@studious-lms/server 1.2.53 → 1.3.0

package/tests/routers/message.test.ts

@@ -0,0 +1,123 @@
+import { test, expect, describe, beforeAll } from 'vitest';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+
+describe('Message Router', () => {
+  let conversationId: string;
+  let messageId: string;
+  let user1Id: string;
+  let user2Id: string;
+
+  beforeAll(async () => {
+    const user1Profile = await user1Caller.user.getProfile();
+    const user2Profile = await user2Caller.user.getProfile();
+    user1Id = user1Profile.id;
+    user2Id = user2Profile.id;
+
+    const conversation = await user1Caller.conversation.create({
+      type: 'GROUP',
+      name: 'Message Test Group',
+      memberIds: [user2Id],
+    });
+    conversationId = conversation.id;
+  });
+
+  describe('send', () => {
+    test('should send a message', async () => {
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Hello from tests!',
+      });
+
+      expect(result).toBeDefined();
+      expect(result.content).toBe('Hello from tests!');
+      expect(result.senderId).toBe(user1Id);
+      messageId = result.id;
+    });
+
+    test('should send a message with mentions', async () => {
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Hey @user2!',
+        mentionedUserIds: [user2Id],
+      });
+
+      expect(result).toBeDefined();
+      expect(result.mentionedUserIds).toContain(user2Id);
+    });
+
+    test('should fail for non-member', async () => {
+      await expect(
+        user3Caller.message.send({
+          conversationId,
+          content: 'Unauthorized message',
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('list', () => {
+    test('should list messages in conversation', async () => {
+      const result = await user1Caller.message.list({ conversationId });
+
+      expect(result.messages).toBeDefined();
+      expect(Array.isArray(result.messages)).toBe(true);
+      expect(result.messages.length).toBeGreaterThanOrEqual(2);
+    });
+
+    test('should fail for non-member', async () => {
+      await expect(
+        user3Caller.message.list({ conversationId }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('update', () => {
+    test('should update own message', async () => {
+      const result = await user1Caller.message.update({
+        messageId,
+        content: 'Updated message content',
+      });
+
+      expect(result.content).toBe('Updated message content');
+    });
+
+    test('should fail to update another user\'s message', async () => {
+      await expect(
+        user2Caller.message.update({
+          messageId,
+          content: 'Unauthorized edit',
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('markAsRead', () => {
+    test('should mark conversation as read', async () => {
+      const result = await user2Caller.message.markAsRead({ conversationId });
+      expect(result.success).toBe(true);
+    });
+  });
+
+  describe('getUnreadCount', () => {
+    test('should return unread counts', async () => {
+      const result = await user2Caller.message.getUnreadCount({ conversationId });
+
+      expect(result).toBeDefined();
+      expect(typeof result.unreadCount).toBe('number');
+      expect(typeof result.unreadMentionCount).toBe('number');
+    });
+  });
+
+  describe('delete', () => {
+    test('should fail to delete another user\'s message', async () => {
+      await expect(
+        user2Caller.message.delete({ messageId }),
+      ).rejects.toThrow();
+    });
+
+    test('should delete own message', async () => {
+      const result = await user1Caller.message.delete({ messageId });
+      expect(result.success).toBe(true);
+    });
+  });
+});

package/tests/routers/notification.test.ts

@@ -0,0 +1,69 @@
+import { test, expect, describe } from 'vitest';
+import { user1Caller, user2Caller } from '../setup';
+import { expectUnauth } from '../helpers';
+
+describe('Notification Router', () => {
+  let notificationId: string;
+  let user2Id: string;
+
+  test('should send notification to another user', async () => {
+    const user2Profile = await user2Caller.user.getProfile();
+    user2Id = user2Profile.id;
+
+    const notification = await user1Caller.notification.sendTo({
+      receiverId: user2Id,
+      title: 'Test Notification',
+      content: 'This is a test notification',
+    });
+
+    expect(notification).toBeDefined();
+    expect(notification.title).toBe('Test Notification');
+    expect(notification.content).toBe('This is a test notification');
+    expect(notification.receiverId).toBe(user2Id);
+    notificationId = notification.id;
+  });
+
+  test('should list notifications for receiver', async () => {
+    const notifications = await user2Caller.notification.list();
+
+    expect(Array.isArray(notifications)).toBe(true);
+    const found = notifications.find((n) => n.id === notificationId);
+    expect(found).toBeDefined();
+    expect(found!.title).toBe('Test Notification');
+  });
+
+  test('should get a single notification', async () => {
+    const notification = await user2Caller.notification.get({ id: notificationId });
+
+    expect(notification).toBeDefined();
+    expect(notification!.id).toBe(notificationId);
+    expect(notification!.title).toBe('Test Notification');
+  });
+
+  test('should mark notification as read', async () => {
+    const notification = await user2Caller.notification.markAsRead({ id: notificationId });
+
+    expect(notification.read).toBe(true);
+  });
+
+  test('should send to multiple users', async () => {
+    const user1Profile = await user1Caller.user.getProfile();
+
+    const result = await user1Caller.notification.sendToMultiple({
+      receiverIds: [user2Id, user1Profile.id],
+      title: 'Bulk Notification',
+      content: 'Sent to multiple users',
+    });
+
+    expect(result.count).toBe(2);
+  });
+
+  test('should not list notifications meant for other users', async () => {
+    const notifications = await user1Caller.notification.list();
+    const foreignNotif = notifications.find((n) => n.id === notificationId);
+    expect(foreignNotif).toBeUndefined();
+  });
+
+  test('should fail without authentication', () =>
+    expectUnauth((c) => c.notification.list()));
+});

package/tests/{section.test.ts → routers/section.test.ts}

@@ -1,7 +1,6 @@
 import { test, expect, describe, beforeEach } from 'vitest';
-import { user1Caller, user2Caller } from './setup';
-import { createTRPCContext } from '../src/trpc';
-import { appRouter } from '../src/routers/_app';
+import { user1Caller, user2Caller } from '../setup';
+import { expectUnauth } from '../helpers';
 
 describe('Section Router', () => {
   let testClass: any;
@@ -49,18 +48,11 @@ describe('Section Router', () => {
       })).rejects.toThrow();
     });
 
-    test('should fail without authentication', async () => {
-      const invalidCaller = await createTRPCContext({
-        req: { headers: {} } as any,
-        res: {} as any,
-      });
-      const router = appRouter.createCaller(invalidCaller);
-
-      await expect(router.section.create({
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.section.create({
         classId: testClass.id,
         name: 'Test Section',
-      })).rejects.toThrow();
-    });
+      })));
   });
 
   describe('update', () => {

package/tests/server/rateLimit.test.ts

@@ -0,0 +1,73 @@
+import { describe, test, expect, beforeEach } from 'vitest';
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import request from 'supertest';
+
+describe('rate limiting', () => {
+  let app: express.Application;
+
+  beforeEach(() => {
+    // Fresh app per test so rate limit state doesn't leak between tests
+    app = express();
+    const testLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: 3,
+      standardHeaders: true,
+      legacyHeaders: false,
+      handler: (req, res) => {
+        res.status(429).json({
+          code: 'TOO_MANY_REQUESTS',
+          message: 'Too many requests, please try again later.',
+        });
+      },
+      skip: (req) => req.path === '/health' || req.method === 'OPTIONS',
+    });
+    app.use(testLimiter);
+    app.get('/health', (_req, res) => res.status(200).json({ status: 'OK' }));
+    app.get('/api/test', (_req, res) => res.status(200).json({ ok: true }));
+  });
+
+  test('allows requests under the limit', async () => {
+    const res = await request(app).get('/api/test');
+    expect(res.status).toBe(200);
+    expect(res.body.ok).toBe(true);
+  });
+
+  test('returns 429 when limit exceeded', async () => {
+    // Make 4 sequential requests; 4th should be rate limited
+    const r1 = await request(app).get('/api/test');
+    const r2 = await request(app).get('/api/test');
+    const r3 = await request(app).get('/api/test');
+    const r4 = await request(app).get('/api/test');
+
+    expect(r1.status).toBe(200);
+    expect(r2.status).toBe(200);
+    expect(r3.status).toBe(200);
+    expect(r4.status).toBe(429);
+
+    expect(r4.body.code).toBe('TOO_MANY_REQUESTS');
+    expect(r4.body.message).toContain('Too many requests');
+  });
+
+  test('skips rate limiting for /health', async () => {
+    // Make many health requests - all should succeed
+    const requests = Array(5)
+      .fill(null)
+      .map(() => request(app).get('/health'));
+    const responses = await Promise.all(requests);
+    expect(responses.every((r) => r.status === 200)).toBe(true);
+  });
+
+  test('429 response matches production format (code + message)', async () => {
+    await request(app).get('/api/test');
+    await request(app).get('/api/test');
+    await request(app).get('/api/test');
+    const limited = await request(app).get('/api/test');
+    expect(limited.status).toBe(429);
+    // Same structure as src/middleware/security.ts rateLimitHandler
+    expect(limited.body).toEqual({
+      code: 'TOO_MANY_REQUESTS',
+      message: 'Too many requests, please try again later.',
+    });
+  });
+});

package/tests/setup.ts

@@ -7,7 +7,6 @@ import { logger } from '../src/utils/logger';
 import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
 import { Session } from '@prisma/client';
-import { clearDatabase } from '../src/seedDatabase';
 
 // Load test environment variables
 config({ path: resolve(process.cwd(), '.env.test') });
@@ -23,103 +22,30 @@ const getCaller = async (token: string) => {
   return appRouter.createCaller(ctx);
 };
 
-// Before the entire test suite runs
+// globalSetup already registered users; we just login and create callers.
+// Safe to run in parallel — no registration, no DB writes.
 beforeAll(async () => {
-  try {
-    logger.info('DATABASE_URL: ' + process.env.DATABASE_URL);
-    await clearDatabase();
-    logger.info('Database cleared for tests');
-
-    // Create public caller (no auth) for registration
-    caller = await getCaller('');
-
-    // Register users
-    const user1 = await caller.auth.register({
-      username: 'testuser1',
-      email: 'test@test.com',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
-
-    const user2 = await caller.auth.register({
-      username: 'testuser2',
-      email: 'test2@test.com',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
-
-    const user3 = await caller.auth.register({
-      username: 'testuser3',
-      email: 'test3@test.com',
-      password: 'password_is_1234',
-      confirmPassword: 'password_is_1234',
-    });
-
-    // Get sessions created during registration
-    session1 = await prisma.session.findFirst({
-      where: {
-        userId: user1.user.id,
-      },
-    }) as Session;
-
-    session2 = await prisma.session.findFirst({
-      where: {
-        userId: user2.user.id,
-      },
-    }) as Session;
-
-    session3 = await prisma.session.findFirst({ 
-      where: {
-        userId: user3.user.id,
-      },
-    }) as Session;
+  caller = await getCaller('');
 
-    if (!session1 || !session2 || !session3) {
-      throw new Error('Failed to create sessions for test users');
-    }
+  login1 = await caller.auth.login({ username: 'testuser1', password: 'password_is_1234' });
+  login2 = await caller.auth.login({ username: 'testuser2', password: 'password_is_1234' });
+  login3 = await caller.auth.login({ username: 'testuser3', password: 'password_is_1234' });
 
-    // Verify emails using session tokens
-    verification1 = await caller.auth.verify({
-      token: session1.id,
-    });
-
-    verification2 = await caller.auth.verify({
-      token: session2.id,
-    });
-
-    verification3 = await caller.auth.verify({
-      token: session3.id,
-    });
-
-    // Login to get fresh tokens
-    login1 = await caller.auth.login({
-      username: 'testuser1',
-      password: 'password_is_1234',
-    });
-
-    login2 = await caller.auth.login({
-      username: 'testuser2',
-      password: 'password_is_1234',
-    });
+  if (!login1.token || !login2.token || !login3.token) {
+    throw new Error('Failed to get login tokens — ensure globalSetup ran');
+  }
 
-    login3 = await caller.auth.login({
-      username: 'testuser3',
-      password: 'password_is_1234',
-    });
+  session1 = await prisma.session.findFirst({ where: { userId: login1.user.id } }) as Session;
+  session2 = await prisma.session.findFirst({ where: { userId: login2.user.id } }) as Session;
+  session3 = await prisma.session.findFirst({ where: { userId: login3.user.id } }) as Session;
 
-    if (!login1.token || !login2.token || !login3.token) {
-      throw new Error('Failed to get login tokens');
-    }
+  verification1 = { verified: true };
+  verification2 = { verified: true };
+  verification3 = { verified: true };
 
-    // Create authenticated callers
-    user1Caller = await getCaller(login1.token);
-    user2Caller = await getCaller(login2.token);
-    user3Caller = await getCaller(login3.token);
-    logger.info('Test setup completed successfully');
-  } catch (error) {
-    logger.error('Test setup failed', { error });
-    throw error;
-  }
+  user1Caller = await getCaller(login1.token);
+  user2Caller = await getCaller(login2.token);
+  user3Caller = await getCaller(login3.token);
 });
 
 // After all tests, close the DB

package/tests/user.test.ts

@@ -1,7 +1,6 @@
 import { test, expect, describe, beforeEach } from 'vitest';
 import { user1Caller, user2Caller } from './setup';
-import { createTRPCContext } from '../src/trpc';
-import { appRouter } from '../src/routers/_app';
+import { expectUnauth } from './helpers';
 
 describe('User Router', () => {
   describe('getProfile', () => {
@@ -19,15 +18,8 @@ describe('User Router', () => {
       expect(profile.profile.profilePicture).toBeNull();
     });
 
-    test('should fail without authentication', async () => {
-      const invalidCaller = await createTRPCContext({
-        req: { headers: {} } as any,
-        res: {} as any,
-      });
-      const router = appRouter.createCaller(invalidCaller);
-      
-      await expect(router.user.getProfile()).rejects.toThrow();
-    });
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.user.getProfile()));
   });
 
   describe('updateProfile', () => {
@@ -89,17 +81,10 @@ describe('User Router', () => {
     //   expect(cleared.profile.bio).toBeNull();
     // });
 
-    test('should fail without authentication', async () => {
-      const invalidCaller = await createTRPCContext({
-        req: { headers: {} } as any,
-        res: {} as any,
-      });
-      const router = appRouter.createCaller(invalidCaller);
-      
-      await expect(router.user.updateProfile({
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.user.updateProfile({
         profile: { displayName: 'Test' },
-      })).rejects.toThrow();
-    });
+      })));
   });
 
   describe('getUploadUrl', () => {
@@ -141,18 +126,11 @@ describe('User Router', () => {
       })).rejects.toThrow();
     });
 
-    test('should fail without authentication', async () => {
-      const invalidCaller = await createTRPCContext({
-        req: { headers: {} } as any,
-        res: {} as any,
-      });
-      const router = appRouter.createCaller(invalidCaller);
-      
-      await expect(router.user.getUploadUrl({
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.user.getUploadUrl({
         fileName: 'test.jpg',
         fileType: 'image/jpeg',
-      })).rejects.toThrow();
-    });
+      })));
   });
 });
 

package/tests/utils/aiUser.test.ts

@@ -0,0 +1,22 @@
+import { describe, test, expect } from 'vitest';
+import { getAIUserId, isAIUser } from '../../src/utils/aiUser.js';
+
+describe('aiUser utils', () => {
+  describe('getAIUserId', () => {
+    test('returns AI_ASSISTANT constant', () => {
+      expect(getAIUserId()).toBe('AI_ASSISTANT');
+    });
+  });
+
+  describe('isAIUser', () => {
+    test('returns true for AI_ASSISTANT', () => {
+      expect(isAIUser('AI_ASSISTANT')).toBe(true);
+    });
+
+    test('returns false for other user ids', () => {
+      expect(isAIUser('user-123')).toBe(false);
+      expect(isAIUser('')).toBe(false);
+      expect(isAIUser('ai-assistant')).toBe(false); // case sensitive
+    });
+  });
+});

package/tests/utils/generateInviteCode.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { generateInviteCode } from '../../src/utils/generateInviteCode.js';
+
+describe('generateInviteCode', () => {
+  test('returns a string of length 5', () => {
+    const code = generateInviteCode();
+    expect(code).toHaveLength(5);
+    expect(typeof code).toBe('string');
+  });
+
+  test('returns alphanumeric characters only', () => {
+    const code = generateInviteCode();
+    expect(code).toMatch(/^[a-z0-9]{5}$/);
+  });
+
+  test('produces different codes on multiple calls', () => {
+    const codes = new Set<string>();
+    for (let i = 0; i < 50; i++) {
+      codes.add(generateInviteCode());
+    }
+    // With 50 calls, we expect at least some uniqueness (collision very unlikely)
+    expect(codes.size).toBeGreaterThan(1);
+  });
+});

package/tests/utils/logger.test.ts

@@ -0,0 +1,74 @@
+import { describe, test, expect, vi, beforeEach, afterEach } from 'vitest';
+import { logger } from '../../src/utils/logger.js';
+
+describe('Logger', () => {
+  let consoleSpy: { log: ReturnType<typeof vi.spyOn>; warn: ReturnType<typeof vi.spyOn>; error: ReturnType<typeof vi.spyOn>; debug: ReturnType<typeof vi.spyOn> };
+
+  beforeEach(() => {
+    consoleSpy = {
+      log: vi.spyOn(console, 'log').mockImplementation(() => {}),
+      warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+      error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+      debug: vi.spyOn(console, 'debug').mockImplementation(() => {}),
+    };
+  });
+
+  afterEach(() => {
+    logger.setMode('silent'); // reset for test env default
+    vi.restoreAllMocks();
+  });
+
+  test('logger has info, warn, error, debug methods', () => {
+    expect(typeof logger.info).toBe('function');
+    expect(typeof logger.warn).toBe('function');
+    expect(typeof logger.error).toBe('function');
+    expect(typeof logger.debug).toBe('function');
+  });
+
+  test('in silent mode only error is logged', () => {
+    logger.setMode('silent');
+    logger.info('info');
+    logger.warn('warn');
+    logger.debug('debug');
+    logger.error('error');
+
+    expect(consoleSpy.log).not.toHaveBeenCalled();
+    expect(consoleSpy.warn).not.toHaveBeenCalled();
+    expect(consoleSpy.debug).not.toHaveBeenCalled();
+    expect(consoleSpy.error).toHaveBeenCalledWith(expect.stringContaining('error'));
+  });
+
+  test('in normal mode info, warn, error are logged', () => {
+    logger.setMode('normal');
+    logger.info('info msg');
+    logger.warn('warn msg');
+    logger.error('error msg');
+
+    expect(consoleSpy.log).toHaveBeenCalledWith(expect.stringContaining('info msg'));
+    expect(consoleSpy.warn).toHaveBeenCalledWith(expect.stringContaining('warn msg'));
+    expect(consoleSpy.error).toHaveBeenCalledWith(expect.stringContaining('error msg'));
+  });
+
+  test('in verbose mode debug is logged', () => {
+    logger.setMode('verbose');
+    logger.debug('debug msg');
+    expect(consoleSpy.debug).toHaveBeenCalledWith(expect.stringContaining('debug msg'));
+  });
+
+  test('formatted output includes level and message', () => {
+    logger.setMode('normal');
+    logger.info('test message');
+    const call = consoleSpy.log.mock.calls[0][0];
+    expect(call).toContain('INFO');
+    expect(call).toContain('test message');
+    expect(call).toMatch(/\[\d{4}-\d{2}-\d{2}T/); // ISO timestamp
+  });
+
+  test('context is included when provided', () => {
+    logger.setMode('normal');
+    logger.info('msg', { key: 'value' });
+    const call = consoleSpy.log.mock.calls[0][0];
+    expect(call).toContain('Context:');
+    expect(call).toContain('"key": "value"');
+  });
+});