     

       12
       12
       +
       					await Bun.$`rm ${testAudioPath}`;

     

       13
       13
       +
       				}

     

       14
       14
       +
       			});

     

       15
       15
       +
       		} catch {

     

       16
       16
       +
       			// Ignore cleanup errors

     

       17
       17
       +
       		}

     

       18
       18
       +
       	});

     

       19
       19
       +
       

     

       20
       20
       +
       	test("extracts creation date from audio file with metadata", async () => {

     

       21
       21
       +
       		// Create a test audio file with metadata using ffmpeg

     

       22
       22
       +
       		// 1 second silent audio with creation_time metadata

     

       23
       23
       +
       		const creationTime = "2024-01-15T14:30:00.000000Z";

     

       24
       24
       +
       

     

       25
       25
       +
       		// Create the file with metadata

     

       26
       26
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -metadata creation_time=${creationTime} -y ${testAudioPath}`.quiet();

     

       27
       27
       +
       

     

       28
       28
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       29
       29
       +
       

     

       30
       30
       +
       		expect(date).not.toBeNull();

     

       31
       31
       +
       		expect(date).toBeInstanceOf(Date);

     

       32
       32
       +
       		// JavaScript Date.toISOString() uses 3 decimal places, not 6 like the input

     

       33
       33
       +
       		expect(date?.toISOString()).toBe("2024-01-15T14:30:00.000Z");

     

       34
       34
       +
       	});

     

       35
       35
       +
       

     

       36
       36
       +
       	test("returns null for audio file without creation_time metadata", async () => {

     

       37
       37
       +
       		// Create audio file without metadata

     

       38
       38
       +
       		await Bun.$`ffmpeg -f lavfi -i anullsrc=r=44100:cl=mono -t 1 -y ${testAudioPath}`.quiet();

     

       39
       39
       +
       

     

       40
       40
       +
       		const date = await extractAudioCreationDate(testAudioPath);

     

       41
       41
       +
       

     

       42
       42
       +
       		// Should use file modification time as fallback

     

       43
       43
       +
       		expect(date).not.toBeNull();

     

       44
       44
       +
       		expect(date).toBeInstanceOf(Date);

     

       45
       45
       +
       		// Should be very recent (within last minute)

     

       46
       46
       +
       		const now = new Date();

     

       47
       47
       +
       		const diff = now.getTime() - (date?.getTime() ?? 0);

     

       48
       48
       +
       		expect(diff).toBeLessThan(60000); // Less than 1 minute

     

       49
       49
       +
       	});

     

       50
       50
       +
       

     

       51
       51
       +
       	test("returns null for non-existent file", async () => {

     

       52
       52
       +
       		const date = await extractAudioCreationDate("./non-existent-file.m4a");

     

       53
       53
       +
       		expect(date).toBeNull();

     

       54
       54
       +
       	});

     

       55
       55
       +
       });

+128

src/lib/audio-metadata.test.ts

···

       1
       1
       +
       import { describe, expect, test } from "bun:test";

     

       2
       2
       +
       import {

     

       3
       3
       +
       	findMatchingMeetingTime,

     

       4
       4
       +
       	getDayName,

     

       5
       5
       +
       	getDayOfWeek,

     

       6
       6
       +
       	meetingTimeLabelMatchesDay,

     

       7
       7
       +
       } from "./audio-metadata";

     

       8
       8
       +
       

     

       9
       9
       +
       describe("getDayOfWeek", () => {

     

       10
       10
       +
       	test("returns correct day number", () => {

     

       11
       11
       +
       		// January 1, 2024 is a Monday (day 1)

     

       12
       12
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       13
       13
       +
       		expect(getDayOfWeek(monday)).toBe(1);

     

       14
       14
       +
       

     

       15
       15
       +
       		// January 7, 2024 is a Sunday (day 0)

     

       16
       16
       +
       		const sunday = new Date("2024-01-07T12:00:00Z");

     

       17
       17
       +
       		expect(getDayOfWeek(sunday)).toBe(0);

     

       18
       18
       +
       

     

       19
       19
       +
       		// January 6, 2024 is a Saturday (day 6)

     

       20
       20
       +
       		const saturday = new Date("2024-01-06T12:00:00Z");

     

       21
       21
       +
       		expect(getDayOfWeek(saturday)).toBe(6);

     

       22
       22
       +
       	});

     

       23
       23
       +
       });

     

       24
       24
       +
       

     

       25
       25
       +
       describe("getDayName", () => {

     

       26
       26
       +
       	test("returns correct day name", () => {

     

       27
       27
       +
       		expect(getDayName(new Date("2024-01-01T12:00:00Z"))).toBe("Monday");

     

       28
       28
       +
       		expect(getDayName(new Date("2024-01-02T12:00:00Z"))).toBe("Tuesday");

     

       29
       29
       +
       		expect(getDayName(new Date("2024-01-03T12:00:00Z"))).toBe("Wednesday");

     

       30
       30
       +
       		expect(getDayName(new Date("2024-01-04T12:00:00Z"))).toBe("Thursday");

     

       31
       31
       +
       		expect(getDayName(new Date("2024-01-05T12:00:00Z"))).toBe("Friday");

     

       32
       32
       +
       		expect(getDayName(new Date("2024-01-06T12:00:00Z"))).toBe("Saturday");

     

       33
       33
       +
       		expect(getDayName(new Date("2024-01-07T12:00:00Z"))).toBe("Sunday");

     

       34
       34
       +
       	});

     

       35
       35
       +
       });

     

       36
       36
       +
       

     

       37
       37
       +
       describe("meetingTimeLabelMatchesDay", () => {

     

       38
       38
       +
       	test("matches full day names", () => {

     

       39
       39
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Monday")).toBe(true);

     

       40
       40
       +
       		expect(meetingTimeLabelMatchesDay("Tuesday Lab", "Tuesday")).toBe(true);

     

       41
       41
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Discussion", "Wednesday")).toBe(

     

       42
       42
       +
       			true,

     

       43
       43
       +
       		);

     

       44
       44
       +
       	});

     

       45
       45
       +
       

     

       46
       46
       +
       	test("matches 3-letter abbreviations", () => {

     

       47
       47
       +
       		expect(meetingTimeLabelMatchesDay("Mon Lecture", "Monday")).toBe(true);

     

       48
       48
       +
       		expect(meetingTimeLabelMatchesDay("Tue Lab", "Tuesday")).toBe(true);

     

       49
       49
       +
       		expect(meetingTimeLabelMatchesDay("Wed Discussion", "Wednesday")).toBe(

     

       50
       50
       +
       			true,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		expect(meetingTimeLabelMatchesDay("Thu Seminar", "Thursday")).toBe(true);

     

       53
       53
       +
       		expect(meetingTimeLabelMatchesDay("Fri Workshop", "Friday")).toBe(true);

     

       54
       54
       +
       		expect(meetingTimeLabelMatchesDay("Sat Review", "Saturday")).toBe(true);

     

       55
       55
       +
       		expect(meetingTimeLabelMatchesDay("Sun Study", "Sunday")).toBe(true);

     

       56
       56
       +
       	});

     

       57
       57
       +
       

     

       58
       58
       +
       	test("is case insensitive", () => {

     

       59
       59
       +
       		expect(meetingTimeLabelMatchesDay("MONDAY LECTURE", "Monday")).toBe(true);

     

       60
       60
       +
       		expect(meetingTimeLabelMatchesDay("monday lecture", "Monday")).toBe(true);

     

       61
       61
       +
       		expect(meetingTimeLabelMatchesDay("MoNdAy LeCTuRe", "Monday")).toBe(true);

     

       62
       62
       +
       	});

     

       63
       63
       +
       

     

       64
       64
       +
       	test("does not match wrong days", () => {

     

       65
       65
       +
       		expect(meetingTimeLabelMatchesDay("Monday Lecture", "Tuesday")).toBe(false);

     

       66
       66
       +
       		expect(meetingTimeLabelMatchesDay("Wednesday Lab", "Thursday")).toBe(false);

     

       67
       67
       +
       		expect(meetingTimeLabelMatchesDay("Lecture Hall A", "Monday")).toBe(false);

     

       68
       68
       +
       	});

     

       69
       69
       +
       

     

       70
       70
       +
       	test("handles labels without day names", () => {

     

       71
       71
       +
       		expect(meetingTimeLabelMatchesDay("Lecture", "Monday")).toBe(false);

     

       72
       72
       +
       		expect(meetingTimeLabelMatchesDay("Lab Session", "Tuesday")).toBe(false);

     

       73
       73
       +
       		expect(meetingTimeLabelMatchesDay("Section A", "Wednesday")).toBe(false);

     

       74
       74
       +
       	});

     

       75
       75
       +
       });

     

       76
       76
       +
       

     

       77
       77
       +
       describe("findMatchingMeetingTime", () => {

     

       78
       78
       +
       	const meetingTimes = [

     

       79
       79
       +
       		{ id: "mt1", label: "Monday Lecture" },

     

       80
       80
       +
       		{ id: "mt2", label: "Wednesday Discussion" },

     

       81
       81
       +
       		{ id: "mt3", label: "Friday Lab" },

     

       82
       82
       +
       	];

     

       83
       83
       +
       

     

       84
       84
       +
       	test("finds correct meeting time for full day name", () => {

     

       85
       85
       +
       		const monday = new Date("2024-01-01T12:00:00Z"); // Monday

     

       86
       86
       +
       		expect(findMatchingMeetingTime(monday, meetingTimes)).toBe("mt1");

     

       87
       87
       +
       

     

       88
       88
       +
       		const wednesday = new Date("2024-01-03T12:00:00Z"); // Wednesday

     

       89
       89
       +
       		expect(findMatchingMeetingTime(wednesday, meetingTimes)).toBe("mt2");

     

       90
       90
       +
       

     

       91
       91
       +
       		const friday = new Date("2024-01-05T12:00:00Z"); // Friday

     

       92
       92
       +
       		expect(findMatchingMeetingTime(friday, meetingTimes)).toBe("mt3");

     

       93
       93
       +
       	});

     

       94
       94
       +
       

     

       95
       95
       +
       	test("finds correct meeting time for abbreviated day name", () => {

     

       96
       96
       +
       		const abbrevMeetingTimes = [

     

       97
       97
       +
       			{ id: "mt1", label: "Mon Lecture" },

     

       98
       98
       +
       			{ id: "mt2", label: "Wed Discussion" },

     

       99
       99
       +
       			{ id: "mt3", label: "Fri Lab" },

     

       100
       100
       +
       		];

     

       101
       101
       +
       

     

       102
       102
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       103
       103
       +
       		expect(findMatchingMeetingTime(monday, abbrevMeetingTimes)).toBe("mt1");

     

       104
       104
       +
       	});

     

       105
       105
       +
       

     

       106
       106
       +
       	test("returns null when no match found", () => {

     

       107
       107
       +
       		const tuesday = new Date("2024-01-02T12:00:00Z"); // Tuesday

     

       108
       108
       +
       		expect(findMatchingMeetingTime(tuesday, meetingTimes)).toBe(null);

     

       109
       109
       +
       

     

       110
       110
       +
       		const saturday = new Date("2024-01-06T12:00:00Z"); // Saturday

     

       111
       111
       +
       		expect(findMatchingMeetingTime(saturday, meetingTimes)).toBe(null);

     

       112
       112
       +
       	});

     

       113
       113
       +
       

     

       114
       114
       +
       	test("returns null for empty meeting times", () => {

     

       115
       115
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       116
       116
       +
       		expect(findMatchingMeetingTime(monday, [])).toBe(null);

     

       117
       117
       +
       	});

     

       118
       118
       +
       

     

       119
       119
       +
       	test("returns first match when multiple matches exist", () => {

     

       120
       120
       +
       		const duplicateMeetingTimes = [

     

       121
       121
       +
       			{ id: "mt1", label: "Monday Lecture" },

     

       122
       122
       +
       			{ id: "mt2", label: "Monday Lab" },

     

       123
       123
       +
       		];

     

       124
       124
       +
       

     

       125
       125
       +
       		const monday = new Date("2024-01-01T12:00:00Z");

     

       126
       126
       +
       		expect(findMatchingMeetingTime(monday, duplicateMeetingTimes)).toBe("mt1");

     

       127
       127
       +
       	});

     

       128
       128
       +
       });

+144

src/lib/audio-metadata.ts

···

       1
       1
       +
       import { $ } from "bun";

     

       2
       2
       +
       

     

       3
       3
       +
       /**

     

       4
       4
       +
        * Extracts creation date from audio file metadata using ffprobe

     

       5
       5
       +
        * Falls back to file birth time (original creation) if no metadata found

     

       6
       6
       +
        * @param filePath Path to audio file

     

       7
       7
       +
        * @returns Date object or null if not found

     

       8
       8
       +
        */

     

       9
       9
       +
       export async function extractAudioCreationDate(

     

       10
       10
       +
       	filePath: string,

     

       11
       11
       +
       ): Promise<Date | null> {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		// Use ffprobe to extract creation_time metadata

     

       14
       14
       +
       		// -v quiet: suppress verbose output

     

       15
       15
       +
       		// -print_format json: output as JSON

     

       16
       16
       +
       		// -show_entries format_tags: show all tags to search for date fields

     

       17
       17
       +
       		const result =

     

       18
       18
       +
       			await $`ffprobe -v quiet -print_format json -show_entries format_tags ${filePath}`.text();

     

       19
       19
       +
       

     

       20
       20
       +
       		const metadata = JSON.parse(result);

     

       21
       21
       +
       		const tags = metadata?.format?.tags || {};

     

       22
       22
       +
       

     

       23
       23
       +
       		// Try multiple metadata fields that might contain creation date

     

       24
       24
       +
       		const dateFields = [

     

       25
       25
       +
       			tags.creation_time, // Standard creation_time

     

       26
       26
       +
       			tags.date, // Common date field

     

       27
       27
       +
       			tags.DATE, // Uppercase variant

     

       28
       28
       +
       			tags.year, // Year field

     

       29
       29
       +
       			tags.YEAR, // Uppercase variant

     

       30
       30
       +
       			tags["com.apple.quicktime.creationdate"], // Apple QuickTime

     

       31
       31
       +
       			tags.TDRC, // ID3v2 recording time

     

       32
       32
       +
       			tags.TDRL, // ID3v2 release time

     

       33
       33
       +
       		];

     

       34
       34
       +
       

     

       35
       35
       +
       		for (const dateField of dateFields) {

     

       36
       36
       +
       			if (dateField) {

     

       37
       37
       +
       				const date = new Date(dateField);

     

       38
       38
       +
       				if (!Number.isNaN(date.getTime())) {

     

       39
       39
       +
       					console.log(

     

       40
       40
       +
       						`[AudioMetadata] Extracted creation date from metadata: ${date.toISOString()} from ${filePath}`,

     

       41
       41
       +
       					);

     

       42
       42
       +
       					return date;

     

       43
       43
       +
       				}

     

       44
       44
       +
       			}

     

       45
       45
       +
       		}

     

       46
       46
       +
       

     

       47
       47
       +
       		// Fallback: use file birth time (original creation time on filesystem)

     

       48
       48
       +
       		// This preserves the original file creation date better than mtime

     

       49
       49
       +
       		console.log(

     

       50
       50
       +
       			`[AudioMetadata] No creation_time metadata found, using file birth time`,

     

       51
       51
       +
       		);

     

       52
       52
       +
       		const file = Bun.file(filePath);

     

       53
       53
       +
       		const stat = await file.stat();

     

       54
       54
       +
       		const date = new Date(stat.birthtime || stat.mtime);

     

       55
       55
       +
       		console.log(

     

       56
       56
       +
       			`[AudioMetadata] Using file birth time: ${date.toISOString()} from ${filePath}`,

     

       57
       57
       +
       		);

     

       58
       58
       +
       		return date;

     

       59
       59
       +
       	} catch (error) {

     

       60
       60
       +
       		console.error(

     

       61
       61
       +
       			`[AudioMetadata] Failed to extract metadata from ${filePath}:`,

     

       62
       62
       +
       			error instanceof Error ? error.message : "Unknown error",

     

       63
       63
       +
       		);

     

       64
       64
       +
       		return null;

     

       65
       65
       +
       	}

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       /**

     

       69
       69
       +
        * Gets day of week from a date (0 = Sunday, 6 = Saturday)

     

       70
       70
       +
        */

     

       71
       71
       +
       export function getDayOfWeek(date: Date): number {

     

       72
       72
       +
       	return date.getDay();

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       /**

     

       76
       76
       +
        * Gets day name from a date

     

       77
       77
       +
        */

     

       78
       78
       +
       export function getDayName(date: Date): string {

     

       79
       79
       +
       	const days = [

     

       80
       80
       +
       		"Sunday",

     

       81
       81
       +
       		"Monday",

     

       82
       82
       +
       		"Tuesday",

     

       83
       83
       +
       		"Wednesday",

     

       84
       84
       +
       		"Thursday",

     

       85
       85
       +
       		"Friday",

     

       86
       86
       +
       		"Saturday",

     

       87
       87
       +
       	];

     

       88
       88
       +
       	return days[date.getDay()] || "Unknown";

     

       89
       89
       +
       }

     

       90
       90
       +
       

     

       91
       91
       +
       /**

     

       92
       92
       +
        * Checks if a meeting time label matches a specific day

     

       93
       93
       +
        * Labels like "Monday Lecture", "Tuesday Lab", "Wed Discussion" should match

     

       94
       94
       +
        */

     

       95
       95
       +
       export function meetingTimeLabelMatchesDay(

     

       96
       96
       +
       	label: string,

     

       97
       97
       +
       	dayName: string,

     

       98
       98
       +
       ): boolean {

     

       99
       99
       +
       	const lowerLabel = label.toLowerCase();

     

       100
       100
       +
       	const lowerDay = dayName.toLowerCase();

     

       101
       101
       +
       

     

       102
       102
       +
       	// Check for full day name

     

       103
       103
       +
       	if (lowerLabel.includes(lowerDay)) {

     

       104
       104
       +
       		return true;

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	// Check for 3-letter abbreviations

     

       108
       108
       +
       	const abbrev = dayName.slice(0, 3).toLowerCase();

     

       109
       109
       +
       	if (lowerLabel.includes(abbrev)) {

     

       110
       110
       +
       		return true;

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	return false;

     

       114
       114
       +
       }

     

       115
       115
       +
       

     

       116
       116
       +
       /**

     

       117
       117
       +
        * Finds the best matching meeting time for a given date

     

       118
       118
       +
        * @param date Date from audio metadata

     

       119
       119
       +
        * @param meetingTimes Available meeting times for the class

     

       120
       120
       +
        * @returns Meeting time ID or null if no match

     

       121
       121
       +
        */

     

       122
       122
       +
       export function findMatchingMeetingTime(

     

       123
       123
       +
       	date: Date,

     

       124
       124
       +
       	meetingTimes: Array<{ id: string; label: string }>,

     

       125
       125
       +
       ): string | null {

     

       126
       126
       +
       	const dayName = getDayName(date);

     

       127
       127
       +
       

     

       128
       128
       +
       	// Find meeting time that matches the day

     

       129
       129
       +
       	const match = meetingTimes.find((mt) =>

     

       130
       130
       +
       		meetingTimeLabelMatchesDay(mt.label, dayName),

     

       131
       131
       +
       	);

     

       132
       132
       +
       

     

       133
       133
       +
       	if (match) {

     

       134
       134
       +
       		console.log(

     

       135
       135
       +
       			`[AudioMetadata] Matched ${dayName} to meeting time: ${match.label}`,

     

       136
       136
       +
       		);

     

       137
       137
       +
       		return match.id;

     

       138
       138
       +
       	}

     

       139
       139
       +
       

     

       140
       140
       +
       	console.log(

     

       141
       141
       +
       		`[AudioMetadata] No meeting time found matching ${dayName} in available options: ${meetingTimes.map((mt) => mt.label).join(", ")}`,

     

       142
       142
       +
       	);

     

       143
       143
       +
       	return null;

     

       144
       144
       +
       }

+34

src/lib/auth.test.ts

···

       130
       130
        
       	};

     

       131
       131
        
       	expect(typeof result.count).toBe("number");

     

       132
       132
        
       });

     

       133
       133
       +
       

     

       134
       134
       +
       test("enforces maximum session limit per user", () => {

     

       135
       135
       +
       	const userId = 999;

     

       136
       136
       +
       

     

       137
       137
       +
       	// Clean up any existing sessions for this user

     

       138
       138
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       139
       139
       +
       

     

       140
       140
       +
       	// Create 11 sessions (limit is 10)

     

       141
       141
       +
       	const sessionIds: string[] = [];

     

       142
       142
       +
       	for (let i = 0; i < 11; i++) {

     

       143
       143
       +
       		const sessionId = createSession(userId, `192.168.1.${i}`, `Agent ${i}`);

     

       144
       144
       +
       		sessionIds.push(sessionId);

     

       145
       145
       +
       	}

     

       146
       146
       +
       

     

       147
       147
       +
       	// Count total sessions for user

     

       148
       148
       +
       	const sessionCount = db

     

       149
       149
       +
       		.query<{ count: number }, [number]>(

     

       150
       150
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       151
       151
       +
       		)

     

       152
       152
       +
       		.get(userId);

     

       153
       153
       +
       

     

       154
       154
       +
       	expect(sessionCount?.count).toBe(10);

     

       155
       155
       +
       

     

       156
       156
       +
       	// First session should be deleted (oldest)

     

       157
       157
       +
       	const firstSession = getSession(sessionIds[0]);

     

       158
       158
       +
       	expect(firstSession).toBeNull();

     

       159
       159
       +
       

     

       160
       160
       +
       	// Last session should exist (newest)

     

       161
       161
       +
       	const lastSession = getSession(sessionIds[10]);

     

       162
       162
       +
       	expect(lastSession).not.toBeNull();

     

       163
       163
       +
       

     

       164
       164
       +
       	// Cleanup

     

       165
       165
       +
       	db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);

     

       166
       166
       +
       });

+22

src/lib/auth.ts

···

       1
       1
        
       import db from "../db/schema";

     

       2
       2
        
       

     

       3
       3
        
       const SESSION_DURATION = 7 * 24 * 60 * 60; // 7 days in seconds

     

       4
       4
       +
       const MAX_SESSIONS_PER_USER = 10; // Maximum number of sessions per user

     

       4
       5
        
       

     

       5
       6
        
       export type UserRole = "user" | "admin";

     

       6
       7
        
       

     
···

       30
       31
        
       ): string {

     

       31
       32
        
       	const sessionId = crypto.randomUUID();

     

       32
       33
        
       	const expiresAt = Math.floor(Date.now() / 1000) + SESSION_DURATION;

     

       34
       34
       +
       

     

       35
       35
       +
       	// Check current session count for user

     

       36
       36
       +
       	const sessionCount = db

     

       37
       37
       +
       		.query<{ count: number }, [number]>(

     

       38
       38
       +
       			"SELECT COUNT(*) as count FROM sessions WHERE user_id = ?",

     

       39
       39
       +
       		)

     

       40
       40
       +
       		.get(userId);

     

       41
       41
       +
       

     

       42
       42
       +
       	// If at or over limit, delete oldest session(s)

     

       43
       43
       +
       	if (sessionCount && sessionCount.count >= MAX_SESSIONS_PER_USER) {

     

       44
       44
       +
       		const sessionsToDelete = sessionCount.count - MAX_SESSIONS_PER_USER + 1;

     

       45
       45
       +
       		db.run(

     

       46
       46
       +
       			`DELETE FROM sessions WHERE id IN (

     

       47
       47
       +
       				SELECT id FROM sessions 

     

       48
       48
       +
       				WHERE user_id = ? 

     

       49
       49
       +
       				ORDER BY created_at ASC 

     

       50
       50
       +
       				LIMIT ?

     

       51
       51
       +
       			)`,

     

       52
       52
       +
       			[userId, sessionsToDelete],

     

       53
       53
       +
       		);

     

       54
       54
       +
       	}

     

       33
       55
        
       

     

       34
       56
        
       	db.run(

     

       35
       57
        
       		"INSERT INTO sessions (id, user_id, ip_address, user_agent, expires_at) VALUES (?, ?, ?, ?, ?)",

+107 -7

src/lib/classes.ts

···

       9
       9
        
       	semester: string;

     

       10
       10
        
       	year: number;

     

       11
       11
        
       	archived: boolean;

     

       12
       12
       +
       	section_number?: string | null;

     

       13
       13
       +
       	created_at: number;

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       export interface ClassSection {

     

       17
       17
       +
       	id: string;

     

       18
       18
       +
       	class_id: string;

     

       19
       19
       +
       	section_number: string;

     

       12
       20
        
       	created_at: number;

     

       13
       21
        
       }

     

       14
       22
        
       

     
···

       22
       30
        
       export interface ClassMember {

     

       23
       31
        
       	class_id: string;

     

       24
       32
        
       	user_id: number;

     

       33
       33
       +
       	section_id: string | null;

     

       25
       34
        
       	enrolled_at: number;

     

       26
       35
        
       }

     

       27
       36
        
       

     
···

       204
       213
        
       	semester: string;

     

       205
       214
        
       	year: number;

     

       206
       215
        
       	meeting_times?: string[];

     

       216
       216
       +
       	sections?: string[];

     

       207
       217
        
       }): Class {

     

       208
       218
        
       	const id = nanoid();

     

       209
       219
        
       	const now = Math.floor(Date.now() / 1000);

     
···

       225
       235
        
       	if (data.meeting_times && data.meeting_times.length > 0) {

     

       226
       236
        
       		for (const label of data.meeting_times) {

     

       227
       237
        
       			createMeetingTime(id, label);

     

       238
       238
       +
       		}

     

       239
       239
       +
       	}

     

       240
       240
       +
       

     

       241
       241
       +
       	// Create sections if provided

     

       242
       242
       +
       	if (data.sections && data.sections.length > 0) {

     

       243
       243
       +
       		for (const sectionNumber of data.sections) {

     

       244
       244
       +
       			createClassSection(id, sectionNumber);

     

       228
       245
        
       		}

     

       229
       246
        
       	}

     

       230
       247
        
       

     
···

       264
       281
        
       /**

     

       265
       282
        
        * Enroll a user in a class

     

       266
       283
        
        */

     

       267
       267
       -
       export function enrollUserInClass(userId: number, classId: string): void {

     

       284
       284
       +
       export function enrollUserInClass(

     

       285
       285
       +
       	userId: number,

     

       286
       286
       +
       	classId: string,

     

       287
       287
       +
       	sectionId?: string | null,

     

       288
       288
       +
       ): void {

     

       268
       289
        
       	const now = Math.floor(Date.now() / 1000);

     

       269
       290
        
       	db.run(

     

       270
       270
       -
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       271
       271
       -
       		[classId, userId, now],

     

       291
       291
       +
       		"INSERT OR IGNORE INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       292
       292
       +
       		[classId, userId, sectionId ?? null, now],

     

       272
       293
        
       	);

     

       273
       294
        
       }

     

       274
       295
        
       

     
···

       338
       359
        
       }

     

       339
       360
        
       

     

       340
       361
        
       /**

     

       362
       362
       +
        * Get a single meeting time by ID

     

       363
       363
       +
        */

     

       364
       364
       +
       export function getMeetingById(meetingId: string): MeetingTime | null {

     

       365
       365
       +
       	const result = db

     

       366
       366
       +
       		.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")

     

       367
       367
       +
       		.get(meetingId);

     

       368
       368
       +
       	return result ?? null;

     

       369
       369
       +
       }

     

       370
       370
       +
       

     

       371
       371
       +
       /**

     

       341
       372
        
        * Update a meeting time label

     

       342
       373
        
        */

     

       343
       374
        
       export function updateMeetingTime(meetingId: string, label: string): void {

     
···

       361
       392
        
       				id: string;

     

       362
       393
        
       				user_id: number;

     

       363
       394
        
       				meeting_time_id: string | null;

     

       395
       395
       +
       				section_id: string | null;

     

       364
       396
        
       				filename: string;

     

       365
       397
        
       				original_filename: string;

     

       366
       398
        
       				status: string;

     
···

       371
       403
        
       			},

     

       372
       404
        
       			[string]

     

       373
       405
        
       		>(

     

       374
       374
       -
       			`SELECT id, user_id, meeting_time_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       406
       406
       +
       			`SELECT id, user_id, meeting_time_id, section_id, filename, original_filename, status, progress, error_message, created_at, updated_at

     

       375
       407
        
              FROM transcriptions

     

       376
       408
        
              WHERE class_id = ?

     

       377
       377
       -
              ORDER BY created_at DESC`,

     

       409
       409
       +
              ORDER BY recording_date DESC, created_at DESC`,

     

       378
       410
        
       		)

     

       379
       411
        
       		.all(classId);

     

       380
       412
        
       }

     
···

       399
       431
        
       export function joinClass(

     

       400
       432
        
       	classId: string,

     

       401
       433
        
       	userId: number,

     

       434
       434
       +
       	sectionId?: string | null,

     

       402
       435
        
       ): { success: boolean; error?: string } {

     

       403
       436
        
       	// Find class by ID

     

       404
       437
        
       	const cls = db

     
···

       422
       455
        
       

     

       423
       456
        
       	if (existing) {

     

       424
       457
        
       		return { success: false, error: "Already enrolled in this class" };

     

       458
       458
       +
       	}

     

       459
       459
       +
       

     

       460
       460
       +
       	// Check if class has sections and require one to be selected

     

       461
       461
       +
       	const sections = getClassSections(classId);

     

       462
       462
       +
       	if (sections.length > 0 && !sectionId) {

     

       463
       463
       +
       		return { success: false, error: "Please select a section" };

     

       464
       464
       +
       	}

     

       465
       465
       +
       

     

       466
       466
       +
       	// If section provided, validate it exists and belongs to this class

     

       467
       467
       +
       	if (sectionId) {

     

       468
       468
       +
       		const section = sections.find((s) => s.id === sectionId);

     

       469
       469
       +
       		if (!section) {

     

       470
       470
       +
       			return { success: false, error: "Invalid section selected" };

     

       471
       471
       +
       		}

     

       425
       472
        
       	}

     

       426
       473
        
       

     

       427
       474
        
       	// Enroll user

     

       428
       475
        
       	db.query(

     

       429
       429
       -
       		"INSERT INTO class_members (class_id, user_id, enrolled_at) VALUES (?, ?, ?)",

     

       430
       430
       -
       	).run(cls.id, userId, Math.floor(Date.now() / 1000));

     

       476
       476
       +
       		"INSERT INTO class_members (class_id, user_id, section_id, enrolled_at) VALUES (?, ?, ?, ?)",

     

       477
       477
       +
       	).run(cls.id, userId, sectionId ?? null, Math.floor(Date.now() / 1000));

     

       431
       478
        
       

     

       432
       479
        
       	return { success: true };

     

       480
       480
       +
       }

     

       481
       481
       +
       

     

       482
       482
       +
       /**

     

       483
       483
       +
        * Create a section for a class

     

       484
       484
       +
        */

     

       485
       485
       +
       export function createClassSection(

     

       486
       486
       +
       	classId: string,

     

       487
       487
       +
       	sectionNumber: string,

     

       488
       488
       +
       ): ClassSection {

     

       489
       489
       +
       	const id = nanoid();

     

       490
       490
       +
       	const now = Math.floor(Date.now() / 1000);

     

       491
       491
       +
       

     

       492
       492
       +
       	db.run(

     

       493
       493
       +
       		"INSERT INTO class_sections (id, class_id, section_number, created_at) VALUES (?, ?, ?, ?)",

     

       494
       494
       +
       		[id, classId, sectionNumber, now],

     

       495
       495
       +
       	);

     

       496
       496
       +
       

     

       497
       497
       +
       	return {

     

       498
       498
       +
       		id,

     

       499
       499
       +
       		class_id: classId,

     

       500
       500
       +
       		section_number: sectionNumber,

     

       501
       501
       +
       		created_at: now,

     

       502
       502
       +
       	};

     

       503
       503
       +
       }

     

       504
       504
       +
       

     

       505
       505
       +
       /**

     

       506
       506
       +
        * Get all sections for a class

     

       507
       507
       +
        */

     

       508
       508
       +
       export function getClassSections(classId: string): ClassSection[] {

     

       509
       509
       +
       	return db

     

       510
       510
       +
       		.query<ClassSection, [string]>(

     

       511
       511
       +
       			"SELECT * FROM class_sections WHERE class_id = ? ORDER BY section_number ASC",

     

       512
       512
       +
       		)

     

       513
       513
       +
       		.all(classId);

     

       514
       514
       +
       }

     

       515
       515
       +
       

     

       516
       516
       +
       /**

     

       517
       517
       +
        * Delete a class section

     

       518
       518
       +
        */

     

       519
       519
       +
       export function deleteClassSection(sectionId: string): void {

     

       520
       520
       +
       	db.run("DELETE FROM class_sections WHERE id = ?", [sectionId]);

     

       521
       521
       +
       }

     

       522
       522
       +
       

     

       523
       523
       +
       /**

     

       524
       524
       +
        * Get user's enrolled section for a class

     

       525
       525
       +
        */

     

       526
       526
       +
       export function getUserSection(userId: number, classId: string): string | null {

     

       527
       527
       +
       	const result = db

     

       528
       528
       +
       		.query<{ section_id: string | null }, [string, number]>(

     

       529
       529
       +
       			"SELECT section_id FROM class_members WHERE class_id = ? AND user_id = ?",

     

       530
       530
       +
       		)

     

       531
       531
       +
       		.get(classId, userId);

     

       532
       532
       +
       	return result?.section_id ?? null;

     

       433
       533
        
       }

     

       434
       534
        
       

     

       435
       535
        
       /**

+3 -1

src/lib/email.ts

···

       27
       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
       28
        
       	// Skip sending emails in test mode

     

       29
       29
        
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       30
       -
       		console.log(`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`);

     

       30
       30
       +
       		console.log(

     

       31
       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       32
       +
       		);

     

       31
       33
        
       		return;

     

       32
       34
        
       	}

     

       33
       35

+227

src/lib/voting.ts

···

       1
       1
       +
       import { nanoid } from "nanoid";

     

       2
       2
       +
       import db from "../db/schema";

     

       3
       3
       +
       

     

       4
       4
       +
       /**

     

       5
       5
       +
        * Vote for a recording

     

       6
       6
       +
        * Returns true if vote was recorded, false if already voted

     

       7
       7
       +
        */

     

       8
       8
       +
       export function voteForRecording(

     

       9
       9
       +
       	transcriptionId: string,

     

       10
       10
       +
       	userId: number,

     

       11
       11
       +
       ): boolean {

     

       12
       12
       +
       	try {

     

       13
       13
       +
       		const voteId = nanoid();

     

       14
       14
       +
       		db.run(

     

       15
       15
       +
       			"INSERT INTO recording_votes (id, transcription_id, user_id) VALUES (?, ?, ?)",

     

       16
       16
       +
       			[voteId, transcriptionId, userId],

     

       17
       17
       +
       		);

     

       18
       18
       +
       

     

       19
       19
       +
       		// Increment vote count on transcription

     

       20
       20
       +
       		db.run(

     

       21
       21
       +
       			"UPDATE transcriptions SET vote_count = vote_count + 1 WHERE id = ?",

     

       22
       22
       +
       			[transcriptionId],

     

       23
       23
       +
       		);

     

       24
       24
       +
       

     

       25
       25
       +
       		return true;

     

       26
       26
       +
       	} catch (error) {

     

       27
       27
       +
       		// Unique constraint violation means user already voted

     

       28
       28
       +
       		if (

     

       29
       29
       +
       			error instanceof Error &&

     

       30
       30
       +
       			error.message.includes("UNIQUE constraint failed")

     

       31
       31
       +
       		) {

     

       32
       32
       +
       			return false;

     

       33
       33
       +
       		}

     

       34
       34
       +
       		throw error;

     

       35
       35
       +
       	}

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       /**

     

       39
       39
       +
        * Remove vote for a recording

     

       40
       40
       +
        */

     

       41
       41
       +
       export function removeVote(transcriptionId: string, userId: number): boolean {

     

       42
       42
       +
       	const result = db.run(

     

       43
       43
       +
       		"DELETE FROM recording_votes WHERE transcription_id = ? AND user_id = ?",

     

       44
       44
       +
       		[transcriptionId, userId],

     

       45
       45
       +
       	);

     

       46
       46
       +
       

     

       47
       47
       +
       	if (result.changes > 0) {

     

       48
       48
       +
       		// Decrement vote count on transcription

     

       49
       49
       +
       		db.run(

     

       50
       50
       +
       			"UPDATE transcriptions SET vote_count = vote_count - 1 WHERE id = ?",

     

       51
       51
       +
       			[transcriptionId],

     

       52
       52
       +
       		);

     

       53
       53
       +
       		return true;

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	return false;

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       /**

     

       60
       60
       +
        * Get user's vote for a specific class meeting time

     

       61
       61
       +
        */

     

       62
       62
       +
       export function getUserVoteForMeeting(

     

       63
       63
       +
       	userId: number,

     

       64
       64
       +
       	classId: string,

     

       65
       65
       +
       	meetingTimeId: string,

     

       66
       66
       +
       ): string | null {

     

       67
       67
       +
       	const result = db

     

       68
       68
       +
       		.query<

     

       69
       69
       +
       			{ transcription_id: string },

     

       70
       70
       +
       			[number, string, string]

     

       71
       71
       +
       		>(

     

       72
       72
       +
       			`SELECT rv.transcription_id 

     

       73
       73
       +
              FROM recording_votes rv

     

       74
       74
       +
              JOIN transcriptions t ON rv.transcription_id = t.id

     

       75
       75
       +
              WHERE rv.user_id = ? 

     

       76
       76
       +
                AND t.class_id = ? 

     

       77
       77
       +
                AND t.meeting_time_id = ?

     

       78
       78
       +
                AND t.status = 'pending'`,

     

       79
       79
       +
       		)

     

       80
       80
       +
       		.get(userId, classId, meetingTimeId);

     

       81
       81
       +
       

     

       82
       82
       +
       	return result?.transcription_id || null;

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       /**

     

       86
       86
       +
        * Get all pending recordings for a class meeting time (filtered by section)

     

       87
       87
       +
        */

     

       88
       88
       +
       export function getPendingRecordings(

     

       89
       89
       +
       	classId: string,

     

       90
       90
       +
       	meetingTimeId: string,

     

       91
       91
       +
       	sectionId?: string | null,

     

       92
       92
       +
       ) {

     

       93
       93
       +
       	// Build query based on whether section filtering is needed

     

       94
       94
       +
       	let query = `SELECT id, user_id, filename, original_filename, vote_count, created_at, section_id

     

       95
       95
       +
              FROM transcriptions

     

       96
       96
       +
              WHERE class_id = ? 

     

       97
       97
       +
                AND meeting_time_id = ?

     

       98
       98
       +
                AND status = 'pending'`;

     

       99
       99
       +
       

     

       100
       100
       +
       	const params: (string | null)[] = [classId, meetingTimeId];

     

       101
       101
       +
       

     

       102
       102
       +
       	// Filter by section if provided (for voting - section-specific)

     

       103
       103
       +
       	if (sectionId !== undefined) {

     

       104
       104
       +
       		query += " AND (section_id = ? OR section_id IS NULL)";

     

       105
       105
       +
       		params.push(sectionId);

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	query += " ORDER BY vote_count DESC, created_at ASC";

     

       109
       109
       +
       

     

       110
       110
       +
       	return db

     

       111
       111
       +
       		.query<

     

       112
       112
       +
       			{

     

       113
       113
       +
       				id: string;

     

       114
       114
       +
       				user_id: number;

     

       115
       115
       +
       				filename: string;

     

       116
       116
       +
       				original_filename: string;

     

       117
       117
       +
       				vote_count: number;

     

       118
       118
       +
       				created_at: number;

     

       119
       119
       +
       				section_id: string | null;

     

       120
       120
       +
       			},

     

       121
       121
       +
       			(string | null)[]

     

       122
       122
       +
       		>(query)

     

       123
       123
       +
       		.all(...params);

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       /**

     

       127
       127
       +
        * Get total enrolled users count for a class

     

       128
       128
       +
        */

     

       129
       129
       +
       export function getEnrolledUserCount(classId: string): number {

     

       130
       130
       +
       	const result = db

     

       131
       131
       +
       		.query<{ count: number }, [string]>(

     

       132
       132
       +
       			"SELECT COUNT(*) as count FROM class_members WHERE class_id = ?",

     

       133
       133
       +
       		)

     

       134
       134
       +
       		.get(classId);

     

       135
       135
       +
       

     

       136
       136
       +
       	return result?.count || 0;

     

       137
       137
       +
       }

     

       138
       138
       +
       

     

       139
       139
       +
       /**

     

       140
       140
       +
        * Check if recording should be auto-submitted

     

       141
       141
       +
        * Returns winning recording ID if ready, null otherwise

     

       142
       142
       +
        */

     

       143
       143
       +
       export function checkAutoSubmit(

     

       144
       144
       +
       	classId: string,

     

       145
       145
       +
       	meetingTimeId: string,

     

       146
       146
       +
       	sectionId?: string | null,

     

       147
       147
       +
       ): string | null {

     

       148
       148
       +
       	const recordings = getPendingRecordings(classId, meetingTimeId, sectionId);

     

       149
       149
       +
       

     

       150
       150
       +
       	if (recordings.length === 0) {

     

       151
       151
       +
       		return null;

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	const totalUsers = getEnrolledUserCount(classId);

     

       155
       155
       +
       	const now = Date.now() / 1000; // Current time in seconds

     

       156
       156
       +
       

     

       157
       157
       +
       	// Get the recording with most votes

     

       158
       158
       +
       	const topRecording = recordings[0];

     

       159
       159
       +
       	if (!topRecording) return null;

     

       160
       160
       +
       

     

       161
       161
       +
       	const uploadedAt = topRecording.created_at;

     

       162
       162
       +
       	const timeSinceUpload = now - uploadedAt;

     

       163
       163
       +
       

     

       164
       164
       +
       	// Auto-submit if:

     

       165
       165
       +
       	// 1. 30 minutes have passed since first upload, OR

     

       166
       166
       +
       	// 2. 40% of enrolled users have voted for the top recording

     

       167
       167
       +
       	const thirtyMinutes = 30 * 60; // 30 minutes in seconds

     

       168
       168
       +
       	const voteThreshold = Math.ceil(totalUsers * 0.4);

     

       169
       169
       +
       

     

       170
       170
       +
       	if (timeSinceUpload >= thirtyMinutes) {

     

       171
       171
       +
       		console.log(

     

       172
       172
       +
       			`[Voting] Auto-submitting ${topRecording.id} - 30 minutes elapsed`,

     

       173
       173
       +
       		);

     

       174
       174
       +
       		return topRecording.id;

     

       175
       175
       +
       	}

     

       176
       176
       +
       

     

       177
       177
       +
       	if (topRecording.vote_count >= voteThreshold) {

     

       178
       178
       +
       		console.log(

     

       179
       179
       +
       			`[Voting] Auto-submitting ${topRecording.id} - reached ${topRecording.vote_count}/${voteThreshold} votes (40% threshold)`,

     

       180
       180
       +
       		);

     

       181
       181
       +
       		return topRecording.id;

     

       182
       182
       +
       	}

     

       183
       183
       +
       

     

       184
       184
       +
       	return null;

     

       185
       185
       +
       }

     

       186
       186
       +
       

     

       187
       187
       +
       /**

     

       188
       188
       +
        * Mark a recording as auto-submitted and start transcription

     

       189
       189
       +
        */

     

       190
       190
       +
       export function markAsAutoSubmitted(transcriptionId: string): void {

     

       191
       191
       +
       	db.run(

     

       192
       192
       +
       		"UPDATE transcriptions SET auto_submitted = 1 WHERE id = ?",

     

       193
       193
       +
       		[transcriptionId],

     

       194
       194
       +
       	);

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       /**

     

       198
       198
       +
        * Delete a pending recording (only allowed by uploader or admin)

     

       199
       199
       +
        */

     

       200
       200
       +
       export function deletePendingRecording(

     

       201
       201
       +
       	transcriptionId: string,

     

       202
       202
       +
       	userId: number,

     

       203
       203
       +
       	isAdmin: boolean,

     

       204
       204
       +
       ): boolean {

     

       205
       205
       +
       	// Check ownership if not admin

     

       206
       206
       +
       	if (!isAdmin) {

     

       207
       207
       +
       		const recording = db

     

       208
       208
       +
       			.query<{ user_id: number; status: string }, [string]>(

     

       209
       209
       +
       				"SELECT user_id, status FROM transcriptions WHERE id = ?",

     

       210
       210
       +
       			)

     

       211
       211
       +
       			.get(transcriptionId);

     

       212
       212
       +
       

     

       213
       213
       +
       		if (!recording || recording.user_id !== userId) {

     

       214
       214
       +
       			return false;

     

       215
       215
       +
       		}

     

       216
       216
       +
       

     

       217
       217
       +
       		// Only allow deleting pending recordings

     

       218
       218
       +
       		if (recording.status !== "pending") {

     

       219
       219
       +
       			return false;

     

       220
       220
       +
       		}

     

       221
       221
       +
       	}

     

       222
       222
       +
       

     

       223
       223
       +
       	// Delete the recording (cascades to votes)

     

       224
       224
       +
       	db.run("DELETE FROM transcriptions WHERE id = ?", [transcriptionId]);

     

       225
       225
       +
       

     

       226
       226
       +
       	return true;

     

       227
       227
       +
       }

+3 -3

src/lib/vtt-cleaner.test.ts

···

       55
       55
        
       

     

       56
       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       58
       -
       	

     

       58
       58
       +
       

     

       59
       59
        
       	// Save and remove API key to avoid burning tokens

     

       60
       60
        
       	const originalKey = process.env.LLM_API_KEY;

     

       61
       61
        
       	delete process.env.LLM_API_KEY;

     

       62
       62
       -
       	

     

       62
       62
       +
       

     

       63
       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       64
       64
        
       

     

       65
       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       66
       -
       	

     

       66
       66
       +
       

     

       67
       67
        
       	// Restore original key

     

       68
       68
        
       	if (originalKey) {

     

       69
       69
        
       		process.env.LLM_API_KEY = originalKey;

-1

src/pages/admin.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Admin - Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/checkout.html

···

       4
       4
        
       <head>

     

       5
       5
        
       	<meta charset="UTF-8">

     

       6
       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
       	<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
       	<title>Success! - Thistle</title>

     

       9
       8
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/class.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Class - Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/classes.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Classes - Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/index.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/reset-password.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Reset Password - Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/settings.html

···

       4
       4
        
       <head>

     

       5
       5
        
       	<meta charset="UTF-8">

     

       6
       6
        
       	<meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
       	<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
       	<title>Settings - Thistle</title>

     

       9
       8
        
       	<link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
       	<link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

-1

src/pages/transcribe.html

···

       4
       4
        
       <head>

     

       5
       5
        
         <meta charset="UTF-8">

     

       6
       6
        
         <meta name="viewport" content="width=device-width, initial-scale=1.0">

     

       7
       7
       -
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'">

     

       8
       7
        
         <title>Transcribe - Thistle</title>

     

       9
       8
        
         <link rel="apple-touch-icon" sizes="180x180" href="../../public/favicon/apple-touch-icon.png">

     

       10
       9
        
         <link rel="icon" type="image/png" sizes="32x32" href="../../public/favicon/favicon-32x32.png">

Compare changes