@studious-lms/server 1.2.53 → 1.4.0

package/tests/helpers.ts

@@ -0,0 +1,22 @@
+import { createTRPCContext } from '../src/trpc';
+import { appRouter } from '../src/routers/_app';
+
+export async function createUnauthCaller() {
+  const ctx = await createTRPCContext({
+    req: { headers: {} } as any,
+    res: {} as any,
+  });
+  return appRouter.createCaller(ctx);
+}
+
+export const expectRejects = (fn: () => Promise<unknown>) =>
+  expect(fn()).rejects.toThrow();
+
+/** Expect a call to throw (e.g. unauthenticated). */
+export async function expectUnauth(call: (caller: Awaited<ReturnType<typeof createUnauthCaller>>) => Promise<unknown>) {
+  const unauth = await createUnauthCaller();
+  await expectRejects(() => call(unauth));
+}
+
+/** Expect a call to throw (e.g. not teacher, not member, forbidden). Same as expectRejects but semantic. */
+export const expectForbidden = expectRejects;

package/tests/middleware/security.test.ts

@@ -0,0 +1,42 @@
+import { describe, test, expect, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import {
+  generalLimiter,
+  authLimiter,
+  uploadLimiter,
+  helmetConfig,
+} from '../../src/middleware/security.js';
+
+describe('security middleware', () => {
+  test('exports all middleware', () => {
+    expect(typeof generalLimiter).toBe('function');
+    expect(typeof authLimiter).toBe('function');
+    expect(typeof uploadLimiter).toBe('function');
+    expect(typeof helmetConfig).toBe('function');
+  });
+
+  describe('generalLimiter skip logic', () => {
+    let app: express.Application;
+
+    beforeEach(() => {
+      app = express();
+      app.use(generalLimiter);
+      app.get('/health', (_req, res) => res.status(200).json({ ok: true }));
+      app.get('/api/test', (_req, res) => res.status(200).json({ ok: true }));
+    });
+
+    test('/health is not rate limited (skip)', async () => {
+      const requests = Array(15)
+        .fill(null)
+        .map(() => request(app).get('/health'));
+      const responses = await Promise.all(requests);
+      expect(responses.every((r) => r.status === 200)).toBe(true);
+    });
+
+    test('OPTIONS is skipped', async () => {
+      const res = await request(app).options('/api/test');
+      expect(res.status).not.toBe(429);
+    });
+  });
+});

package/tests/routers/agenda.test.ts

@@ -0,0 +1,138 @@
+import { test, expect, describe, beforeAll } from 'vitest';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { expectUnauth } from '../helpers';
+import { startOfWeek, addMonths } from 'date-fns';
+
+describe('Agenda Router', () => {
+  let testClass: any;
+  let classEvent: any;
+  const now = new Date();
+  const weekStart = startOfWeek(now).toISOString();
+
+  beforeAll(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Agenda Test Class',
+      subject: 'Science',
+      section: '9th Grade',
+    });
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: (await user2Caller.user.getProfile()).id,
+    });
+
+    const startTime = new Date();
+    startTime.setHours(11, 0, 0, 0);
+    const endTime = new Date(startTime);
+    endTime.setHours(12, 0, 0, 0);
+
+    classEvent = await user1Caller.event.create({
+      name: 'Class Agenda Event',
+      location: 'Room 301',
+      startTime: startTime.toISOString(),
+      endTime: endTime.toISOString(),
+      classId: testClass.id,
+      color: '#EF4444',
+    });
+  });
+
+  describe('get', () => {
+    test('should return personal events', async () => {
+      const startTime = new Date();
+      startTime.setHours(9, 0, 0, 0);
+      const endTime = new Date(startTime);
+      endTime.setHours(10, 0, 0, 0);
+
+      const created = await user1Caller.event.create({
+        name: 'Personal Agenda Event',
+        location: 'Home',
+        startTime: startTime.toISOString(),
+        endTime: endTime.toISOString(),
+      });
+
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.personal).toBeDefined();
+      expect(Array.isArray(agenda.events.personal)).toBe(true);
+      const found = agenda.events.personal.find(
+        (e) => e.id === created.event.id,
+      );
+      expect(found).toBeDefined();
+      expect(found!.name).toBe('Personal Agenda Event');
+      expect(found!.classId).toBeNull();
+    });
+
+    test('should return class events for the teacher', async () => {
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.class).toBeDefined();
+      const found = agenda.events.class.find(
+        (e) => e.id === classEvent.event.id,
+      );
+      expect(found).toBeDefined();
+      expect(found!.name).toBe('Class Agenda Event');
+      expect(found!.classId).toBe(testClass.id);
+    });
+
+    test('should return class events for enrolled students', async () => {
+      const agenda = await user2Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.class).toBeDefined();
+      const found = agenda.events.class.find(
+        (e) => e.name === 'Class Agenda Event',
+      );
+      expect(found).toBeDefined();
+      expect(found!.classId).toBe(testClass.id);
+    });
+
+    test('should not return class events for non-members', async () => {
+      const agenda = await user3Caller.agenda.get({ weekStart });
+
+      const found = agenda.events.class.find(
+        (e) => e.classId === testClass.id,
+      );
+      expect(found).toBeUndefined();
+    });
+
+    test('should return empty arrays for user with no events', async () => {
+      const agenda = await user3Caller.agenda.get({ weekStart });
+
+      expect(agenda.events.personal).toEqual([]);
+      expect(Array.isArray(agenda.events.class)).toBe(true);
+    });
+
+    test('should not return events outside the 6-month range', async () => {
+      const farFuture = addMonths(now, 6);
+      farFuture.setHours(10, 0, 0, 0);
+      const farFutureEnd = new Date(farFuture);
+      farFutureEnd.setHours(11, 0, 0, 0);
+
+      await user1Caller.event.create({
+        name: 'Far Future Event',
+        startTime: farFuture.toISOString(),
+        endTime: farFutureEnd.toISOString(),
+      });
+
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      const found = agenda.events.personal.find(
+        (e) => e.name === 'Far Future Event',
+      );
+      expect(found).toBeUndefined();
+    });
+
+    test('should separate personal and class events correctly', async () => {
+      const agenda = await user1Caller.agenda.get({ weekStart });
+
+      for (const event of agenda.events.personal) {
+        expect(event.classId).toBeNull();
+      }
+      for (const event of agenda.events.class) {
+        expect(event.classId).not.toBeNull();
+      }
+    });
+
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.agenda.get({ weekStart })));
+  });
+});

package/tests/routers/announcement.test.ts

@@ -0,0 +1,490 @@
+import { test, expect, describe, beforeEach } from 'vitest';
+import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { expectForbidden, expectUnauth } from '../helpers';
+
+describe('Announcement Router', () => {
+  let testClass: any;
+  let testAnnouncement: any;
+  let studentId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Test Class for Announcements',
+      subject: 'Mathematics',
+      section: '10th Grade',
+    });
+
+    const studentProfile = await user2Caller.user.getProfile();
+    studentId = studentProfile.id;
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId,
+    });
+
+    testAnnouncement = await user1Caller.announcement.create({
+      classId: testClass.id,
+      remarks: 'This is a test announcement',
+    });
+  });
+
+  describe('create', () => {
+    test('should create announcement successfully', async () => {
+      expect(testAnnouncement).toBeDefined();
+      expect(testAnnouncement.announcement).toBeDefined();
+      expect(testAnnouncement.announcement.remarks).toBe('This is a test announcement');
+      expect(testAnnouncement.announcement.teacher.id).toBeDefined();
+    });
+
+    test('should create announcement with attachments', async () => {
+      const announcement = await user1Caller.announcement.create({
+        classId: testClass.id,
+        remarks: 'Announcement with attachments',
+        files: [
+          {
+            name: 'test.pdf',
+            type: 'application/pdf',
+            size: 1024,
+          },
+        ],
+      });
+
+      expect(announcement.announcement).toBeDefined();
+      expect(announcement.announcement.attachments).toBeDefined();
+    });
+
+    test('should fail to create announcement for class user is not teacher of', () =>
+      expectForbidden(() => user2Caller.announcement.create({
+        classId: testClass.id,
+        remarks: 'Unauthorized announcement',
+      })));
+
+    test('should fail without authentication', () =>
+      expectUnauth((c) => c.announcement.create({
+        classId: testClass.id,
+        remarks: 'Test',
+      })));
+  });
+
+  describe('getAll', () => {
+    test('should get all announcements for class', async () => {
+      const result = await user1Caller.announcement.getAll({
+        classId: testClass.id,
+      });
+
+      expect(result.announcements).toBeDefined();
+      expect(Array.isArray(result.announcements)).toBe(true);
+      expect(result.announcements.length).toBeGreaterThanOrEqual(1);
+      expect(result.announcements.some((a: any) => a.id === testAnnouncement.announcement.id)).toBe(true);
+    });
+
+    test('should fail to get announcements for class user is not member of', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+      await expect(user2Caller.announcement.getAll({
+        classId: otherClass.id,
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('get', () => {
+    test('should get single announcement successfully', async () => {
+      const announcement = await user1Caller.announcement.get({
+        id: testAnnouncement.announcement.id,
+        classId: testClass.id,
+      });
+
+      expect(announcement.announcement).toBeDefined();
+      expect(announcement.announcement.id).toBe(testAnnouncement.announcement.id);
+      expect(announcement.announcement.remarks).toBe('This is a test announcement');
+    });
+
+    test('should fail to get announcement for class user is not member of', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+      await expect(user2Caller.announcement.get({
+        id: testAnnouncement.announcement.id,
+        classId: otherClass.id,
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('update', () => {
+    test('should update announcement successfully', async () => {
+      const updated = await user1Caller.announcement.update({
+        id: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        data: {
+          remarks: 'Updated announcement remarks',
+        },
+      });
+
+      expect(updated.announcement.remarks).toBe('Updated announcement remarks');
+    });
+
+    test('should fail to update announcement user is not teacher of', () =>
+      expectForbidden(() => user2Caller.announcement.update({
+        id: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        data: {
+          remarks: 'Unauthorized update',
+        },
+      })));
+  });
+
+  describe('delete', () => {
+    test('should delete announcement successfully', async () => {
+      // Create a new announcement to delete
+      const newAnnouncement = await user1Caller.announcement.create({
+        classId: testClass.id,
+        remarks: 'To be deleted',
+      });
+
+      const result = await user1Caller.announcement.delete({
+        id: newAnnouncement.announcement.id,
+        classId: testClass.id,
+      });
+
+      expect(result.success).toBe(true);
+
+      // Verify announcement is deleted
+      await expect(user1Caller.announcement.get({
+        id: newAnnouncement.announcement.id,
+        classId: testClass.id,
+      })).rejects.toThrow();
+    });
+
+    test('should fail to delete announcement user is not teacher of', () =>
+      expectForbidden(() => user2Caller.announcement.delete({
+        id: testAnnouncement.announcement.id,
+        classId: testClass.id,
+      })));
+  });
+
+  describe('getAnnouncementUploadUrls', () => {
+    test('teacher can get upload URLs for announcement', async () => {
+      const result = await user1Caller.announcement.getAnnouncementUploadUrls({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        files: [
+          { name: 'doc.pdf', type: 'application/pdf', size: 1024 },
+        ],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.uploadFiles).toBeDefined();
+      expect(Array.isArray(result.uploadFiles)).toBe(true);
+      expect(result.uploadFiles.length).toBe(1);
+    });
+
+    test('non-teacher cannot get upload URLs', () =>
+      expectForbidden(() =>
+        user2Caller.announcement.getAnnouncementUploadUrls({
+          announcementId: testAnnouncement.announcement.id,
+          classId: testClass.id,
+          files: [{ name: 'doc.pdf', type: 'application/pdf', size: 1024 }],
+        })
+      ));
+  });
+
+  describe('addComment', () => {
+    test('teacher can add comment', async () => {
+      const result = await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Great announcement!',
+      });
+
+      expect(result.comment).toBeDefined();
+      expect(result.comment.content).toBe('Great announcement!');
+      expect(result.comment.author).toBeDefined();
+    });
+
+    test('student can add comment', async () => {
+      const result = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Thanks for sharing!',
+      });
+
+      expect(result.comment).toBeDefined();
+      expect(result.comment.content).toBe('Thanks for sharing!');
+    });
+
+    test('can add reply to comment', async () => {
+      const parent = await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Parent comment',
+      });
+
+      const result = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Reply to parent',
+        parentCommentId: parent.comment.id,
+      });
+
+      expect(result.comment.content).toBe('Reply to parent');
+    });
+
+    test('fails for non-class member', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+      const otherAnnouncement = await user1Caller.announcement.create({
+        classId: otherClass.id,
+        remarks: 'Other announcement',
+      });
+
+      await expect(user2Caller.announcement.addComment({
+        announcementId: otherAnnouncement.announcement.id,
+        classId: otherClass.id,
+        content: 'Should fail',
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('getComments', () => {
+    test('class member can get comments', async () => {
+      await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'First comment',
+      });
+
+      const result = await user2Caller.announcement.getComments({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+      });
+
+      expect(result.comments).toBeDefined();
+      expect(Array.isArray(result.comments)).toBe(true);
+      expect(result.comments.length).toBe(1);
+      expect(result.comments[0].content).toBe('First comment');
+    });
+
+    test('fails for non-class member', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+
+      await expect(user2Caller.announcement.getComments({
+        announcementId: testAnnouncement.announcement.id,
+        classId: otherClass.id,
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('updateComment', () => {
+    test('author can update their comment', async () => {
+      const { comment } = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Original content',
+      });
+
+      const result = await user2Caller.announcement.updateComment({
+        id: comment.id,
+        content: 'Updated content',
+      });
+
+      expect(result.comment.content).toBe('Updated content');
+    });
+
+    test('non-author cannot update comment', async () => {
+      const { comment } = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Student comment',
+      });
+
+      await expect(user1Caller.announcement.updateComment({
+        id: comment.id,
+        content: 'Hijacked!',
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('deleteComment', () => {
+    test('author can delete their comment', async () => {
+      const { comment } = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'To be deleted',
+      });
+
+      const result = await user2Caller.announcement.deleteComment({ id: comment.id });
+      expect(result.success).toBe(true);
+
+      const { comments } = await user1Caller.announcement.getComments({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+      });
+      expect(comments.find((c: any) => c.id === comment.id)).toBeUndefined();
+    });
+
+    test('teacher can delete any comment', async () => {
+      const { comment } = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Student comment',
+      });
+
+      const result = await user1Caller.announcement.deleteComment({ id: comment.id });
+      expect(result.success).toBe(true);
+    });
+
+    test('non-author non-teacher cannot delete comment', async () => {
+      const { comment } = await user2Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Student comment',
+      });
+
+      await expect(user3Caller.announcement.deleteComment({ id: comment.id })).rejects.toThrow();
+    });
+  });
+
+  describe('addReaction', () => {
+    test('can add reaction to announcement', async () => {
+      const result = await user2Caller.announcement.addReaction({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        type: 'THUMBSUP',
+      });
+
+      expect(result.reaction).toBeDefined();
+      expect(result.reaction.type).toBe('THUMBSUP');
+    });
+
+    test('can add reaction to comment', async () => {
+      const { comment } = await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Comment to react',
+      });
+
+      const result = await user2Caller.announcement.addReaction({
+        commentId: comment.id,
+        classId: testClass.id,
+        type: 'HEART',
+      });
+
+      expect(result.reaction).toBeDefined();
+      expect(result.reaction.type).toBe('HEART');
+    });
+
+    test('non-class member cannot add reaction', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+
+      await expect(user2Caller.announcement.addReaction({
+        announcementId: testAnnouncement.announcement.id,
+        classId: otherClass.id,
+        type: 'THUMBSUP',
+      })).rejects.toThrow();
+    });
+  });
+
+  describe('removeReaction', () => {
+    test('can remove reaction from announcement', async () => {
+      await user2Caller.announcement.addReaction({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        type: 'THUMBSUP',
+      });
+
+      const result = await user2Caller.announcement.removeReaction({
+        announcementId: testAnnouncement.announcement.id,
+      });
+
+      expect(result.success).toBe(true);
+    });
+
+    test('can remove reaction from comment', async () => {
+      const { comment } = await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Comment',
+      });
+      await user2Caller.announcement.addReaction({
+        commentId: comment.id,
+        classId: testClass.id,
+        type: 'HEART',
+      });
+
+      const result = await user2Caller.announcement.removeReaction({
+        commentId: comment.id,
+      });
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  describe('getReactions', () => {
+    test('can get reactions for announcement', async () => {
+      await user2Caller.announcement.addReaction({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        type: 'THUMBSUP',
+      });
+
+      const result = await user1Caller.announcement.getReactions({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+      });
+
+      expect(result.counts).toBeDefined();
+      expect(result.total).toBeGreaterThanOrEqual(1);
+      expect(result.userReaction).toBeDefined();
+    });
+
+    test('can get reactions for comment', async () => {
+      const { comment } = await user1Caller.announcement.addComment({
+        announcementId: testAnnouncement.announcement.id,
+        classId: testClass.id,
+        content: 'Comment',
+      });
+      await user2Caller.announcement.addReaction({
+        commentId: comment.id,
+        classId: testClass.id,
+        type: 'CELEBRATE',
+      });
+
+      const result = await user1Caller.announcement.getReactions({
+        commentId: comment.id,
+        classId: testClass.id,
+      });
+
+      expect(result.counts).toBeDefined();
+      expect(result.total).toBeGreaterThanOrEqual(1);
+    });
+
+    test('fails for non-class member', async () => {
+      const otherClass = await user1Caller.class.create({
+        name: 'Other Class',
+        subject: 'Science',
+        section: '11th Grade',
+      });
+
+      await expect(user2Caller.announcement.getReactions({
+        announcementId: testAnnouncement.announcement.id,
+        classId: otherClass.id,
+      })).rejects.toThrow();
+    });
+  });
+});
+