@studious-lms/server 1.1.26 → 1.2.6

package/tests/routers/message.test.ts

@@ -0,0 +1,123 @@
+import { test, expect, describe, beforeAll } from 'vitest';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+
+describe('Message Router', () => {
+  let conversationId: string;
+  let messageId: string;
+  let user1Id: string;
+  let user2Id: string;
+
+  beforeAll(async () => {
+    const user1Profile = await user1Caller.user.getProfile();
+    const user2Profile = await user2Caller.user.getProfile();
+    user1Id = user1Profile.id;
+    user2Id = user2Profile.id;
+
+    const conversation = await user1Caller.conversation.create({
+      type: 'GROUP',
+      name: 'Message Test Group',
+      memberIds: [user2Id],
+    });
+    conversationId = conversation.id;
+  });
+
+  describe('send', () => {
+    test('should send a message', async () => {
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Hello from tests!',
+      });
+
+      expect(result).toBeDefined();
+      expect(result.content).toBe('Hello from tests!');
+      expect(result.senderId).toBe(user1Id);
+      messageId = result.id;
+    });
+
+    test('should send a message with mentions', async () => {
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Hey @user2!',
+        mentionedUserIds: [user2Id],
+      });
+
+      expect(result).toBeDefined();
+      expect(result.mentionedUserIds).toContain(user2Id);
+    });
+
+    test('should fail for non-member', async () => {
+      await expect(
+        user3Caller.message.send({
+          conversationId,
+          content: 'Unauthorized message',
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('list', () => {
+    test('should list messages in conversation', async () => {
+      const result = await user1Caller.message.list({ conversationId });
+
+      expect(result.messages).toBeDefined();
+      expect(Array.isArray(result.messages)).toBe(true);
+      expect(result.messages.length).toBeGreaterThanOrEqual(2);
+    });
+
+    test('should fail for non-member', async () => {
+      await expect(
+        user3Caller.message.list({ conversationId }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('update', () => {
+    test('should update own message', async () => {
+      const result = await user1Caller.message.update({
+        messageId,
+        content: 'Updated message content',
+      });
+
+      expect(result.content).toBe('Updated message content');
+    });
+
+    test('should fail to update another user\'s message', async () => {
+      await expect(
+        user2Caller.message.update({
+          messageId,
+          content: 'Unauthorized edit',
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('markAsRead', () => {
+    test('should mark conversation as read', async () => {
+      const result = await user2Caller.message.markAsRead({ conversationId });
+      expect(result.success).toBe(true);
+    });
+  });
+
+  describe('getUnreadCount', () => {
+    test('should return unread counts', async () => {
+      const result = await user2Caller.message.getUnreadCount({ conversationId });
+
+      expect(result).toBeDefined();
+      expect(typeof result.unreadCount).toBe('number');
+      expect(typeof result.unreadMentionCount).toBe('number');
+    });
+  });
+
+  describe('delete', () => {
+    test('should fail to delete another user\'s message', async () => {
+      await expect(
+        user2Caller.message.delete({ messageId }),
+      ).rejects.toThrow();
+    });
+
+    test('should delete own message', async () => {
+      const result = await user1Caller.message.delete({ messageId });
+      expect(result.success).toBe(true);
+    });
+  });
+});

package/tests/routers/notification.test.ts

@@ -0,0 +1,69 @@
+import { test, expect, describe } from 'vitest';
+import { user1Caller, user2Caller } from '../setup';
+import { expectUnauth } from '../helpers';
+
+describe('Notification Router', () => {
+  let notificationId: string;
+  let user2Id: string;
+
+  test('should send notification to another user', async () => {
+    const user2Profile = await user2Caller.user.getProfile();
+    user2Id = user2Profile.id;
+
+    const notification = await user1Caller.notification.sendTo({
+      receiverId: user2Id,
+      title: 'Test Notification',
+      content: 'This is a test notification',
+    });
+
+    expect(notification).toBeDefined();
+    expect(notification.title).toBe('Test Notification');
+    expect(notification.content).toBe('This is a test notification');
+    expect(notification.receiverId).toBe(user2Id);
+    notificationId = notification.id;
+  });
+
+  test('should list notifications for receiver', async () => {
+    const notifications = await user2Caller.notification.list();
+
+    expect(Array.isArray(notifications)).toBe(true);
+    const found = notifications.find((n) => n.id === notificationId);
+    expect(found).toBeDefined();
+    expect(found!.title).toBe('Test Notification');
+  });
+
+  test('should get a single notification', async () => {
+    const notification = await user2Caller.notification.get({ id: notificationId });
+
+    expect(notification).toBeDefined();
+    expect(notification!.id).toBe(notificationId);
+    expect(notification!.title).toBe('Test Notification');
+  });
+
+  test('should mark notification as read', async () => {
+    const notification = await user2Caller.notification.markAsRead({ id: notificationId });
+
+    expect(notification.read).toBe(true);
+  });
+
+  test('should send to multiple users', async () => {
+    const user1Profile = await user1Caller.user.getProfile();
+
+    const result = await user1Caller.notification.sendToMultiple({
+      receiverIds: [user2Id, user1Profile.id],
+      title: 'Bulk Notification',
+      content: 'Sent to multiple users',
+    });
+
+    expect(result.count).toBe(2);
+  });
+
+  test('should not list notifications meant for other users', async () => {
+    const notifications = await user1Caller.notification.list();
+    const foreignNotif = notifications.find((n) => n.id === notificationId);
+    expect(foreignNotif).toBeUndefined();
+  });
+
+  test('should fail without authentication', () =>
+    expectUnauth((c) => c.notification.list()));
+});

package/tests/routers/section.test.ts

@@ -0,0 +1,208 @@
+import { test, expect, describe, beforeEach } from 'vitest';
+import { user1Caller, user2Caller } from '../setup';
+import { expectUnauth } from '../helpers';
+
+describe('Section Router', () => {
+  let testClass: any;
+  let testSection: any;
+
+  beforeEach(async () => {
+    // Create a test class
+    testClass = await user1Caller.class.create({
+      name: 'Test Class for Sections',
+      subject: 'Mathematics',
+      section: '10th Grade',
+    });
+
+    // Create a test section
+    testSection = await user1Caller.section.create({
+      classId: testClass.id,
+      name: 'Test Section',
+      color: '#3B82F6',
+    });
+  });
+
+  describe('create', () => {
+    test('should create section successfully', async () => {
+      expect(testSection).toBeDefined();
+      expect(testSection.id).toBeDefined();
+      expect(testSection.name).toBe('Test Section');
+      expect(testSection.color).toBe('#3B82F6');
+      expect(testSection.classId).toBe(testClass.id);
+    });
+
+    test('should create section without color', async () => {
+      const section = await user1Caller.section.create({
+        classId: testClass.id,
+        name: 'Section Without Color',
+      });
+
+      expect(section).toBeDefined();
+      expect(section.name).toBe('Section Without Color');
+    });
+
+    test('should fail to create section for class user is not teacher of', async () => {
+      await expect(user2Caller.section.create({
+        classId: testClass.id,
+        name: 'Unauthorized Section',
+      })).rejects.toThrow();
+    });
+
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.section.create({
+        classId: testClass.id,
+        name: 'Test Section',
+      })));
+  });
+
+  describe('update', () => {
+    test('should update section successfully', async () => {
+      const updated = await user1Caller.section.update({
+        id: testSection.id,
+        classId: testClass.id,
+        name: 'Updated Section Name',
+        color: '#10B981',
+      });
+
+      expect(updated.name).toBe('Updated Section Name');
+      expect(updated.color).toBe('#10B981');
+    });
+
+    test('should update section with partial data', async () => {
+      const updated = await user1Caller.section.update({
+        id: testSection.id,
+        classId: testClass.id,
+        name: 'Partially Updated Section',
+      });
+
+      expect(updated.name).toBe('Partially Updated Section');
+      expect(updated.color).toBe('#3B82F6'); // Should remain unchanged
+    });
+
+    test('should fail to update section user is not teacher of', async () => {
+      await expect(user2Caller.section.update({
+        id: testSection.id,
+        classId: testClass.id,
+        name: 'Unauthorized Update',
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('delete', () => {
+    test('should delete section successfully', async () => {
+      // Create a new section to delete
+      const newSection = await user1Caller.section.create({
+        classId: testClass.id,
+        name: 'To Be Deleted',
+      });
+
+      const result = await user1Caller.section.delete({
+        id: newSection.id,
+        classId: testClass.id,
+      });
+
+      expect(result.id).toBe(newSection.id);
+
+      // Verify section is deleted by trying to update it
+      await expect(user1Caller.section.update({
+        id: newSection.id,
+        classId: testClass.id,
+        name: 'Test',
+      })).rejects.toThrow();
+    });
+
+    test('should fail to delete section user is not teacher of', async () => {
+      await expect(user2Caller.section.delete({
+        id: testSection.id,
+        classId: testClass.id,
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('reorder', () => {
+    test('should reorder section to start', async () => {
+      // Create another section
+      const section2 = await user1Caller.section.create({
+        classId: testClass.id,
+        name: 'Second Section',
+      });
+
+      const originalOrder = section2.order;
+      const result = await user1Caller.section.reorder({
+        classId: testClass.id,
+        movedId: section2.id,
+        position: 'start',
+      });
+
+      expect(result).toBeDefined();
+      expect(result?.order).toBeDefined();
+      // When moved to start, order should be less than original
+      expect(result?.order).toBeLessThanOrEqual(originalOrder || Infinity);
+    });
+
+    test('should reorder section to end', async () => {
+      const section2 = await user1Caller.section.create({
+        classId: testClass.id,
+        name: 'Third Section',
+      });
+
+      const originalOrder = section2.order;
+      const result = await user1Caller.section.reorder({
+        classId: testClass.id,
+        movedId: section2.id,
+        position: 'end',
+      });
+
+      expect(result).toBeDefined();
+      expect(result?.order).toBeDefined();
+      // When moved to end, order should be greater than or equal to original
+      expect(result?.order).toBeGreaterThanOrEqual(originalOrder || 0);
+    });
+
+    test('should reorder section before another', async () => {
+      const section2 = await user1Caller.section.create({
+        classId: testClass.id,
+        name: 'Fourth Section',
+      });
+
+      const targetOrder = testSection.order;
+      const result = await user1Caller.section.reorder({
+        classId: testClass.id,
+        movedId: section2.id,
+        position: 'before',
+        targetId: testSection.id,
+      });
+
+      expect(result).toBeDefined();
+      expect(result?.order).toBeDefined();
+      // When moved before target, order should be less than target's order
+      expect(result?.order).toBeLessThan(targetOrder || Infinity);
+    });
+
+    test('should fail to reorder section user is not teacher of', async () => {
+      // Create a separate class that user2 is not part of
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class for Reorder Test',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+
+      const otherSection = await user1Caller.section.create({
+        classId: otherClass.id,
+        name: 'Other Section',
+      });
+
+      // user2 is not a member of otherClass, so they shouldn't be able to reorder
+      // Note: The reorder endpoint uses protectedProcedure, not protectedTeacherProcedure
+      // It only checks if the section exists, not teacher permissions
+      // So if user2 can see the section (e.g., if they're a student), reorder will succeed
+      // This test verifies that non-class members can't reorder
+      await expect(user2Caller.section.reorder({
+        classId: otherClass.id,
+        movedId: otherSection.id,
+        position: 'start',
+      })).rejects.toThrow();
+    });
+  });
+});
+

package/tests/server/rateLimit.test.ts

@@ -0,0 +1,73 @@
+import { describe, test, expect, beforeEach } from 'vitest';
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import request from 'supertest';
+
+describe('rate limiting', () => {
+  let app: express.Application;
+
+  beforeEach(() => {
+    // Fresh app per test so rate limit state doesn't leak between tests
+    app = express();
+    const testLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: 3,
+      standardHeaders: true,
+      legacyHeaders: false,
+      handler: (req, res) => {
+        res.status(429).json({
+          code: 'TOO_MANY_REQUESTS',
+          message: 'Too many requests, please try again later.',
+        });
+      },
+      skip: (req) => req.path === '/health' || req.method === 'OPTIONS',
+    });
+    app.use(testLimiter);
+    app.get('/health', (_req, res) => res.status(200).json({ status: 'OK' }));
+    app.get('/api/test', (_req, res) => res.status(200).json({ ok: true }));
+  });
+
+  test('allows requests under the limit', async () => {
+    const res = await request(app).get('/api/test');
+    expect(res.status).toBe(200);
+    expect(res.body.ok).toBe(true);
+  });
+
+  test('returns 429 when limit exceeded', async () => {
+    // Make 4 sequential requests; 4th should be rate limited
+    const r1 = await request(app).get('/api/test');
+    const r2 = await request(app).get('/api/test');
+    const r3 = await request(app).get('/api/test');
+    const r4 = await request(app).get('/api/test');
+
+    expect(r1.status).toBe(200);
+    expect(r2.status).toBe(200);
+    expect(r3.status).toBe(200);
+    expect(r4.status).toBe(429);
+
+    expect(r4.body.code).toBe('TOO_MANY_REQUESTS');
+    expect(r4.body.message).toContain('Too many requests');
+  });
+
+  test('skips rate limiting for /health', async () => {
+    // Make many health requests - all should succeed
+    const requests = Array(5)
+      .fill(null)
+      .map(() => request(app).get('/health'));
+    const responses = await Promise.all(requests);
+    expect(responses.every((r) => r.status === 200)).toBe(true);
+  });
+
+  test('429 response matches production format (code + message)', async () => {
+    await request(app).get('/api/test');
+    await request(app).get('/api/test');
+    await request(app).get('/api/test');
+    const limited = await request(app).get('/api/test');
+    expect(limited.status).toBe(429);
+    // Same structure as src/middleware/security.ts rateLimitHandler
+    expect(limited.body).toEqual({
+      code: 'TOO_MANY_REQUESTS',
+      message: 'Too many requests, please try again later.',
+    });
+  });
+});

package/tests/setup.ts

@@ -1,92 +1,72 @@
 import { execSync } from 'child_process';
+import { config } from 'dotenv';
+import { resolve } from 'path';
 import { prisma } from '../src/lib/prisma';
 import { beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
 import { logger } from '../src/utils/logger';
 import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
 import { Session } from '@prisma/client';
-import { clearDatabase } from '../src/seedDatabase';
+
+// Load test environment variables
+config({ path: resolve(process.cwd(), '.env.test') });
 
 const getCaller = async (token: string) => {
   const ctx = await createTRPCContext({
     req: { headers: {
-      authorization: `Bearer ${token}`,
-      'x-user': token,
+      authorization: token ? `Bearer ${token}` : undefined,
+      'x-user': token || undefined,
     } } as any,
     res: {} as any,
   });
   return appRouter.createCaller(ctx);
 };
 
-  // Before the entire test suite runs
-  beforeAll(async () => {
-
-    await clearDatabase();
-
-    logger.info('Getting caller');
-
-    caller = await getCaller('');
-
-    const user1 = await caller.auth.register({
-      username: 'testuser1',
-      email: 'test@test.com',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
-
-    const user2 = await caller.auth.register({
-      username: 'testuser2',
-      email: 'test2@test.com',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
+// globalSetup already registered users; we just login and create callers.
+// Safe to run in parallel — no registration, no DB writes.
+beforeAll(async () => {
+  caller = await getCaller('');
 
-    session1 = await prisma.session.findFirst({
-      where: {
-        userId: user1.user.id,
-      },
-    }) as Session;
+  login1 = await caller.auth.login({ username: 'testuser1', password: 'password_is_1234' });
+  login2 = await caller.auth.login({ username: 'testuser2', password: 'password_is_1234' });
+  login3 = await caller.auth.login({ username: 'testuser3', password: 'password_is_1234' });
 
-    session2 = (await prisma.session.findFirst({
-      where: {
-        userId: user2.user.id,
-      },
-    })) as Session;
+  if (!login1.token || !login2.token || !login3.token) {
+    throw new Error('Failed to get login tokens — ensure globalSetup ran');
+  }
 
-    verification1 = await caller.auth.verify({
-      token: session1.id,
-    });
+  session1 = await prisma.session.findFirst({ where: { userId: login1.user.id } }) as Session;
+  session2 = await prisma.session.findFirst({ where: { userId: login2.user.id } }) as Session;
+  session3 = await prisma.session.findFirst({ where: { userId: login3.user.id } }) as Session;
 
-    verification2 = await caller.auth.verify({
-      token: session2.id,
-    });
+  verification1 = { verified: true };
+  verification2 = { verified: true };
+  verification3 = { verified: true };
 
-    login1 = await caller.auth.login({
-      username: 'testuser1',
-      password: 'password_is_1234',
-    });
+  user1Caller = await getCaller(login1.token);
+  user2Caller = await getCaller(login2.token);
+  user3Caller = await getCaller(login3.token);
+});
 
-    login2 = await caller.auth.login({
-      username: 'testuser2',
-      password: 'password_is_1234',
-    });
-
-    user1Caller = await getCaller(login1.token);
-    user2Caller = await getCaller(login2.token);
-  });
-
-
-  // After all tests, close the DB
-  afterAll(async () => {
+// After all tests, close the DB
+afterAll(async () => {
+  try {
     await prisma.$disconnect();
-  });
+  } catch (error) {
+    logger.error('Error disconnecting from database', { error });
+  }
+});
 
 export let user1Caller: ReturnType<typeof appRouter.createCaller>;
 export let user2Caller: ReturnType<typeof appRouter.createCaller>;
+export let user3Caller: ReturnType<typeof appRouter.createCaller>;
 export let caller: ReturnType<typeof appRouter.createCaller>;
 export let session1: Session;
 export let session2: Session;
+export let session3: Session;
 export let verification1: any;
 export let verification2: any;
+export let verification3: any;
 export let login1: any;
-export let login2: any;
+export let login2: any;
+export let login3: any;