@studious-lms/server 1.13.0 → 1.15.0

package/prisma/migrations/20260610130000_add_worksheet_tags/migration.sql

@@ -0,0 +1,13 @@
+-- CreateTable (implicit many-to-many join for ClassTag <-> Worksheet)
+CREATE TABLE "_WorksheetToTag" (
+    "A" TEXT NOT NULL,
+    "B" TEXT NOT NULL,
+    CONSTRAINT "_WorksheetToTag_A_fkey" FOREIGN KEY ("A") REFERENCES "DiscussionTag"("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "_WorksheetToTag_B_fkey" FOREIGN KEY ("B") REFERENCES "Worksheet"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "_WorksheetToTag_AB_unique" ON "_WorksheetToTag"("A", "B");
+
+-- CreateIndex
+CREATE INDEX "_WorksheetToTag_B_index" ON "_WorksheetToTag"("B");

package/prisma/migrations/20260610140000_expand_embedding_source_types/migration.sql

@@ -0,0 +1,4 @@
+-- AlterEnum
+ALTER TYPE "EmbeddingSourceType" ADD VALUE 'DISCUSSION';
+ALTER TYPE "EmbeddingSourceType" ADD VALUE 'SUBMISSION';
+ALTER TYPE "EmbeddingSourceType" ADD VALUE 'SYLLABUS';

package/prisma/migrations/20260611120000_add_user_terms_acceptance/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN "termsAcceptedAt" TIMESTAMP(3),
+ADD COLUMN "termsVersion" TEXT;

package/prisma/schema.prisma

@@ -5,7 +5,8 @@
 // Try Prisma Accelerate: https://pris.ly/cli/accelerate-init
 
 generator client {
-  provider = "prisma-client-js"
+  provider        = "prisma-client-js"
+  previewFeatures = ["postgresqlExtensions"]
   // output   = "../generated/prisma"
 }
 
@@ -15,9 +16,10 @@ generator client {
 // }
 
 datasource db {
-  provider  = "postgresql"
-  url       = env("DATABASE_URL")
-  directUrl = env("DIRECT_URL")
+  provider   = "postgresql"
+  url        = env("DATABASE_URL")
+  directUrl  = env("DIRECT_URL")
+  extensions = [vector]
 }
 
 enum AssignmentType {
@@ -194,6 +196,9 @@ model User {
   profile  UserProfile?
   verified Boolean      @default(false)
 
+  termsAcceptedAt DateTime?
+  termsVersion      String?
+
   teacherIn Class[] @relation("UserTeacherToClass")
   studentIn Class[] @relation("UserStudentToClass")
 
@@ -321,7 +326,8 @@ model Class {
   tags              Tag[]             @relation("ClassTags")
   permissions       Permission[]      @relation("ClassPermissions")
   discussions       Discussion[]
-  discussionTags    DiscussionTag[]
+  classTags         ClassTag[]
+  embeddings        Embedding[]
 
   discussionsEnabled              Boolean @default(true)
   studentsCanCreateDiscussions    Boolean @default(true)
@@ -542,7 +548,7 @@ model Discussion {
   isLocked       Boolean           @default(false)
   allowReplies   Boolean           @default(true)
   attachments    File[]            @relation("DiscussionFiles")
-  tags           DiscussionTag[]   @relation("DiscussionToTag")
+  tags           ClassTag[]        @relation("DiscussionToTag")
   replies        DiscussionReply[]
   reactions      Reaction[]
   reads          DiscussionRead[]
@@ -575,15 +581,17 @@ model DiscussionReply {
   @@index([parentId])
 }
 
-model DiscussionTag {
+model ClassTag {
   id          String       @id @default(uuid())
   class       Class        @relation(fields: [classId], references: [id], onDelete: Cascade)
   classId     String
   name        String
   color       String       @default("#3B82F6")
   discussions Discussion[] @relation("DiscussionToTag")
+  worksheets  Worksheet[]  @relation("WorksheetToTag")
 
   @@unique([classId, name])
+  @@map("DiscussionTag")
 }
 
 model DiscussionRead {
@@ -861,6 +869,7 @@ model Worksheet {
   runJob                    RunJob?                    @relation("WorksheetRunJob", fields: [runJobId], references: [id], onDelete: SetNull)
 
   status                    JobStatus?                 @default(NOT_STARTED)
+  tags                      ClassTag[]                 @relation("WorksheetToTag")
 
   @@unique([classId, sourceUrl])
 }
@@ -962,6 +971,34 @@ enum RunJobType {
   AI_LAB_CHAT
   AI_NEWTON_CHAT
   STUDENT_PROGRESS_CHAT
+  EMBED_CONTENT
+}
+
+enum EmbeddingSourceType {
+  FILE
+  ASSIGNMENT
+  WORKSHEET
+  ANNOUNCEMENT
+  SECTION
+  DISCUSSION
+  SUBMISSION
+  SYLLABUS
+}
+
+model Embedding {
+  id         String              @id @default(uuid())
+  classId    String
+  sourceType EmbeddingSourceType
+  sourceId   String
+  content    String
+  vector     Unsupported("vector(1536)")
+  metadata   Json?               @default("{}")
+  createdAt  DateTime            @default(now())
+
+  class Class @relation(fields: [classId], references: [id], onDelete: Cascade)
+
+  @@index([classId])
+  @@index([sourceType, sourceId])
 }
 
 enum RunJobStatus {

package/src/index.ts

@@ -27,6 +27,7 @@ import { v4 as uuidv4 } from 'uuid';
 
 import "./instrument.js";
 import { openAIClient } from './utils/inference.js';
+import { aiStreamRouter } from './routes/aiStream.js';
 
 const app = express();
 
@@ -313,6 +314,9 @@ io.engine.on('connection_error', (err: Error) => {
 // Setup socket handlers
 setupSocketHandlers(io);
 
+// AI streaming routes
+app.use('/api/ai', aiStreamRouter);
+
 // File serving endpoint for secure file access
 app.get('/api/files/:fileId', async (req, res) => {
   try {

package/src/instrument.ts

@@ -8,7 +8,7 @@ if (env.NODE_ENV !== 'test') {
     environment: env.NODE_ENV || 'development',
     // Setting this option to true will send default PII data to Sentry.
     // For example, automatic IP address collection on events
-    sendDefaultPii: true,
+    sendDefaultPii: false,
     // @todo: disable in test environment
     enabled: true, // Explicitly disable in test environment
   });

package/src/lib/config/cors.ts

@@ -5,18 +5,24 @@ type CorsEnv = {
   CORS_ALLOWED_ORIGIN_PATTERNS?: string;
 };
 
-const productionOrigins = [
+// First-party Studious domains. These are always allowed, regardless of
+// NODE_ENV, so local/dev servers can still serve the real frontends.
+const studiousOrigins = [
   'https://www.studious.sh',
   'https://studious.sh',
   'https://dev.studious.sh',
-  // @todo: remove in actual prod
-'http://localhost:3000',
-  'http://localhost:3001',
-  'http://127.0.0.1:3000',
-  'http://127.0.0.1:3001',
+  'https://superuser.studious.sh',
+  'https://*.studious.sh',
+  'https://www.studious.ac',
+  'https://studious.ac',
+  'https://dev.studious.ac',
+  'https://superuser.studious.ac',
+  'https://*.studious.ac',
 ];
 
-const nonProductionOrigins = [
+// Local development frontends.
+// @todo: gate these behind a non-production check before real prod.
+const localhostOrigins = [
   'http://localhost:3000',
   'http://localhost:3001',
   'http://127.0.0.1:3000',
@@ -40,6 +46,17 @@ const parseList = (value?: string) =>
 
 const isDefined = <T>(value: T | undefined | null): value is T => Boolean(value);
 
+const hasWildcard = (value: string) => value.includes('*');
+
+// Turn a wildcard origin like `https://*.studious.ac` into an anchored regex.
+// `*` matches one or more subdomain labels (e.g. `app` or `a.b`).
+const wildcardOriginToRegExp = (value: string) => {
+  const escaped = value
+    .replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    .replace(/\\\*/g, '[a-z0-9-]+(?:\\.[a-z0-9-]+)*');
+  return new RegExp(`^${escaped}$`, 'i');
+};
+
 const toCorsOrigin = (value: string) => {
   try {
     return new URL(value).origin;
@@ -79,14 +96,20 @@ export const isValidCorsOriginPatternList = (patterns?: string) => {
 };
 
 export const createCorsOriginMatcher = (env: CorsEnv) => {
-  const allowedOrigins = Array.from(new Set([
-    ...(env.NODE_ENV === 'production' ? productionOrigins : nonProductionOrigins),
+  const configuredOrigins = Array.from(new Set([
+    ...studiousOrigins,
+    ...localhostOrigins,
     env.NEXT_PUBLIC_APP_URL ? toCorsOrigin(env.NEXT_PUBLIC_APP_URL) : undefined,
     ...parseCorsOrigins(env.CORS_ALLOWED_ORIGINS),
   ].filter(isDefined)));
 
+  // Wildcard entries (e.g. `https://*.studious.ac`) can't be matched by exact
+  // string comparison, so they're compiled into regex patterns instead.
+  const allowedOrigins = configuredOrigins.filter((origin) => !hasWildcard(origin));
+
   const allowedOriginPatterns = [
     vercelAppOriginPattern,
+    ...configuredOrigins.filter(hasWildcard).map(wildcardOriginToRegExp),
     ...parseCorsOriginPatterns(env.CORS_ALLOWED_ORIGIN_PATTERNS),
   ];
 

package/src/lib/config/env.ts

@@ -35,6 +35,12 @@ const baseSchema = z.object({
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
   PORT: z.string().transform(Number).default('3001'),
   DATABASE_URL: z.string().url('DATABASE_URL must be a valid URL'),
+  /**
+   * Optional BullMQ key prefix. Defaults to `bull:<NODE_ENV>` (see
+   * `getBullPrefix`). Set explicitly to isolate queues when multiple
+   * databases share one Redis instance (e.g. several devs on one Upstash).
+   */
+  BULL_PREFIX: z.string().optional(),
 });
 
 // Production/development schema with all required vars

package/src/lib/googleCloudStorage.ts

@@ -98,4 +98,25 @@ export async function copyFile(sourcePath: string, destPath: string): Promise<vo
       message: 'Failed to copy file in storage',
     });
   }
+}
+
+/**
+ * Returns the public URL for a GCS object.
+ * The object must be publicly readable (via ACL or bucket-level IAM).
+ */
+export function getPublicUrl(filePath: string): string {
+  return `https://storage.googleapis.com/${env.GOOGLE_CLOUD_BUCKET_NAME}/${filePath}`;
+}
+
+/**
+ * Best-effort attempt to make a GCS object publicly readable.
+ * Silently ignores errors (e.g. uniform bucket-level access enabled).
+ */
+export async function makeFilePublic(filePath: string): Promise<void> {
+  try {
+    await bucket.file(filePath).makePublic();
+  } catch {
+    // Bucket may use uniform access or already have a public IAM policy – either way, the
+    // public URL will work if the bucket allows it; nothing to do here.
+  }
 } 

package/src/lib/inferDocumentFormat.ts

@@ -0,0 +1,58 @@
+import type { DocumentFormat } from '../services/openaiDocumentGen.js';
+import { normalizeDocumentFormat } from '../services/openaiDocumentGen.js';
+
+type FormatRule = { format: DocumentFormat; pattern: RegExp };
+
+/** Ordered most-specific first. */
+const FORMAT_RULES: FormatRule[] = [
+  { format: 'pptx', pattern: /\b(presentation|powerpoint|power point|slides?|slide deck|deck|pptx|\.pptx)\b/i },
+  { format: 'xlsx', pattern: /\b(spreadsheet|excel|workbook|xlsx|gradebook|grade book|\.xlsx)\b/i },
+  { format: 'csv', pattern: /\b(csv|comma[- ]separated|\.csv)\b/i },
+  { format: 'docx', pattern: /\b(word doc(ument)?|docx|editable handout|\.docx)\b/i },
+  { format: 'png', pattern: /\b(diagram|chart|graph|plot|figure|infographic|\.png)\b/i },
+  { format: 'md', pattern: /\b(markdown|readme|\.md)\b/i },
+  { format: 'html', pattern: /\b(html|web ?page|\.html)\b/i },
+  { format: 'txt', pattern: /\b(plain text|text file|\.txt)\b/i },
+];
+
+function inferFromText(...parts: Array<string | null | undefined>): DocumentFormat | null {
+  const hay = parts.filter(Boolean).join('\n');
+  if (!hay.trim()) return null;
+
+  for (const { format, pattern } of FORMAT_RULES) {
+    if (pattern.test(hay)) return format;
+  }
+  return null;
+}
+
+/**
+ * Resolve the output format for a generated document.
+ *
+ * The lab model often passes `format: "pdf"` even for presentations/spreadsheets.
+ * Keyword signals from the teacher request, title, and body take precedence over
+ * a generic pdf default; a non-pdf explicit format is always respected.
+ */
+export function inferDocumentFormat(
+  title: string,
+  content: string,
+  explicit?: string | null,
+  userRequest?: string | null,
+): DocumentFormat {
+  const explicitNorm = explicit?.trim()
+    ? normalizeDocumentFormat(explicit)
+    : null;
+
+  const fromKeywords = inferFromText(userRequest, title, content);
+
+  // Non-pdf explicit choice wins (model or tool args).
+  if (explicitNorm && explicitNorm !== 'pdf') {
+    return explicitNorm;
+  }
+
+  // Override pdf when the request clearly asks for slides, spreadsheets, etc.
+  if (fromKeywords && fromKeywords !== 'pdf') {
+    return fromKeywords;
+  }
+
+  return explicitNorm ?? 'pdf';
+}

package/src/lib/legal.ts

@@ -0,0 +1,2 @@
+/** Must match the "Last updated" month in the client privacy/terms copy. */
+export const CURRENT_TERMS_VERSION = "2025-11";

package/src/lib/prisma.ts

@@ -30,6 +30,19 @@ const getDatabaseUrl = () => {
   }
 };
 
+/**
+ * Resolve a profile-picture value stored in the DB to a browser-loadable URL.
+ * - `null` / empty  → `null`
+ * - already an HTTP URL (e.g. dicebear)  → returned as-is
+ * - raw GCS object path  → converted to a public GCS URL
+ */
+function resolveProfilePictureUrl(raw: string | null): string | null {
+  if (!raw) return null;
+  if (raw.startsWith('http')) return raw;
+  const bucket = env.GOOGLE_CLOUD_BUCKET_NAME;
+  return `https://storage.googleapis.com/${bucket}/${raw}`;
+}
+
 const prismaClientSingleton = () => {
   return new PrismaClient({
     datasources: {
@@ -37,6 +50,23 @@ const prismaClientSingleton = () => {
         url: getDatabaseUrl(),
       },
     },
+  }).$extends({
+    result: {
+      userProfile: {
+        profilePicture: {
+          needs: { profilePicture: true },
+          compute(profile) {
+            return resolveProfilePictureUrl(profile.profilePicture);
+          },
+        },
+        profilePictureThumbnail: {
+          needs: { profilePictureThumbnail: true },
+          compute(profile) {
+            return resolveProfilePictureUrl(profile.profilePictureThumbnail);
+          },
+        },
+      },
+    },
   });
 };
 
@@ -53,4 +83,13 @@ if (env.NODE_ENV !== 'production') {
 
 process.on('beforeExit', async () => {
   await prisma.$disconnect();
-});
+});
+
+/** The concrete (extended) Prisma client type used throughout the app. */
+export type AppPrismaClient = typeof prisma;
+
+/** Transaction client type compatible with the extended Prisma client. */
+export type AppTransactionClient = Omit<
+  AppPrismaClient,
+  '$connect' | '$disconnect' | '$on' | '$transaction' | '$use' | '$extends'
+>;

package/src/models/auth.ts

@@ -102,6 +102,8 @@ export function createUser(data: {
   email: string;
   password: string;
   verified?: boolean;
+  termsAcceptedAt?: Date;
+  termsVersion?: string;
 }) {
   return prisma.user.create({
     data: {
@@ -109,6 +111,8 @@ export function createUser(data: {
       email: data.email,
       password: data.password,
       verified: data.verified ?? false,
+      termsAcceptedAt: data.termsAcceptedAt,
+      termsVersion: data.termsVersion,
       profile: { create: {} },
     },
     select: {

package/src/models/class.ts

@@ -5,7 +5,8 @@
  */
 
 import { Assignment, Class, Folder, GradingBoundary, MarkScheme, Section, SessionType, Worksheet } from "@prisma/client";
-import type { PrismaClient, WorksheetQuestion } from "@prisma/client";
+import type { WorksheetQuestion } from "@prisma/client";
+import type { AppPrismaClient, AppTransactionClient } from "../lib/prisma.js";
 
 import { prisma } from "../lib/prisma.js";
 import { v4 as uuidv4 } from 'uuid';
@@ -477,7 +478,7 @@ async function recursivelyCopyFilesToGcs(folderId: string): Promise<Map<string,
 }
 
 async function recursivelyCreateFiles(
-  tx: PrismaClient | Omit<PrismaClient, "$connect" | "$disconnect" | "$on" | "$transaction" | "$use" | "$extends">,
+  tx: AppPrismaClient | AppTransactionClient,
   folderId: string,
   targetFolderId: string | undefined,
   pathMap: Map<string, string>

package/src/models/marketing.ts

@@ -27,10 +27,18 @@ export function createSchoolDevelopmentProgram(data: {
   });
 }
 
-/** @returns School development program by ID. */
-export function findSchoolDevelopmentProgramById(id: string) {
+/** Public status lookup — omits contact PII (email, phone, address). */
+export function findSchoolDevelopmentProgramStatusById(id: string) {
   return prisma.schoolDevelopementProgram.findUnique({
     where: { id },
+    select: {
+      id: true,
+      name: true,
+      city: true,
+      country: true,
+      status: true,
+      submittedAt: true,
+    },
   });
 }
 

package/src/models/worksheet.ts

@@ -1,8 +1,8 @@
 /**
  * Worksheet model – worksheets, questions, submissions, student progress, grading.
  */
-import type { Prisma } from "@prisma/client";
 import { prisma } from "../lib/prisma.js";
+import type { AppTransactionClient } from "../lib/prisma.js";
 import type { WorksheetQuestionType, JobStatus } from "@prisma/client";
 import {
   classMemberOrSchoolAdminWhere,
@@ -45,6 +45,7 @@ export function findWorksheetByIdForClassMember(id: string, userId: string) {
     include: {
       questions: { orderBy: { order: "asc" as const } },
       class: true,
+      tags: true,
     },
   });
 }
@@ -59,6 +60,7 @@ export function findWorksheetByIdForTeacher(id: string, userId: string) {
     include: {
       questions: { orderBy: { order: "asc" as const } },
       class: true,
+      tags: true,
     },
   });
 }
@@ -69,6 +71,7 @@ export function findWorksheetsByClassId(classId: string) {
     where: { classId },
     include: {
       questions: { select: { id: true } },
+      tags: true,
     },
     orderBy: { createdAt: "desc" },
   });
@@ -121,7 +124,7 @@ export function deleteWorksheet(id: string) {
  * Does not copy student responses or assignment links.
  */
 export async function duplicateWorksheetWithClient(
-  tx: Prisma.TransactionClient,
+  tx: AppTransactionClient,
   sourceWorksheetId: string,
   targetClassId: string,
   name: string