@studious-lms/server 1.16.0 → 1.17.0

package/src/services/userPrivacy.ts

@@ -0,0 +1,196 @@
+/**
+ * User privacy service — data export and account erasure (anonymization).
+ */
+import { TRPCError } from "@trpc/server";
+import { randomBytes } from "node:crypto";
+import { hash } from "bcryptjs";
+import { prisma } from "../lib/prisma.js";
+import { deleteSessionsByUserId } from "../models/auth.js";
+
+async function assertAccountCanBeErased(userId: string) {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: {
+      id: true,
+      teacherIn: {
+        select: {
+          id: true,
+          name: true,
+          _count: { select: { students: true } },
+        },
+      },
+      _count: {
+        select: {
+          assignments: true,
+          createdLabChats: true,
+        },
+      },
+    },
+  });
+
+  if (!user) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "User not found" });
+  }
+
+  const classesWithStudents = user.teacherIn.filter(
+    (cls) => cls._count.students > 0,
+  );
+  if (classesWithStudents.length > 0) {
+    throw new TRPCError({
+      code: "PRECONDITION_FAILED",
+      message:
+        "Delete or transfer your classes before deleting your account.",
+    });
+  }
+
+  if (user._count.assignments > 0) {
+    throw new TRPCError({
+      code: "PRECONDITION_FAILED",
+      message:
+        "Remove or reassign your assignments before deleting your account.",
+    });
+  }
+
+  if (user._count.createdLabChats > 0) {
+    throw new TRPCError({
+      code: "PRECONDITION_FAILED",
+      message: "Remove your AI lab chats before deleting your account.",
+    });
+  }
+}
+
+/** Export a portable snapshot of the authenticated user's personal data. */
+export async function exportUserData(userId: string) {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: {
+      id: true,
+      username: true,
+      email: true,
+      verified: true,
+      termsAcceptedAt: true,
+      termsVersion: true,
+      profile: true,
+      teacherIn: {
+        select: { id: true, name: true, subject: true, section: true },
+      },
+      studentIn: {
+        select: { id: true, name: true, subject: true, section: true },
+      },
+      schoolMemberships: {
+        select: {
+          role: true,
+          status: true,
+          school: { select: { id: true, name: true } },
+        },
+      },
+      submissions: {
+        select: {
+          id: true,
+          createdAt: true,
+          submittedAt: true,
+          gradeReceived: true,
+          extendedResponse: true,
+          assignment: { select: { id: true, title: true, classId: true } },
+        },
+      },
+      events: {
+        select: {
+          id: true,
+          name: true,
+          startTime: true,
+          endTime: true,
+          location: true,
+          remarks: true,
+        },
+      },
+      sentMessages: {
+        select: {
+          id: true,
+          content: true,
+          createdAt: true,
+          conversationId: true,
+        },
+        take: 500,
+        orderBy: { createdAt: "desc" },
+      },
+      notificationsReceived: {
+        select: {
+          id: true,
+          title: true,
+          content: true,
+          read: true,
+          createdAt: true,
+        },
+        take: 200,
+        orderBy: { createdAt: "desc" },
+      },
+    },
+  });
+
+  if (!user) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "User not found" });
+  }
+
+  return {
+    exportedAt: new Date().toISOString(),
+    user,
+  };
+}
+
+/**
+ * Erase personal account data by anonymizing the user record and removing
+ * sessions and memberships. Educational records tied to classes (e.g.
+ * submissions) remain with an anonymized identity where required.
+ */
+export async function deleteUserAccount(userId: string) {
+  await assertAccountCanBeErased(userId);
+  await deleteSessionsByUserId(userId);
+
+  const anonUsername = `deleted_${userId.slice(0, 8)}`;
+  const anonEmail = `deleted+${userId}@studious.invalid`;
+  const randomPassword = await hash(randomBytes(32).toString("hex"), 10);
+
+  await prisma.$transaction([
+    prisma.conversationMember.deleteMany({ where: { userId } }),
+    prisma.notification.deleteMany({
+      where: { OR: [{ senderId: userId }, { receiverId: userId }] },
+    }),
+    prisma.schoolMembership.deleteMany({ where: { userId } }),
+    prisma.permission.deleteMany({
+      where: { OR: [{ userId }, { grantedById: userId }] },
+    }),
+    prisma.user.update({
+      where: { id: userId },
+      data: {
+        teacherIn: { set: [] },
+        studentIn: { set: [] },
+        departments: { set: [] },
+        tags: { set: [] },
+        specificAssignments: { set: [] },
+        presentAttendance: { set: [] },
+        lateAttendance: { set: [] },
+        absentAttendance: { set: [] },
+        schoolId: null,
+        username: anonUsername,
+        email: anonEmail,
+        password: randomPassword,
+        verified: false,
+        termsAcceptedAt: null,
+        termsVersion: null,
+        profile: {
+          update: {
+            displayName: null,
+            bio: null,
+            location: null,
+            website: null,
+            profilePicture: null,
+            profilePictureThumbnail: null,
+          },
+        },
+      },
+    }),
+  ]);
+
+  return { success: true };
+}

package/src/services/worksheet.ts

@@ -6,7 +6,7 @@ import { TRPCError } from "@trpc/server";
 import { JobStatus, Prisma, type WorksheetQuestionType } from "@prisma/client";
 import { prisma } from "../lib/prisma.js";
 import { getFileUrl } from "../lib/fileUpload.js";
-import { cancelGradePipeline, regradeWorksheetPipeline } from "../pipelines/gradeWorksheet.js";
+import { cancelGradePipeline, regradeWorksheetPipeline, regradeAllPipeline } from "../pipelines/gradeWorksheet.js";
 import { enqueueRunJob } from "../workers/queues.js";
 import { logger } from "../utils/logger.js";
 import {
@@ -629,6 +629,25 @@ export async function regradeQuestion(
   return regradeWorksheetPipeline(worksheetResponseId, progressId);
 }
 
+export async function regradeAll(
+  worksheetResponseId: string,
+  userId: string
+) {
+  const worksheetResponse = await findWorksheetResponseByIdForTeacher(
+    worksheetResponseId,
+    userId
+  );
+
+  if (!worksheetResponse) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can regrade all worksheet answers",
+    });
+  }
+
+  await regradeAllPipeline(worksheetResponseId);
+}
+
 export async function gradeAnswer(
   questionId: string,
   studentWorksheetResponseId: string,

package/src/utils/email.ts

@@ -27,7 +27,11 @@ export const transport = nodemailer.createTransport({
 export const sendMail = async ({ from, to, subject, text }: sendMailProps) => {
   // Wrapper function for sending emails
   if (env.EMAIL_DRY_RUN == "true") {
-    logger.info(`Email dry run enabled. Would have sent email to ${to} from ${from} with subject ${subject} and text ${text}`);
+    logger.info("Email dry run enabled. Would have sent email", {
+      to,
+      from,
+      subject,
+    });
     return;
   }
   

package/src/workers/processors/aiNewtonChat.ts

@@ -64,7 +64,6 @@ export const aiNewtonChatWorker = createRunJobWorker({
 
     await generateAndSendNewtonResponse(
       newtonChat.id,
-      triggeringMessage.content,
       conversationId,
       newtonChat.submission,
       aiMessageId,

package/tests/helpers/registerInput.ts

@@ -0,0 +1,20 @@
+import { CURRENT_TERMS_VERSION } from "../../src/lib/legal.js";
+
+export function registerInput(
+  overrides: {
+    username: string;
+    email: string;
+    password?: string;
+    confirmPassword?: string;
+  },
+) {
+  const password = overrides.password ?? "password_is_1234";
+  return {
+    username: overrides.username,
+    email: overrides.email,
+    password,
+    confirmPassword: overrides.confirmPassword ?? password,
+    agreeToTerms: true as const,
+    termsVersion: CURRENT_TERMS_VERSION,
+  };
+}

package/tests/integration/globalSetup.ts

@@ -10,6 +10,7 @@ import { createTRPCContext } from '../../src/trpc';
 import { clearDatabase } from '../../src/seedDatabase';
 import { execSync } from 'child_process';
 import { SessionType } from '@prisma/client';
+import { registerInput } from '../helpers/registerInput.js';
 
 async function runSetup() {
   const ctx = await createTRPCContext({
@@ -20,26 +21,17 @@ async function runSetup() {
 
   execSync('npm run test:pre');
 
-  const user1 = await caller.auth.register({
-    username: 'testuser1',
-    email: 'test@studious.sh',
-    password: 'password_is_1234',
-    confirmPassword: 'password_is_1234',
-  });
+  const user1 = await caller.auth.register(
+    registerInput({ username: 'testuser1', email: 'test@studious.sh' }),
+  );
 
-  const user2 = await caller.auth.register({
-    username: 'testuser2',
-    email: 'test2@studious.sh',
-    password: 'password_is_1234',
-    confirmPassword: 'password_is_1234',
-  });
+  const user2 = await caller.auth.register(
+    registerInput({ username: 'testuser2', email: 'test2@studious.sh' }),
+  );
 
-  const user3 = await caller.auth.register({
-    username: 'testuser3',
-    email: 'test3@studious.sh',
-    password: 'password_is_1234',
-    confirmPassword: 'password_is_1234',
-  });
+  const user3 = await caller.auth.register(
+    registerInput({ username: 'testuser3', email: 'test3@studious.sh' }),
+  );
 
   const session1 = await prisma.session.findFirst({
     where: { userId: user1.user.id, type: SessionType.EMAIL_VERIFICATION },

package/tests/integration/routers/auth.test.ts

@@ -6,6 +6,7 @@ import { test, expect, describe } from 'vitest';
 import { appRouter } from '../../../src/routers/_app';
 import { createTRPCContext } from '../../../src/trpc';
 import { prisma } from '../../../src/lib/prisma';
+import { registerInput } from '../../helpers/registerInput.js';
 import {
   caller,
   login1,
@@ -64,12 +65,9 @@ describe('Auth Router', () => {
   test('check fails when unauthenticated', () => expectUnauth((c) => c.auth.check()));
 
   test('resendVerificationEmail succeeds for existing user', async () => {
-    await caller.auth.register({
-      username: 'resendtest',
-      email: 'resend@studious.sh',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
+    await caller.auth.register(
+      registerInput({ username: 'resendtest', email: 'resend@studious.sh' }),
+    );
     const result = await caller.auth.resendVerificationEmail({
       email: 'resend@studious.sh',
     });
@@ -227,23 +225,20 @@ describe('Auth Router', () => {
 
   test('register fails when username already exists', async () => {
     await expect(
-      caller.auth.register({
-        username: 'testuser1',
-        email: 'newemail@studious.sh',
-        password: 'password_is_1234',
-        confirmPassword: 'password_is_1234',
-      })
+      caller.auth.register(
+        registerInput({
+          username: 'testuser1',
+          email: 'newemail@studious.sh',
+        }),
+      )
     ).rejects.toThrow();
   });
 
   test('register fails when email already exists', async () => {
     await expect(
-      caller.auth.register({
-        username: 'newuser',
-        email: 'test@studious.sh',
-        password: 'password_is_1234',
-        confirmPassword: 'password_is_1234',
-      })
+      caller.auth.register(
+        registerInput({ username: 'newuser', email: 'test@studious.sh' }),
+      )
     ).rejects.toThrow();
   });
 

package/tests/integration/routers/newtonChat.test.ts

@@ -50,7 +50,7 @@ describe('Newton Chat Router', () => {
     conversationId = tutorConversation.conversationId;
   });
 
-  test('rejects attachment-only Newton chat posts', async () => {
+  test('allows attachment-only Newton chat posts', async () => {
     const [uploadTarget] = await user2Caller.message.getUploadUrls({
       conversationId,
       files: [
@@ -70,12 +70,13 @@ describe('Newton Chat Router', () => {
       },
     });
 
-    await expect(
-      user2Caller.newtonChat.postToNewtonChat({
-        newtonChatId,
-        content: '   ',
-        fileIds: [uploadTarget!.id],
-      }),
-    ).rejects.toThrow();
+    const message = await user2Caller.newtonChat.postToNewtonChat({
+      newtonChatId,
+      content: '   ',
+      fileIds: [uploadTarget!.id],
+    });
+
+    expect(message.attachments).toHaveLength(1);
+    expect(message.attachments[0]?.name).toBe('newton-attachment-only.pdf');
   });
 });

package/tests/unit/lib/chatAttachmentPrompt.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, it, vi } from 'vitest';
+import {
+  buildUserMessageContentWithAttachments,
+  loadChatAttachments,
+} from '../../../src/lib/chatAttachmentPrompt.js';
+
+const pdfBytes = new Uint8Array([0x25, 0x50, 0x44, 0x46]);
+const docxText = 'Unit 3 lesson plan content';
+
+vi.mock('officeparser', () => ({
+  OfficeParser: {
+    parseOffice: vi.fn(async () => ({
+      toText: () => docxText,
+    })),
+  },
+}));
+
+vi.mock('../../../src/lib/googleCloudStorage.js', () => ({
+  bucket: {
+    file: vi.fn((path: string) => ({
+      download: vi.fn(async () => {
+        if (path.includes('missing')) {
+          throw new Error('not found');
+        }
+        if (path.endsWith('.docx')) {
+          return [Buffer.from('fake-docx-bytes')];
+        }
+        return [Buffer.from(pdfBytes)];
+      }),
+    })),
+  },
+}));
+
+describe('buildUserMessageContentWithAttachments', () => {
+  it('returns plain text when there are no attachments', () => {
+    expect(buildUserMessageContentWithAttachments('Hello', [])).toBe('Hello');
+  });
+
+  it('includes PDFs as inline file parts with bytes', () => {
+    const content = buildUserMessageContentWithAttachments('Review this', [
+      {
+        id: '1',
+        name: 'essay.pdf',
+        type: 'application/pdf',
+        path: 'essay.pdf',
+        data: pdfBytes,
+      },
+    ]);
+
+    expect(content).toEqual([
+      { type: 'text', text: 'Review this' },
+      {
+        type: 'file',
+        data: pdfBytes,
+        mediaType: 'application/pdf',
+        filename: 'essay.pdf',
+      },
+    ]);
+  });
+
+  it('includes extracted docx text in the message body', () => {
+    const content = buildUserMessageContentWithAttachments('Summarize', [
+      {
+        id: '2',
+        name: 'plan.docx',
+        type: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        path: 'plan.docx',
+        extractedText: docxText,
+      },
+    ]);
+
+    expect(content).toBe(
+      `Summarize\n\n[Content of plan.docx]:\n${docxText}`,
+    );
+  });
+
+  it('lists unsupported file types when extraction failed', () => {
+    const content = buildUserMessageContentWithAttachments('Here', [
+      {
+        id: '3',
+        name: 'clip.mp4',
+        type: 'video/mp4',
+        path: 'clip.mp4',
+      },
+    ]);
+
+    expect(content).toBe(
+      'Here\n[Attached files (content not extracted): clip.mp4 (video/mp4)]',
+    );
+  });
+});
+
+describe('loadChatAttachments', () => {
+  it('loads bytes and extracts office document text', async () => {
+    const resolved = await loadChatAttachments([
+      {
+        id: '1',
+        name: 'plan.docx',
+        type: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        path: 'uploads/plan.docx',
+      },
+    ]);
+
+    expect(resolved[0]?.data).toBeDefined();
+    expect(resolved[0]?.extractedText).toBe(docxText);
+  });
+
+  it('loads pdf bytes without extracted text', async () => {
+    const resolved = await loadChatAttachments([
+      {
+        id: '2',
+        name: 'scan.pdf',
+        type: 'application/pdf',
+        path: 'uploads/scan.pdf',
+      },
+    ]);
+
+    expect(resolved[0]?.data).toEqual(pdfBytes);
+    expect(resolved[0]?.extractedText).toBeUndefined();
+  });
+
+  it('skips download for video attachments', async () => {
+    const resolved = await loadChatAttachments([
+      {
+        id: '3',
+        name: 'clip.mp4',
+        type: 'video/mp4',
+        path: 'uploads/clip.mp4',
+      },
+    ]);
+
+    expect(resolved[0]?.data).toBeUndefined();
+    expect(resolved[0]?.extractedText).toBeUndefined();
+  });
+});

package/tests/unit/lib/inferDocumentFormat.test.ts

@@ -30,4 +30,14 @@ describe('inferDocumentFormat', () => {
   it('defaults to pdf for generic handouts', () => {
     expect(inferDocumentFormat('Reading Guide', 'Chapter summary', 'pdf')).toBe('pdf');
   });
+
+  it('overrides pdf when content mentions a flowchart', () => {
+    expect(
+      inferDocumentFormat(
+        'Photosynthesis Overview',
+        'Include a flowchart of the light reactions.',
+        'pdf',
+      ),
+    ).toBe('png');
+  });
 });

package/tests/unit/pipelines/labChatPrompt.test.ts

@@ -17,8 +17,8 @@ describe("buildLabChatAgentSystemPrompt", () => {
 });
 
 describe("buildLabChatAgentMessages", () => {
-  test("folds the class context into the system prompt, not the message list", () => {
-    const { system, messages } = buildLabChatAgentMessages({
+  test("folds the class context into the system prompt, not the message list", async () => {
+    const { system, messages } = await buildLabChatAgentMessages({
       context: "Topic context",
       classContext: "CLASS: Biology",
       recentMessages: [
@@ -41,8 +41,8 @@ describe("buildLabChatAgentMessages", () => {
     ]);
   });
 
-  test("sorts timestamped history into chronological order before prompt assembly", () => {
-    const { messages } = buildLabChatAgentMessages({
+  test("sorts timestamped history into chronological order before prompt assembly", async () => {
+    const { messages } = await buildLabChatAgentMessages({
       context: "Topic context",
       classContext: "CLASS: Biology",
       recentMessages: [
@@ -76,8 +76,8 @@ describe("buildLabChatAgentMessages", () => {
     });
   });
 
-  test("keeps original order among messages without timestamps", () => {
-    const { messages } = buildLabChatAgentMessages({
+  test("keeps original order among messages without timestamps", async () => {
+    const { messages } = await buildLabChatAgentMessages({
       context: "Topic context",
       classContext: "CLASS: Biology",
       recentMessages: [

package/tests/unit/services/aiChatStream.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'vitest';
+import {
+  enrichStreamPartsWithGeneratedFiles,
+  finalizeDeferredToolParts,
+} from '../../../src/services/aiChatStream.js';
+
+describe('enrichStreamPartsWithGeneratedFiles', () => {
+  it('links generated files to generate_document tool parts by title', () => {
+    const parts = enrichStreamPartsWithGeneratedFiles(
+      [
+        { type: 'text', text: 'Here is your worksheet.' },
+        {
+          type: 'tool',
+          toolCallId: 'tc-1',
+          toolName: 'generate_document',
+          title: 'Algebra Review',
+          status: 'completed',
+        },
+      ],
+      [{ title: 'Algebra Review', fileId: 'file-1', fileName: 'Algebra_Review.pdf' }],
+    );
+
+    expect(parts[1]).toMatchObject({
+      type: 'tool',
+      fileId: 'file-1',
+      fileName: 'Algebra_Review.pdf',
+    });
+  });
+
+  it('falls back to order when titles do not match', () => {
+    const parts = enrichStreamPartsWithGeneratedFiles(
+      [
+        {
+          type: 'tool',
+          toolCallId: 'tc-1',
+          toolName: 'generate_document',
+          status: 'completed',
+        },
+      ],
+      [{ title: 'Doc A', fileId: 'file-a', fileName: 'doc_a.pdf' }],
+    );
+
+    expect(parts[0]).toMatchObject({ fileId: 'file-a' });
+  });
+
+  it('marks linked generate_document tools completed', () => {
+    const parts = enrichStreamPartsWithGeneratedFiles(
+      [
+        {
+          type: 'tool',
+          toolCallId: 'tc-1',
+          toolName: 'generate_document',
+          title: 'Slides',
+          status: 'executing',
+        },
+      ],
+      [{ title: 'Slides', fileId: 'file-1', fileName: 'slides.pptx' }],
+    );
+
+    expect(parts[0]).toMatchObject({ status: 'completed', fileId: 'file-1' });
+  });
+});
+
+describe('finalizeDeferredToolParts', () => {
+  it('marks generate_document without a file as failed', () => {
+    const parts = finalizeDeferredToolParts([
+      {
+        type: 'tool',
+        toolCallId: 'tc-1',
+        toolName: 'generate_document',
+        title: 'Missing',
+        status: 'executing',
+      },
+    ]);
+
+    expect(parts[0]).toMatchObject({ status: 'failed' });
+  });
+
+  it('leaves other tools unchanged', () => {
+    const parts = finalizeDeferredToolParts([
+      {
+        type: 'tool',
+        toolCallId: 'tc-1',
+        toolName: 'propose_assignment',
+        title: 'HW',
+        status: 'completed',
+      },
+    ]);
+
+    expect(parts[0]).toMatchObject({ status: 'completed' });
+  });
+});