feat: move community supabase request to api layer (#612)

* feat: move community supabase request to api layer

* chore: pr review checkpoint

* chore: PR fixes

* feat: implement role-based authorization middleware and align the community features with the developer guide.

- Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`.
- Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content.
- Updated community routes to utilize the new middleware for enhanced security and access control.
- Refactored community services to streamline upvote functionality and improve error handling.
- Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions.
- Updated documentation to reflect new middleware usage and best practices for authorization in the API layer.

* feat: enhance course and organization routes with middleware for improved access control

- Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks.
- Updated lesson route to include `courseMemberMiddleware` for PDF downloads.
- Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data.
- Refactored lesson and organization routes for consistency and clarity in middleware usage.

* chore: streamline dashboard and API development scripts in package.json

- Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use.
- Removed redundant full command variants to simplify the script section.

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

apps/api/src/middlewares/course-member.ts

@@ -0,0 +1,64 @@
+import { Context, Next } from 'hono';
+
+import { ErrorCodes } from '@api/utils/errors';
+import { isUserCourseMember } from '@cio/db/queries/group';
+
+/**
+ * Middleware to check if the authenticated user is a member of a course's group
+ * Requires authMiddleware to be applied first
+ * Extracts courseId from request params, query, or body
+ */
+export const courseMemberMiddleware = async (c: Context, next: Next) => {
+  try {
+    const user = c.get('user');
+    if (!user) {
+      return c.json(
+        {
+          success: false,
+          error: 'Unauthorized',
+          code: 'UNAUTHORIZED'
+        },
+        401
+      );
+    }
+
+    // Try to get courseId from params or query
+    // Note: Body parsing should happen after validation middleware
+    const courseId = c.req.param('courseId') || c.req.query('courseId');
+
+    if (!courseId) {
+      return c.json(
+        {
+          success: false,
+          error: 'Course ID is required',
+          code: 'COURSE_ID_REQUIRED'
+        },
+        400
+      );
+    }
+
+    const isMember = await isUserCourseMember(courseId, user.id);
+    if (!isMember) {
+      return c.json(
+        {
+          success: false,
+          error: 'You must be a member of this course to perform this action',
+          code: ErrorCodes.ORG_TEAM_NOT_AUTHORIZED
+        },
+        403
+      );
+    }
+
+    await next();
+  } catch (error) {
+    console.error('Error in courseMemberMiddleware:', error);
+    return c.json(
+      {
+        success: false,
+        error: 'Failed to verify course membership',
+        code: 'COURSE_MEMBER_CHECK_FAILED'
+      },
+      500
+    );
+  }
+};

apps/api/src/middlewares/org-member.ts

@@ -0,0 +1,62 @@
+import { Context, Next } from 'hono';
+
+import { ErrorCodes } from '@api/utils/errors';
+import { isUserOrgMember } from '@cio/db/queries/organization';
+
+/**
+ * Middleware to check if the authenticated user is a member of the organization
+ * Requires authMiddleware to be applied first
+ * Expects orgId in the 'cio-org-id' header
+ */
+export const orgMemberMiddleware = async (c: Context, next: Next) => {
+  try {
+    const user = c.get('user');
+    if (!user) {
+      return c.json(
+        {
+          success: false,
+          error: 'Unauthorized',
+          code: 'UNAUTHORIZED'
+        },
+        401
+      );
+    }
+
+    const orgId = c.req.header('cio-org-id');
+
+    if (!orgId) {
+      return c.json(
+        {
+          success: false,
+          error: 'Organization ID is required',
+          code: 'ORG_ID_REQUIRED'
+        },
+        400
+      );
+    }
+
+    const isMember = await isUserOrgMember(orgId, user.id);
+    if (!isMember) {
+      return c.json(
+        {
+          success: false,
+          error: 'UNAUTHORIZED',
+          code: 'UNAUTHORIZED'
+        },
+        403
+      );
+    }
+
+    await next();
+  } catch (error) {
+    console.error('Error in orgMemberMiddleware:', error);
+    return c.json(
+      {
+        success: false,
+        error: 'INTERNAL_ERROR',
+        code: 'INTERNAL_ERROR'
+      },
+      500
+    );
+  }
+};

apps/api/src/middlewares/org-team-member.ts

@@ -0,0 +1,62 @@
+import { Context, Next } from 'hono';
+
+import { ErrorCodes } from '@api/utils/errors';
+import { isUserOrgTeamMember } from '@cio/db/queries/organization';
+
+/**
+ * Middleware to check if the authenticated user is a team member (ADMIN or TUTOR) of the organization
+ * Requires authMiddleware to be applied first
+ * Expects orgId in the 'cio-org-id' header
+ */
+export const orgTeamMemberMiddleware = async (c: Context, next: Next) => {
+  try {
+    const user = c.get('user');
+    if (!user) {
+      return c.json(
+        {
+          success: false,
+          error: 'Unauthorized',
+          code: 'UNAUTHORIZED'
+        },
+        401
+      );
+    }
+
+    const orgId = c.req.header('cio-org-id');
+
+    if (!orgId) {
+      return c.json(
+        {
+          success: false,
+          error: 'Organization ID is required',
+          code: 'ORG_ID_REQUIRED'
+        },
+        400
+      );
+    }
+
+    const isTeamMember = await isUserOrgTeamMember(orgId, user.id);
+    if (!isTeamMember) {
+      return c.json(
+        {
+          success: false,
+          error: 'Only organization team members (admins or tutors) can perform this action',
+          code: ErrorCodes.ORG_TEAM_NOT_AUTHORIZED
+        },
+        403
+      );
+    }
+
+    await next();
+  } catch (error) {
+    console.error('Error in orgTeamMemberMiddleware:', error);
+    return c.json(
+      {
+        success: false,
+        error: 'Failed to verify organization team member status',
+        code: 'ORG_TEAM_MEMBER_CHECK_FAILED'
+      },
+      500
+    );
+  }
+};