@studious-lms/server 1.1.24 → 1.2.6

package/src/utils/prismaWrapper.ts

@@ -1,6 +1,10 @@
+/**
+ * Prisma wrapper – wraps Prisma operations with error handling and tRPC error mapping.
+ */
 import { TRPCError } from '@trpc/server';
 import { handlePrismaError } from './prismaErrorHandler.js';
 
+/** Execute a Prisma operation and convert errors to tRPC errors. */
 export async function withPrismaErrorHandling<T>(
   operation: () => Promise<T>,
   context: string = 'database operation'

package/tests/globalSetup.ts

@@ -0,0 +1,62 @@
+import { config } from 'dotenv';
+import { resolve } from 'path';
+import type { TestProject } from 'vitest/node';
+
+config({ path: resolve(process.cwd(), '.env.test'), override: true });
+
+import { prisma } from '../src/lib/prisma';
+import { appRouter } from '../src/routers/_app';
+import { createTRPCContext } from '../src/trpc';
+import { clearDatabase } from '../src/seedDatabase';
+import { execSync } from 'child_process';
+
+async function runSetup() {
+  const ctx = await createTRPCContext({
+    req: { headers: {} } as any,
+    res: {} as any,
+  });
+  const caller = appRouter.createCaller(ctx);
+
+  execSync('npm run test:pre');
+
+  const user1 = await caller.auth.register({
+    username: 'testuser1',
+    email: 'test@studious.sh',
+    password: 'password_is_1234',
+    confirmPassword: 'password_is_1234',
+  });
+
+  const user2 = await caller.auth.register({
+    username: 'testuser2',
+    email: 'test2@studious.sh',
+    password: 'password_is_1234',
+    confirmPassword: 'password_is_1234',
+  });
+
+  const user3 = await caller.auth.register({
+    username: 'testuser3',
+    email: 'test3@studious.sh',
+    password: 'password_is_1234',
+    confirmPassword: 'password_is_1234',
+  });
+
+  const session1 = await prisma.session.findFirst({ where: { userId: user1.user.id } });
+  const session2 = await prisma.session.findFirst({ where: { userId: user2.user.id } });
+  const session3 = await prisma.session.findFirst({ where: { userId: user3.user.id } });
+
+  if (!session1 || !session2 || !session3) {
+    throw new Error('Failed to create sessions for test users');
+  }
+
+  await caller.auth.verify({ token: session1.id });
+  await caller.auth.verify({ token: session2.id });
+  await caller.auth.verify({ token: session3.id });
+
+  await prisma.$disconnect();
+}
+
+export default async function setup(project: TestProject) {
+  project.onTestsRerun(runSetup);
+  await runSetup();
+}
+

package/tests/helpers.ts

@@ -0,0 +1,22 @@
+import { createTRPCContext } from '../src/trpc';
+import { appRouter } from '../src/routers/_app';
+
+export async function createUnauthCaller() {
+  const ctx = await createTRPCContext({
+    req: { headers: {} } as any,
+    res: {} as any,
+  });
+  return appRouter.createCaller(ctx);
+}
+
+export const expectRejects = (fn: () => Promise<unknown>) =>
+  expect(fn()).rejects.toThrow();
+
+/** Expect a call to throw (e.g. unauthenticated). */
+export async function expectUnauth(call: (caller: Awaited<ReturnType<typeof createUnauthCaller>>) => Promise<unknown>) {
+  const unauth = await createUnauthCaller();
+  await expectRejects(() => call(unauth));
+}
+
+/** Expect a call to throw (e.g. not teacher, not member, forbidden). Same as expectRejects but semantic. */
+export const expectForbidden = expectRejects;

package/tests/middleware/security.test.ts

@@ -0,0 +1,42 @@
+import { describe, test, expect, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import {
+  generalLimiter,
+  authLimiter,
+  uploadLimiter,
+  helmetConfig,
+} from '../../src/middleware/security.js';
+
+describe('security middleware', () => {
+  test('exports all middleware', () => {
+    expect(typeof generalLimiter).toBe('function');
+    expect(typeof authLimiter).toBe('function');
+    expect(typeof uploadLimiter).toBe('function');
+    expect(typeof helmetConfig).toBe('function');
+  });
+
+  describe('generalLimiter skip logic', () => {
+    let app: express.Application;
+
+    beforeEach(() => {
+      app = express();
+      app.use(generalLimiter);
+      app.get('/health', (_req, res) => res.status(200).json({ ok: true }));
+      app.get('/api/test', (_req, res) => res.status(200).json({ ok: true }));
+    });
+
+    test('/health is not rate limited (skip)', async () => {
+      const requests = Array(15)
+        .fill(null)
+        .map(() => request(app).get('/health'));
+      const responses = await Promise.all(requests);
+      expect(responses.every((r) => r.status === 200)).toBe(true);
+    });
+
+    test('OPTIONS is skipped', async () => {
+      const res = await request(app).options('/api/test');
+      expect(res.status).not.toBe(429);
+    });
+  });
+});

package/tests/routers/agenda.test.ts

@@ -0,0 +1,138 @@
+import { test, expect, describe, beforeAll } from 'vitest';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { expectUnauth } from '../helpers';
+import { startOfWeek, addMonths } from 'date-fns';
+
+describe('Agenda Router', () => {
+  let testClass: any;
+  let classEvent: any;
+  const now = new Date();
+  const weekStart = startOfWeek(now).toISOString();
+
+  beforeAll(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Agenda Test Class',
+      subject: 'Science',
+      section: '9th Grade',
+    });
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: (await user2Caller.user.getProfile()).id,
+    });
+
+    const startTime = new Date();
+    startTime.setHours(11, 0, 0, 0);
+    const endTime = new Date(startTime);
+    endTime.setHours(12, 0, 0, 0);
+
+    classEvent = await user1Caller.event.create({
+      name: 'Class Agenda Event',
+      location: 'Room 301',
+      startTime: startTime.toISOString(),
+      endTime: endTime.toISOString(),
+      classId: testClass.id,
+      color: '#EF4444',
+    });
+  });
+
+  describe('get', () => {
+    test('should return personal events', async () => {
+      const startTime = new Date();
+      startTime.setHours(9, 0, 0, 0);
+      const endTime = new Date(startTime);
+      endTime.setHours(10, 0, 0, 0);
+
+      const created = await user1Caller.event.create({
+        name: 'Personal Agenda Event',
+        location: 'Home',
+        startTime: startTime.toISOString(),
+        endTime: endTime.toISOString(),
+      });
+
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.personal).toBeDefined();
+      expect(Array.isArray(agenda.events.personal)).toBe(true);
+      const found = agenda.events.personal.find(
+        (e) => e.id === created.event.id,
+      );
+      expect(found).toBeDefined();
+      expect(found!.name).toBe('Personal Agenda Event');
+      expect(found!.classId).toBeNull();
+    });
+
+    test('should return class events for the teacher', async () => {
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.class).toBeDefined();
+      const found = agenda.events.class.find(
+        (e) => e.id === classEvent.event.id,
+      );
+      expect(found).toBeDefined();
+      expect(found!.name).toBe('Class Agenda Event');
+      expect(found!.classId).toBe(testClass.id);
+    });
+
+    test('should return class events for enrolled students', async () => {
+      const agenda = await user2Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.class).toBeDefined();
+      const found = agenda.events.class.find(
+        (e) => e.name === 'Class Agenda Event',
+      );
+      expect(found).toBeDefined();
+      expect(found!.classId).toBe(testClass.id);
+    });
+
+    test('should not return class events for non-members', async () => {
+      const agenda = await user3Caller.agenda.get({ weekStart });
+
+      const found = agenda.events.class.find(
+        (e) => e.classId === testClass.id,
+      );
+      expect(found).toBeUndefined();
+    });
+
+    test('should return empty arrays for user with no events', async () => {
+      const agenda = await user3Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.personal).toEqual([]);
+      expect(Array.isArray(agenda.events.class)).toBe(true);
+    });
+
+    test('should not return events outside the 6-month range', async () => {
+      const farFuture = addMonths(now, 6);
+      farFuture.setHours(10, 0, 0, 0);
+      const farFutureEnd = new Date(farFuture);
+      farFutureEnd.setHours(11, 0, 0, 0);
+
+      await user1Caller.event.create({
+        name: 'Far Future Event',
+        startTime: farFuture.toISOString(),
+        endTime: farFutureEnd.toISOString(),
+      });
+
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      const found = agenda.events.personal.find(
+        (e) => e.name === 'Far Future Event',
+      );
+      expect(found).toBeUndefined();
+    });
+
+    test('should separate personal and class events correctly', async () => {
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      for (const event of agenda.events.personal) {
+        expect(event.classId).toBeNull();
+      }
+      for (const event of agenda.events.class) {
+        expect(event.classId).not.toBeNull();
+      }
+    });
+
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.agenda.get({ weekStart })));
+  });
+});