feat: move community supabase request to api layer (#612)

* feat: move community supabase request to api layer

* chore: pr review checkpoint

* chore: PR fixes

* feat: implement role-based authorization middleware and align the community features with the developer guide.

- Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`.
- Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content.
- Updated community routes to utilize the new middleware for enhanced security and access control.
- Refactored community services to streamline upvote functionality and improve error handling.
- Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions.
- Updated documentation to reflect new middleware usage and best practices for authorization in the API layer.

* feat: enhance course and organization routes with middleware for improved access control

- Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks.
- Updated lesson route to include `courseMemberMiddleware` for PDF downloads.
- Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data.
- Refactored lesson and organization routes for consistency and clarity in middleware usage.

* chore: streamline dashboard and API development scripts in package.json

- Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use.
- Removed redundant full command variants to simplify the script section.

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

apps/api/src/routes/course/course.ts

@@ -9,17 +9,21 @@ import {
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
 import { cloneCourse } from '@api/services/course/clone';
+import { courseMemberMiddleware } from '@api/middlewares/course-member';
 import { generateCertificate } from '@api/utils/certificate';
 import { generateCoursePdf } from '@api/utils/course';
 import { handleError } from '@api/utils/errors';
 import { katexRouter } from '@api/routes/course/katex';
 import { lessonRouter } from '@api/routes/course/lesson';
+import { orgMemberMiddleware } from '@api/middlewares/org-member';
 import { presignRouter } from '@api/routes/course/presign';
 import { zValidator } from '@hono/zod-validator';
 
 export const courseRouter = new Hono()
   .post(
     '/:courseId/download/certificate',
+    authMiddleware,
+    courseMemberMiddleware,
     zValidator('param', ZCourseDownloadParam),
     zValidator('json', ZCertificateDownload),
     async (c) => {
@@ -42,6 +46,8 @@ export const courseRouter = new Hono()
   )
   .post(
     '/:courseId/download/content',
+    authMiddleware,
+    courseMemberMiddleware,
     zValidator('param', ZCourseDownloadParam),
     zValidator('json', ZCourseDownloadContent),
     async (c) => {
@@ -64,6 +70,7 @@ export const courseRouter = new Hono()
   .post(
     '/:courseId/clone',
     authMiddleware,
+    orgMemberMiddleware,
     zValidator('param', ZCourseCloneParam),
     zValidator('json', ZCourseClone),
     async (c) => {
@@ -90,5 +97,5 @@ export const courseRouter = new Hono()
     }
   )
   .route('/katex', katexRouter)
-  .route('/lesson', lessonRouter)
+  .route('/:courseId/lesson', lessonRouter)
   .route('/presign', presignRouter);

apps/api/src/routes/course/lesson.ts

@@ -1,20 +1,26 @@
 import { Hono } from '@api/utils/hono';
 import { ZLessonDownloadContent } from '@cio/utils/validation/course';
+import { courseMemberMiddleware } from '@api/middlewares/course-member';
 import { generateLessonPdf } from '@api/utils/lesson';
 import { zValidator } from '@hono/zod-validator';
 
-export const lessonRouter = new Hono().post('/download/pdf', zValidator('json', ZLessonDownloadContent), async (c) => {
-  const validatedData = c.req.valid('json');
+export const lessonRouter = new Hono().post(
+  '/download/pdf',
+  courseMemberMiddleware,
+  zValidator('json', ZLessonDownloadContent),
+  async (c) => {
+    const validatedData = c.req.valid('json');
 
-  const pdfBuffer = await generateLessonPdf(validatedData);
+    const pdfBuffer = await generateLessonPdf(validatedData);
 
-  c.header('Content-Type', 'application/pdf');
-  return c.body(
-    new ReadableStream({
-      start(controller) {
-        controller.enqueue(pdfBuffer);
-        controller.close();
-      }
-    })
-  );
-});
+    c.header('Content-Type', 'application/pdf');
+    return c.body(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(pdfBuffer);
+          controller.close();
+        }
+      })
+    );
+  }
+);