@studious-lms/server 1.11.0 → 1.12.0

package/src/services/studentProgress.ts

@@ -8,6 +8,10 @@ import { prisma } from "../lib/prisma.js";
 import { isTeacherInClass } from "../models/class.js";
 import { inference } from "../utils/inference.js";
 import { logger } from "../utils/logger.js";
+import {
+  getStudentProgressInferenceCacheHit,
+  setStudentProgressInferenceCache,
+} from "./studentProgressInferenceCache.js";
 
 type ProgressChatMessage = {
   role: "user" | "assistant";
@@ -681,23 +685,53 @@ function buildStructuredInferenceMessages(
   ];
 }
 
+type ProgressInferenceCacheRow<T> = {
+  epoch: number;
+  cachedAt: number;
+  value: T;
+};
+
+const studentProgressInsightsCache = new Map<
+  string,
+  ProgressInferenceCacheRow<StudentProgressInsights>
+>();
+const studentProgressForecastCache = new Map<
+  string,
+  ProgressInferenceCacheRow<StudentProgressForecast>
+>();
+const studentProgressFocusCache = new Map<
+  string,
+  ProgressInferenceCacheRow<StudentProgressFocus>
+>();
+
 export async function getStudentProgressInsights(
   viewerId: string,
   classId: string,
   studentId: string,
 ) {
+  const cached = getStudentProgressInferenceCacheHit(
+    studentProgressInsightsCache,
+    classId,
+    studentId,
+  );
+
   const { classData, student, submissions } = await loadStudentProgressContext(
     viewerId,
     classId,
     studentId,
   );
+
+  if (cached !== undefined) {
+    return cached;
+  }
+
   const context = buildStructuredProgressContext(
     classData,
     student,
     submissions,
   );
 
-  return inference<StudentProgressInsights>(
+  const value = await inference<StudentProgressInsights>(
     buildStructuredInferenceMessages(
       [
         "Generate an AI analytics summary for this one student's dashboard.",
@@ -713,6 +747,13 @@ export async function getStudentProgressInsights(
       metadata: { viewerId, classId, studentId },
     },
   );
+  setStudentProgressInferenceCache(
+    studentProgressInsightsCache,
+    classId,
+    studentId,
+    value,
+  );
+  return value;
 }
 
 export async function getStudentProgressForecast(
@@ -720,18 +761,29 @@ export async function getStudentProgressForecast(
   classId: string,
   studentId: string,
 ) {
+  const cached = getStudentProgressInferenceCacheHit(
+    studentProgressForecastCache,
+    classId,
+    studentId,
+  );
+
   const { classData, student, submissions } = await loadStudentProgressContext(
     viewerId,
     classId,
     studentId,
   );
+
+  if (cached !== undefined) {
+    return cached;
+  }
+
   const context = buildStructuredProgressContext(
     classData,
     student,
     submissions,
   );
 
-  return inference<StudentProgressForecast>(
+  const value = await inference<StudentProgressForecast>(
     buildStructuredInferenceMessages(
       "Predict the student's next graded assignment percentage band and risk status. Base the forecast on trajectory, missing work, low scores, and assignment recency. Keep the reason to one sentence.",
       context,
@@ -742,6 +794,13 @@ export async function getStudentProgressForecast(
       metadata: { viewerId, classId, studentId },
     },
   );
+  setStudentProgressInferenceCache(
+    studentProgressForecastCache,
+    classId,
+    studentId,
+    value,
+  );
+  return value;
 }
 
 export async function getStudentProgressFocus(
@@ -749,18 +808,29 @@ export async function getStudentProgressFocus(
   classId: string,
   studentId: string,
 ) {
+  const cached = getStudentProgressInferenceCacheHit(
+    studentProgressFocusCache,
+    classId,
+    studentId,
+  );
+
   const { classData, student, submissions } = await loadStudentProgressContext(
     viewerId,
     classId,
     studentId,
   );
+
+  if (cached !== undefined) {
+    return cached;
+  }
+  
   const context = buildStructuredProgressContext(
     classData,
     student,
     submissions,
   );
 
-  return inference<StudentProgressFocus>(
+  const value = await inference<StudentProgressFocus>(
     buildStructuredInferenceMessages(
       "Generate 3-5 student-facing weekly focus items. Each item should be specific, actionable, and grounded in the student's grade pattern or assignment titles. No numbering in the strings.",
       context,
@@ -771,6 +841,13 @@ export async function getStudentProgressFocus(
       metadata: { viewerId, classId, studentId },
     },
   );
+  setStudentProgressInferenceCache(
+    studentProgressFocusCache,
+    classId,
+    studentId,
+    value,
+  );
+  return value;
 }
 
 export async function chatAboutStudentProgress(

package/src/services/studentProgressInferenceCache.ts

@@ -0,0 +1,64 @@
+/**
+ * In-process cache for student progress AI panels (insights / forecast / focus).
+ * Epoch bumps invalidate all three for a given class + student (e.g. after a grade update).
+ * Entries also expire after one week so stale AI summaries eventually refresh.
+ */
+
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+
+const epochByScope = new Map<string, number>();
+
+function scopeKey(classId: string, studentId: string) {
+  return `${classId}:${studentId}`;
+}
+
+function currentStudentProgressInferenceEpoch(
+  classId: string,
+  studentId: string,
+) {
+  return epochByScope.get(scopeKey(classId, studentId)) ?? 0;
+}
+
+/** Call when a teacher updates `gradeReceived` for that student's work in this class. */
+export function invalidateStudentProgressInferenceCache(
+  classId: string,
+  studentId: string,
+) {
+  const key = scopeKey(classId, studentId);
+  epochByScope.set(key, (epochByScope.get(key) ?? 0) + 1);
+}
+
+type CacheRow<T> = { epoch: number; cachedAt: number; value: T };
+
+export function getStudentProgressInferenceCacheHit<T>(
+  store: Map<string, CacheRow<T>>,
+  classId: string,
+  studentId: string,
+): T | undefined {
+  const key = scopeKey(classId, studentId);
+  const epoch = currentStudentProgressInferenceEpoch(classId, studentId);
+  const hit = store.get(key);
+  if (!hit) {
+    return undefined;
+  }
+  const fresh =
+    hit.epoch === epoch && Date.now() - hit.cachedAt < WEEK_MS;
+  if (!fresh) {
+    store.delete(key);
+    return undefined;
+  }
+  return hit.value;
+}
+
+export function setStudentProgressInferenceCache<T>(
+  store: Map<string, CacheRow<T>>,
+  classId: string,
+  studentId: string,
+  value: T,
+) {
+  store.set(scopeKey(classId, studentId), {
+    epoch: currentStudentProgressInferenceEpoch(classId, studentId),
+    cachedAt: Date.now(),
+    value,
+  });
+}

package/src/services/worksheet.ts

@@ -35,6 +35,7 @@ import {
   createStudentQuestionProgressForGrading,
   createComment,
   findStudentQuestionProgressByIdForTeacher,
+  findStudentQuestionProgressByIdForStudentOrTeacher,
   findStudentQuestionProgressByIdForTeacherAndResponse,
 } from "../models/worksheet.js";
 
@@ -645,14 +646,15 @@ export async function addCommentToResponse(
   comment: string,
   authorId: string
 ) {
-  const progress = await findStudentQuestionProgressByIdForTeacher(
+  const progress = await findStudentQuestionProgressByIdForStudentOrTeacher(
     responseId,
     authorId
   );
   if (!progress) {
     throw new TRPCError({
       code: "FORBIDDEN",
-      message: "Only class teachers can comment on worksheet responses",
+      message:
+        "You can only comment on your own worksheet answers or on answers for classes you teach",
     });
   }
 

package/src/trpc.ts

@@ -7,6 +7,7 @@ import { Request, Response } from 'express';
 import { z } from 'zod';
 import { handlePrismaError, PrismaErrorInfo } from './utils/prismaErrorHandler.js';
 import { findUserBySessionToken } from './models/auth.js';
+import { assertAdminPanelUser } from './utils/adminPanelAccess.js';
 
 interface CreateContextOptions {
   req: Request;
@@ -88,6 +89,20 @@ export const publicProcedure = t.procedure.use(loggingMiddleware);
 // Protected procedures
 export const protectedProcedure = publicProcedure.use(isAuthed);
 
+const adminPanelMiddleware = t.middleware(({ ctx, next }) => {
+  if (!ctx.user) {
+    throw new TRPCError({
+      code: 'UNAUTHORIZED',
+      message: 'Not authenticated',
+    });
+  }
+  assertAdminPanelUser(ctx.user.id);
+  return next({ ctx });
+});
+
+/** Authenticated + env allowlist (see `assertAdminPanelUser`). */
+export const adminProcedure = protectedProcedure.use(adminPanelMiddleware);
+
 export const protectedClassMemberProcedure = protectedProcedure
   .input(z.object({ classId: z.string() }).passthrough())
   .use(isMemberInClass);

package/src/utils/adminPanelAccess.ts

@@ -0,0 +1,46 @@
+import { TRPCError } from '@trpc/server';
+import { env } from '../lib/config/env.js';
+
+function parseAdminUserIds(raw: string | undefined): Set<string> {
+  if (!raw?.trim()) return new Set();
+  return new Set(
+    raw
+      .split(/[\s,]+/)
+      .map((s) => s.trim())
+      .filter(Boolean),
+  );
+}
+
+/**
+ * Admin tRPC routes: in production `ADMIN_PANEL_USER_IDS` must be a non-empty
+ * comma/whitespace-separated list of user UUIDs. In non-production, an empty
+ * unset value allows any authenticated user (local ops); a non-empty list is
+ * still enforced.
+ */
+export function assertAdminPanelUser(userId: string): void {
+  const allowed = parseAdminUserIds(env.ADMIN_PANEL_USER_IDS);
+
+  if (env.NODE_ENV === 'production') {
+    if (allowed.size === 0) {
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message:
+          'Admin API disabled: set ADMIN_PANEL_USER_IDS to a non-empty list of user ids.',
+      });
+    }
+    if (!allowed.has(userId)) {
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message: 'You are not allowed to use the admin API.',
+      });
+    }
+    return;
+  }
+
+  if (allowed.size > 0 && !allowed.has(userId)) {
+    throw new TRPCError({
+      code: 'FORBIDDEN',
+      message: 'You are not allowed to use the admin API.',
+    });
+  }
+}

package/tests/integration/routers/discussion.test.ts

@@ -0,0 +1,253 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { expectForbidden, expectUnauth } from '../helpers';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+
+vi.mock('../../../src/lib/pusher.js', async () => ({
+  pusher: { trigger: vi.fn().mockResolvedValue(undefined) },
+  chatChannel: (conversationId: string) => `private-conversation-${conversationId}`,
+  worksheetChannel: (worksheetResponseId: string) => `private-worksheet-${worksheetResponseId}`,
+  teacherChannel: (classId: string) => `private-teacher-${classId}`,
+  discussionChannel: (classId: string) => `private-class-${classId}-discussions`,
+  worksheetJobChannel: (worksheetId: string) => `private-worksheet-job-${worksheetId}`,
+}));
+
+describe('Discussion Router', () => {
+  let testClass: any;
+  let studentId: string;
+  let secondStudentId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: `Discussion Test Class ${Date.now()}`,
+      subject: 'History',
+      section: '12th Grade',
+    });
+
+    const studentProfile = await user2Caller.user.getProfile();
+    const secondStudentProfile = await user3Caller.user.getProfile();
+    studentId = studentProfile.id;
+    secondStudentId = secondStudentProfile.id;
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId,
+    });
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: secondStudentId,
+    });
+  });
+
+  test('creates, lists, searches, paginates, tags, and reacts to discussions', async () => {
+    const tag = await user1Caller.discussion.tags.create({
+      classId: testClass.id,
+      name: `Review ${Date.now()}`,
+      color: '#3B82F6',
+    });
+
+    const first = await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Primary source analysis',
+      body: 'Discuss the archive packet.',
+      type: 'DISCUSSION',
+      tagIds: [tag.id],
+    });
+    const question = await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Exam review question',
+      body: 'Where should we focus?',
+      type: 'QUESTION',
+    });
+    await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Reading logistics',
+      body: 'Bring the printed handout.',
+      type: 'ANNOUNCEMENT',
+    });
+
+    await user1Caller.discussion.pin({
+      discussionId: first.discussion.id,
+      isPinned: true,
+    });
+
+    await user2Caller.discussion.reply({
+      discussionId: first.discussion.id,
+      body: 'I found one strong quote.',
+    });
+    await user2Caller.discussion.reply({
+      discussionId: first.discussion.id,
+      body: 'A second point for ranking.',
+    });
+    await user2Caller.discussion.reply({
+      discussionId: question.discussion.id,
+      body: 'Focus on the essay question.',
+    });
+
+    const list = await user2Caller.discussion.list({
+      classId: testClass.id,
+      sort: 'top',
+      limit: 2,
+    });
+    expect(list.items).toHaveLength(2);
+    expect(list.nextCursor).toBeDefined();
+    expect(list.items[0].id).toBe(first.discussion.id);
+    expect(list.items[0].isPinned).toBe(true);
+    expect(list.items[0].replyCount).toBe(2);
+
+    const search = await user2Caller.discussion.list({
+      classId: testClass.id,
+      search: 'exam review',
+      sort: 'activity',
+      limit: 10,
+    });
+    expect(search.items.map((item: any) => item.id)).toContain(question.discussion.id);
+
+    const byTag = await user2Caller.discussion.list({
+      classId: testClass.id,
+      tagId: tag.id,
+      sort: 'activity',
+      limit: 10,
+    });
+    expect(byTag.items.map((item: any) => item.id)).toEqual([first.discussion.id]);
+
+    const reaction = await user2Caller.discussion.reactions.toggle({
+      discussionId: first.discussion.id,
+      type: 'HEART',
+    });
+    expect(reaction.reaction?.type).toBe('HEART');
+
+    const removedReaction = await user2Caller.discussion.reactions.toggle({
+      discussionId: first.discussion.id,
+      type: 'HEART',
+    });
+    expect(removedReaction.reaction).toBeNull();
+  });
+
+  test('returns nested replies, preserves children after soft delete, and toggles accepted answers', async () => {
+    const created = await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Question thread',
+      body: 'Which answer is best?',
+      type: 'QUESTION',
+    });
+
+    const parent = await user2Caller.discussion.reply({
+      discussionId: created.discussion.id,
+      body: 'This is my answer.',
+    });
+    const child = await user3Caller.discussion.reply({
+      discussionId: created.discussion.id,
+      parentReplyId: parent.reply.id,
+      body: 'Adding evidence under that answer.',
+    });
+
+    const accepted = await user1Caller.discussion.markAcceptedAnswer({
+      replyId: parent.reply.id,
+      accepted: true,
+    });
+    expect(accepted.reply.isAcceptedAnswer).toBe(true);
+
+    const deleted = await user2Caller.discussion.deleteReply({
+      replyId: parent.reply.id,
+    });
+    expect(deleted.reply.body).toBe('[deleted]');
+    expect(deleted.reply.deletedAt).toBeTruthy();
+
+    const thread = await user1Caller.discussion.get({
+      discussionId: created.discussion.id,
+    });
+    expect(thread.replies).toHaveLength(1);
+    expect(thread.replies[0].id).toBe(parent.reply.id);
+    expect(thread.replies[0].body).toBe('[deleted]');
+    expect(thread.replies[0].children[0].id).toBe(child.reply.id);
+  });
+
+  test('computes unread counts after a reader marks a discussion read', async () => {
+    const created = await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Unread count thread',
+      body: 'Watch unread counts here.',
+      type: 'DISCUSSION',
+    });
+
+    await user2Caller.discussion.get({ discussionId: created.discussion.id });
+    await user3Caller.discussion.reply({
+      discussionId: created.discussion.id,
+      body: 'This should be unread for the first student.',
+    });
+
+    const counts = await user2Caller.discussion.getUnreadCounts({
+      classIds: [testClass.id],
+    });
+    expect(counts[testClass.id].total).toBe(1);
+    expect(counts[testClass.id].perDiscussion).toEqual([
+      { discussionId: created.discussion.id, count: 1 },
+    ]);
+
+    await user2Caller.discussion.markRead({ discussionId: created.discussion.id });
+    const afterRead = await user2Caller.discussion.getUnreadCounts({
+      classIds: [testClass.id],
+    });
+    expect(afterRead[testClass.id].total).toBe(0);
+  });
+
+  test('enforces discussion authorization branches', async () => {
+    await expectUnauth((caller) => caller.discussion.list({
+      classId: testClass.id,
+      sort: 'activity',
+      limit: 10,
+    }));
+
+    await expectForbidden(() => user2Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Student announcement',
+      body: 'Students cannot make this type.',
+      type: 'ANNOUNCEMENT',
+    }));
+
+    await user1Caller.class.update({
+      classId: testClass.id,
+      studentsCanCreateDiscussions: false,
+    });
+    await expectForbidden(() => user2Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Blocked student discussion',
+      body: 'This should not create.',
+      type: 'DISCUSSION',
+    }));
+
+    const created = await user1Caller.discussion.create({
+      classId: testClass.id,
+      title: 'Teacher managed thread',
+      body: 'Teacher owns this.',
+      type: 'DISCUSSION',
+    });
+
+    await expectForbidden(() => user2Caller.discussion.pin({
+      discussionId: created.discussion.id,
+      isPinned: true,
+    }));
+
+    await user1Caller.discussion.lock({
+      discussionId: created.discussion.id,
+      isLocked: true,
+    });
+    await expectForbidden(() => user2Caller.discussion.reply({
+      discussionId: created.discussion.id,
+      body: 'Student cannot reply to locked thread.',
+    }));
+
+    await user1Caller.class.update({
+      classId: testClass.id,
+      discussionsEnabled: false,
+    });
+    await expectForbidden(() => user1Caller.discussion.list({
+      classId: testClass.id,
+      sort: 'activity',
+      limit: 10,
+    }));
+    await expectForbidden(() => user1Caller.discussion.get({
+      discussionId: created.discussion.id,
+    }));
+  });
+});