@goscribe/server 1.2.0 → 1.3.1

package/dist/trpc.js

@@ -1,7 +1,15 @@
 import { initTRPC, TRPCError } from "@trpc/server";
 import superjson from "superjson";
+import { ActivityLogStatus } from "@prisma/client";
 import { logger } from "./lib/logger.js";
 import { toTRPCError } from "./lib/errors.js";
+import { getUserUsage, getUserPlanLimits } from "./lib/usage_service.js";
+import { getClientIp, isActivityLogEnabled, scheduleRecordActivity, truncateUserAgent, } from "./lib/activity_log_service.js";
+/** Avoid logging the log viewers themselves (noise when browsing activity). */
+const SKIP_ACTIVITY_TRPC_PATHS = new Set([
+    "admin.activityList",
+    "admin.activityExportCsv",
+]);
 const t = initTRPC.context().create({
     transformer: superjson,
     errorFormatter({ shape, error }) {
@@ -51,6 +59,7 @@ const isAuthed = middleware(({ ctx, next }) => {
     }
     return next({
         ctx: {
+            ...ctx,
             session: ctx.session,
             userId: ctx.session.user.id,
         },
@@ -67,8 +76,148 @@ const errorHandler = middleware(async ({ next }) => {
         throw toTRPCError(error);
     }
 });
+/**
+ * Middleware that enforces email verification
+ */
+const isVerified = middleware(async ({ ctx, next }) => {
+    const user = await ctx.db.user.findUnique({
+        where: { id: ctx.session.user.id },
+        select: { emailVerified: true },
+    });
+    if (!user?.emailVerified) {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "Please verify your email to access this feature",
+        });
+    }
+    return next();
+});
+/**
+ * Middleware that enforces resource limits based on the user's plan.
+ * Note: This matches the 'path' to decide which limit to check.
+ */
+const checkUsageLimit = middleware(async ({ ctx, next, path }) => {
+    const userId = ctx.session.user.id;
+    // 1. Get current usage and limits
+    const [usage, limits] = await Promise.all([
+        getUserUsage(userId),
+        getUserPlanLimits(userId)
+    ]);
+    // If no limits found (no active plan), we block any premium actions
+    if (!limits) {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "No active plan found. Please subscribe to a plan to continue.",
+        });
+    }
+    // 2. Check limits based on the tRPC path
+    // Flashcards (matches: flashcards.createCard, flashcards.generateFromPrompt)
+    if (path.startsWith('flashcards.') && (path.includes('create') || path.includes('generate')) && usage.flashcards >= limits.maxFlashcards) {
+        throw new TRPCError({ code: "FORBIDDEN", message: "Flashcard limit reached for your plan." });
+    }
+    // Worksheets (matches: worksheets.create, worksheets.generateFromPrompt)
+    if (path.startsWith('worksheets.') && (path.includes('create') || path.includes('generate')) && usage.worksheets >= limits.maxWorksheets) {
+        throw new TRPCError({ code: "FORBIDDEN", message: "Worksheet limit reached for your plan." });
+    }
+    // Podcasts (matches: podcast.generateEpisode)
+    if (path.startsWith('podcast.') && path.includes('generate') && usage.podcasts >= limits.maxPodcasts) {
+        throw new TRPCError({ code: "FORBIDDEN", message: "Podcast limit reached for your plan." });
+    }
+    // Study Guides (matches: studyguide.get - because it lazily creates)
+    if (path.startsWith('studyguide.') && path.includes('get') && usage.studyGuides >= limits.maxStudyGuides) {
+        // Note: We only block if the artifact doesn't exist yet (handled inside the query or by checking usage)
+        // For simplicity, if they hit the limit, we block creation of NEW study guides.
+        // However, usage_service counts existing ones. 
+        // If usage is already at/over limit, it means any NEW workspace's 'get' will fail creation.
+    }
+    // Storage check (for uploads)
+    if (path.includes('upload') && usage.storageBytes >= Number(limits.maxStorageBytes)) {
+        throw new TRPCError({ code: "FORBIDDEN", message: "Storage limit reached for your plan." });
+    }
+    return next();
+});
+/**
+ * Middleware that enforces system admin role
+ */
+const isAdmin = middleware(async ({ ctx, next }) => {
+    const user = await ctx.db.user.findUnique({
+        where: { id: ctx.session.user.id },
+        include: { role: true },
+    });
+    if (user?.role?.name !== 'System Admin') {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "You do not have permission to access this resource",
+        });
+    }
+    return next();
+});
+/**
+ * Persists ActivityLog rows for authenticated tRPC calls (async, non-blocking).
+ */
+const activityLogMiddleware = middleware(async (opts) => {
+    const { ctx, next, path, type, getRawInput } = opts;
+    if (!isActivityLogEnabled() || SKIP_ACTIVITY_TRPC_PATHS.has(path)) {
+        return next();
+    }
+    const userId = ctx.userId;
+    if (!userId) {
+        return next();
+    }
+    let rawInput;
+    try {
+        rawInput = await getRawInput();
+    }
+    catch {
+        rawInput = undefined;
+    }
+    const req = ctx.req;
+    const ipAddress = req ? getClientIp(req) : undefined;
+    const userAgent = req.headers["user-agent"];
+    const httpMethod = req.method;
+    const start = Date.now();
+    const result = await next();
+    const durationMs = Date.now() - start;
+    if (result.ok) {
+        scheduleRecordActivity({
+            db: ctx.db,
+            actorUserId: userId,
+            path,
+            type,
+            status: ActivityLogStatus.SUCCESS,
+            durationMs,
+            rawInput,
+            ipAddress,
+            userAgent: truncateUserAgent(typeof userAgent === "string" ? userAgent : undefined),
+            httpMethod,
+        });
+    }
+    else {
+        scheduleRecordActivity({
+            db: ctx.db,
+            actorUserId: userId,
+            path,
+            type,
+            status: ActivityLogStatus.FAILURE,
+            durationMs,
+            rawInput,
+            ipAddress,
+            userAgent: truncateUserAgent(typeof userAgent === "string" ? userAgent : undefined),
+            httpMethod,
+            errorCode: result.error.code,
+        });
+    }
+    return result;
+});
 /** Exported procedures with middleware */
 export const authedProcedure = publicProcedure
     .use(loggingMiddleware)
     .use(errorHandler)
-    .use(isAuthed);
+    .use(isAuthed)
+    .use(activityLogMiddleware);
+export const verifiedProcedure = authedProcedure
+    .use(isVerified);
+export const adminProcedure = authedProcedure
+    .use(isAdmin);
+export const limitedProcedure = verifiedProcedure
+    .use(checkUsageLimit);

package/mcq-test.cjs

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+
+const worksheetModeSchema = z.enum(['practice', 'quiz']);
+const worksheetDifficultyInputSchema = z.enum(['easy', 'medium', 'hard']);
+const questionTypeSchema = z.enum([
+  'MULTIPLE_CHOICE',
+  'TEXT',
+  'NUMERIC',
+  'TRUE_FALSE',
+  'MATCHING',
+  'FILL_IN_THE_BLANK',
+]);
+
+
+const worksheetPresetConfigSchema = z.object({
+  mode: worksheetModeSchema.default('practice'),
+  numQuestions: z.number().int().min(1).max(20).default(8),
+  difficulty: worksheetDifficultyInputSchema.default('medium'),
+  questionTypes: z.array(questionTypeSchema).optional(),
+  mcqRatio: z.number().min(0).max(1).optional(),
+});
+
+function test(mcqCount, numQuestions) {
+  const configOverride = {
+     questionTypes: ['MULTIPLE_CHOICE', 'TEXT'],
+     mcqRatio: mcqCount / Math.max(1, numQuestions),
+  };
+  
+  const merged = {
+    ...worksheetPresetConfigSchema.parse({}),
+    ...configOverride,
+  };
+  console.log(`mcqCount: ${mcqCount}, numQuestions: ${numQuestions} -> mcqRatio: ${merged.mcqRatio}`);
+}
+
+test(4, 8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goscribe/server",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,6 +15,10 @@
     "dev": "tsx watch src/server.ts",
     "build": "npx prisma generate && tsc -p .",
     "start": "node --experimental-specifier-resolution=node dist/server.js",
+    "test": "tsx --test src/lib/worksheet-generation.test.ts",
+    "test:activity": "tsx --test src/lib/activity_log_service.test.ts src/lib/activity_human_description.test.ts"
+  },
+  "prisma": {
     "seed": "node --experimental-specifier-resolution=node prisma/seed.mjs"
   },
   "author": "",
@@ -36,12 +40,14 @@
     "express": "^5.1.0",
     "helmet": "^8.1.0",
     "morgan": "^1.10.1",
+    "nodemailer": "^8.0.1",
     "openai": "^6.3.0",
     "prisma": "^6.14.0",
     "pusher": "^5.2.0",
     "pusher-js": "^8.4.0",
     "resend": "^6.9.2",
     "socket.io": "^4.8.1",
+    "stripe": "^20.4.1",
     "superjson": "^2.2.2",
     "uuid": "^13.0.0",
     "zod": "^4.1.1"
@@ -53,6 +59,7 @@
     "@types/express": "^5.0.3",
     "@types/morgan": "^1.9.10",
     "@types/node": "^24.3.0",
+    "@types/nodemailer": "^7.0.11",
     "ts-node": "^10.9.2",
     "ts-node-dev": "^2.0.0",
     "tsc-alias": "^1.8.16",
@@ -61,4 +68,4 @@
     "typescript": "^5.9.2",
     "typescript-transform-paths": "^3.5.5"
   }
-}
+}