feat: move community supabase request to api layer (#612)

* feat: move community supabase request to api layer

* chore: pr review checkpoint

* chore: PR fixes

* feat: implement role-based authorization middleware and align the community features with the developer guide.

- Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`.
- Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content.
- Updated community routes to utilize the new middleware for enhanced security and access control.
- Refactored community services to streamline upvote functionality and improve error handling.
- Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions.
- Updated documentation to reflect new middleware usage and best practices for authorization in the API layer.

* feat: enhance course and organization routes with middleware for improved access control

- Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks.
- Updated lesson route to include `courseMemberMiddleware` for PDF downloads.
- Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data.
- Refactored lesson and organization routes for consistency and clarity in middleware usage.

* chore: streamline dashboard and API development scripts in package.json

- Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use.
- Removed redundant full command variants to simplify the script section.

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

apps/api/src/routes/organization/organization.ts

@@ -34,6 +34,7 @@ import { authMiddleware } from '@api/middlewares/auth';
 import { authOrApiKeyMiddleware } from '@api/middlewares/auth-or-api-key';
 import { handleError } from '@api/utils/errors';
 import { orgAdminMiddleware } from '@api/middlewares/org-admin';
+import { orgMemberMiddleware } from '@api/middlewares/org-member';
 import { zValidator } from '@hono/zod-validator';
 
 export const organizationRouter = new Hono()
@@ -66,7 +67,7 @@ export const organizationRouter = new Hono()
    * Gets organization team members (non-students)
    * Requires authentication
    */
-  .get('/:orgId/team', authMiddleware, zValidator('param', ZGetOrganizationTeam), async (c) => {
+  .get('/:orgId/team', authMiddleware, orgMemberMiddleware, zValidator('param', ZGetOrganizationTeam), async (c) => {
     try {
       const { orgId } = c.req.valid('param');
       const team = await getOrgTeam(orgId);
@@ -144,22 +145,28 @@ export const organizationRouter = new Hono()
    * Gets organization audience (students)
    * Requires authentication
    */
-  .get('/:orgId/audience', authMiddleware, zValidator('param', ZGetOrganizationAudience), async (c) => {
-    try {
-      const { orgId } = c.req.valid('param');
-      const audience = await getOrgAudience(orgId);
+  .get(
+    '/:orgId/audience',
+    authMiddleware,
+    orgMemberMiddleware,
+    zValidator('param', ZGetOrganizationAudience),
+    async (c) => {
+      try {
+        const { orgId } = c.req.valid('param');
+        const audience = await getOrgAudience(orgId);
 
-      return c.json(
-        {
-          success: true,
-          data: audience
-        },
-        200
-      );
-    } catch (error) {
-      return handleError(c, error, 'Failed to fetch organization audience');
+        return c.json(
+          {
+            success: true,
+            data: audience
+          },
+          200
+        );
+      } catch (error) {
+        return handleError(c, error, 'Failed to fetch organization audience');
+      }
     }
-  })
+  )
   /**
    * GET /organization/courses
    * Gets courses by organization siteName
@@ -305,6 +312,7 @@ export const organizationRouter = new Hono()
   .put(
     '/:orgId',
     authMiddleware,
+    orgAdminMiddleware,
     zValidator('param', ZUpdateOrganizationParam),
     zValidator('json', ZUpdateOrganization),
     async (c) => {