Initial commit: ExaMetra v1.0.0 — Free & open-source competence & grading platform

Features: - 15+ views: Dashboard, Classes, Progress, Flower, Matrix, Assessments, Grading, Reports, Attendance, Calendar, Lesson Plans, Analytics, Parent Communication, Behavior Tracking, Settings - 34+ API endpoints - 30+ Prisma models - 700+ i18n keys (German + English) - Keyboard shortcuts (Cmd+K, Cmd+1-9, Cmd+/) - Batch deletion, drag-and-drop seating, custom color palette - Demo accounts (admin, teacher, student, parent) - Dark mode, responsive design, print styles - CSV/PDF export, notification system, onboarding tour - Zero emojis — all replaced with Lucide icons - MIT License
2026-07-29 05:46:10 +00:00
commit 0c1f739989
@@ -0,0 +1,195 @@
+import { NextResponse } from 'next/server';
+import { z } from 'zod';
+import { db } from '@/lib/db';
+import { getSession } from '@/lib/auth';
+
+const updateCategorySchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  color: z
+    .string()
+    .regex(/^#[0-9a-fA-F]{6}$/, 'color must be a hex like #10b981')
+    .optional(),
+  icon: z.string().max(20).optional().nullable(),
+});
+
+function isTeacherOrAdmin(role: string | undefined): boolean {
+  return (
+    role === 'TEACHER' ||
+    role === 'SCHOOL_ADMIN' ||
+    role === 'SUPER_ADMIN'
+  );
+}
+
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const session = await getSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+    if (!isTeacherOrAdmin(session.user?.role)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const { id } = await params;
+    const category = await db.commentCategory.findUnique({
+      where: { id },
+      include: { _count: { select: { comments: true } } },
+    });
+
+    if (!category) {
+      return NextResponse.json({ error: 'Category not found' }, { status: 404 });
+    }
+
+    if (
+      session.user?.role === 'SCHOOL_ADMIN' &&
+      session.user.schoolId &&
+      category.schoolId !== session.user.schoolId
+    ) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    return NextResponse.json(category);
+  } catch (error) {
+    console.error('CommentCategory GET error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function PUT(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const session = await getSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+    if (!isTeacherOrAdmin(session.user?.role)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const { id } = await params;
+    const body = await request.json();
+    const parsed = updateCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validation failed', details: parsed.error.issues },
+        { status: 400 }
+      );
+    }
+
+    const existing = await db.commentCategory.findUnique({ where: { id } });
+    if (!existing) {
+      return NextResponse.json({ error: 'Category not found' }, { status: 404 });
+    }
+
+    if (
+      session.user?.role === 'SCHOOL_ADMIN' &&
+      session.user.schoolId &&
+      existing.schoolId !== session.user.schoolId
+    ) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    if (parsed.data.name && parsed.data.name !== existing.name) {
+      const dupe = await db.commentCategory.findUnique({
+        where: { schoolId_name: { schoolId: existing.schoolId, name: parsed.data.name } },
+      });
+      if (dupe) {
+        return NextResponse.json(
+          { error: 'A category with this name already exists in this school' },
+          { status: 409 }
+        );
+      }
+    }
+
+    const data: Record<string, unknown> = {};
+    if (parsed.data.name !== undefined) data.name = parsed.data.name;
+    if (parsed.data.color !== undefined) data.color = parsed.data.color;
+    if (parsed.data.icon !== undefined) data.icon = parsed.data.icon ?? null;
+
+    const updated = await db.commentCategory.update({
+      where: { id },
+      data,
+    });
+
+    await db.auditLog.create({
+      data: {
+        userId: session.userId,
+        schoolId: existing.schoolId,
+        action: 'UPDATE',
+        entityType: 'CommentCategory',
+        entityId: id,
+        metadata: JSON.stringify({ updatedFields: Object.keys(data) }),
+      },
+    });
+
+    return NextResponse.json(updated);
+  } catch (error) {
+    console.error('CommentCategory PUT error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const session = await getSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+    if (!isTeacherOrAdmin(session.user?.role)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const { id } = await params;
+    const existing = await db.commentCategory.findUnique({
+      where: { id },
+      include: { _count: { select: { comments: true } } },
+    });
+    if (!existing) {
+      return NextResponse.json({ error: 'Category not found' }, { status: 404 });
+    }
+
+    if (
+      session.user?.role === 'SCHOOL_ADMIN' &&
+      session.user.schoolId &&
+      existing.schoolId !== session.user.schoolId
+    ) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    if (existing._count.comments > 0) {
+      return NextResponse.json(
+        {
+          error: 'Cannot delete: category is referenced by existing comments',
+          commentCount: existing._count.comments,
+        },
+        { status: 409 }
+      );
+    }
+
+    await db.commentCategory.delete({ where: { id } });
+
+    await db.auditLog.create({
+      data: {
+        userId: session.userId,
+        schoolId: existing.schoolId,
+        action: 'DELETE',
+        entityType: 'CommentCategory',
+        entityId: id,
+        metadata: JSON.stringify({ name: existing.name, color: existing.color }),
+      },
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('CommentCategory DELETE error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
@@ -0,0 +1,130 @@
+import { NextResponse } from 'next/server';
+import { z } from 'zod';
+import { db } from '@/lib/db';
+import { getSession } from '@/lib/auth';
+
+const createCategorySchema = z.object({
+  schoolId: z.string().min(1),
+  name: z.string().min(1).max(100),
+  color: z
+    .string()
+    .regex(/^#[0-9a-fA-F]{6}$/, 'color must be a hex like #10b981'),
+  icon: z.string().max(20).optional().nullable(),
+});
+
+function isTeacherOrAdmin(role: string | undefined): boolean {
+  return (
+    role === 'TEACHER' ||
+    role === 'SCHOOL_ADMIN' ||
+    role === 'SUPER_ADMIN'
+  );
+}
+
+export async function GET(request: Request) {
+  try {
+    const session = await getSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+    if (!isTeacherOrAdmin(session.user?.role)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const schoolIdParam = searchParams.get('schoolId');
+
+    let schoolId: string | undefined;
+    if (session.user?.role === 'SCHOOL_ADMIN') {
+      schoolId = session.user.schoolId ?? undefined;
+    } else {
+      schoolId = schoolIdParam ?? session.user?.schoolId ?? undefined;
+    }
+
+    if (!schoolId) {
+      return NextResponse.json([]);
+    }
+
+    const categories = await db.commentCategory.findMany({
+      where: { schoolId },
+      orderBy: { name: 'asc' },
+      include: {
+        _count: { select: { comments: true } },
+      },
+    });
+
+    return NextResponse.json(categories);
+  } catch (error) {
+    console.error('CommentCategories GET error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    const session = await getSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+    if (!isTeacherOrAdmin(session.user?.role)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const body = await request.json();
+    const parsed = createCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validation failed', details: parsed.error.issues },
+        { status: 400 }
+      );
+    }
+
+    const { schoolId, name } = parsed.data;
+
+    const school = await db.school.findUnique({ where: { id: schoolId } });
+    if (!school) {
+      return NextResponse.json({ error: 'School not found' }, { status: 404 });
+    }
+    if (
+      session.user?.role === 'SCHOOL_ADMIN' &&
+      session.user.schoolId &&
+      school.id !== session.user.schoolId
+    ) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const existing = await db.commentCategory.findUnique({
+      where: { schoolId_name: { schoolId, name } },
+    });
+    if (existing) {
+      return NextResponse.json(
+        { error: 'A category with this name already exists in this school' },
+        { status: 409 }
+      );
+    }
+
+    const category = await db.commentCategory.create({
+      data: {
+        schoolId,
+        name,
+        color: parsed.data.color,
+        icon: parsed.data.icon ?? null,
+      },
+    });
+
+    await db.auditLog.create({
+      data: {
+        userId: session.userId,
+        schoolId,
+        action: 'CREATE',
+        entityType: 'CommentCategory',
+        entityId: category.id,
+        metadata: JSON.stringify({ name, color: parsed.data.color }),
+      },
+    });
+
+    return NextResponse.json(category, { status: 201 });
+  } catch (error) {
+    console.error('CommentCategories POST error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}