@studious-lms/server 1.25.0 → 1.27.0

package/src/services/parentPortal.ts

@@ -85,6 +85,91 @@ export async function linkParentToStudent(
   return { link };
 }
 
+export async function addParentToStudent(
+  userId: string,
+  input: { schoolId: string; studentUserId: string; parentIdentifier: string }
+) {
+  await requireSchoolAdmin(input.schoolId, userId);
+
+  const studentMembership = await findSchoolMembership(
+    input.schoolId,
+    input.studentUserId
+  );
+  if (
+    !studentMembership ||
+    studentMembership.status !== "ACTIVE" ||
+    studentMembership.role !== "STUDENT"
+  ) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "studentUserId must be an active STUDENT member",
+    });
+  }
+
+  const identifier = input.parentIdentifier.trim();
+  const parentUser = await prisma.user.findFirst({
+    where: {
+      OR: [{ email: identifier }, { username: identifier }],
+    },
+    select: { id: true },
+  });
+  if (!parentUser) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "No account found with that email or username",
+    });
+  }
+  if (parentUser.id === input.studentUserId) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "A student cannot be their own parent",
+    });
+  }
+
+  const parentMembership = await findSchoolMembership(
+    input.schoolId,
+    parentUser.id
+  );
+  if (!parentMembership) {
+    await prisma.schoolMembership.create({
+      data: {
+        schoolId: input.schoolId,
+        userId: parentUser.id,
+        role: "PARENT",
+        status: "ACTIVE",
+      },
+    });
+  } else if (parentMembership.role !== "PARENT") {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "That account already belongs to this school with another role",
+    });
+  } else if (parentMembership.status !== "ACTIVE") {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Parent must be an active school member",
+    });
+  }
+
+  const link = await prisma.parentStudentLink.upsert({
+    where: {
+      schoolId_parentUserId_studentUserId: {
+        schoolId: input.schoolId,
+        parentUserId: parentUser.id,
+        studentUserId: input.studentUserId,
+      },
+    },
+    update: {},
+    create: {
+      schoolId: input.schoolId,
+      parentUserId: parentUser.id,
+      studentUserId: input.studentUserId,
+    },
+  });
+
+  return { link };
+}
+
 export async function unlinkParentFromStudent(
   userId: string,
   input: { schoolId: string; parentUserId: string; studentUserId: string }

package/src/services/school.ts

@@ -662,6 +662,7 @@ export async function getStudentTimeline(
       where: {
         userId: input.studentId,
         startTime: range,
+        OR: [{ classId: null }, { class: { schoolId: input.schoolId } }],
       },
       select: {
         id: true,
@@ -678,6 +679,7 @@ export async function getStudentTimeline(
     prisma.assignment.findMany({
       where: {
         class: {
+          schoolId: input.schoolId,
           students: { some: { id: input.studentId } },
         },
         template: false,
@@ -840,6 +842,7 @@ export async function getMemberTimeline(
         where: {
           userId: input.memberId,
           startTime: range,
+          OR: [{ classId: null }, { class: { schoolId: input.schoolId } }],
         },
         select: {
           id: true,
@@ -855,7 +858,10 @@ export async function getMemberTimeline(
       }),
       prisma.assignment.findMany({
         where: {
-          class: { students: { some: { id: input.memberId } } },
+          class: {
+            schoolId: input.schoolId,
+            students: { some: { id: input.memberId } },
+          },
           template: false,
           dueDate: range,
         },
@@ -947,8 +953,14 @@ export async function getMemberTimeline(
     prisma.event.findMany({
       where: {
         OR: [
-          { userId: input.memberId },
-          { class: { teachers: { some: { id: input.memberId } } } },
+          { userId: input.memberId, classId: null },
+          { userId: input.memberId, class: { schoolId: input.schoolId } },
+          {
+            class: {
+              schoolId: input.schoolId,
+              teachers: { some: { id: input.memberId } },
+            },
+          },
         ],
         startTime: range,
       },

package/src/services/studentProgress.ts

@@ -6,6 +6,7 @@ import type { AssignmentType } from "@prisma/client";
 import { z } from "zod";
 import { prisma } from "../lib/prisma.js";
 import { isTeacherInClass } from "../models/class.js";
+import { createAssignmentRecord } from "./assignment.js";
 import { inference } from "../utils/inference.js";
 import { logger } from "../utils/logger.js";
 import {
@@ -617,6 +618,140 @@ export async function dismissStudentRecommendation(
   return { success: true };
 }
 
+const followUpAssignmentSchema = z.object({
+  title: z.string().min(1).max(200),
+  instructions: z.string().min(1),
+});
+
+export type FollowUpAssignmentDraft = z.infer<typeof followUpAssignmentSchema>;
+
+export async function generateFollowUpAssignment(
+  viewerId: string,
+  input: {
+    classId: string;
+    studentId: string;
+    submissionId: string;
+    prompt: string;
+    dueDate?: string;
+  },
+) {
+  const teacherInClass = await isTeacherInClass(input.classId, viewerId);
+  if (!teacherInClass) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Only teachers can generate follow-up assignments",
+    });
+  }
+
+  const submission = await prisma.submission.findFirst({
+    where: {
+      id: input.submissionId,
+      studentId: input.studentId,
+      assignment: { classId: input.classId },
+    },
+    select: {
+      id: true,
+      gradeReceived: true,
+      teacherComments: true,
+      student: {
+        select: {
+          id: true,
+          username: true,
+          profile: { select: { displayName: true } },
+        },
+      },
+      assignment: {
+        select: {
+          id: true,
+          title: true,
+          instructions: true,
+          type: true,
+          maxGrade: true,
+          weight: true,
+          section: { select: { id: true, name: true } },
+        },
+      },
+    },
+  });
+
+  if (!submission) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Submission not found for this student in this class",
+    });
+  }
+
+  const displayName =
+    submission.student.profile?.displayName ?? submission.student.username;
+  const percentage =
+    submission.gradeReceived != null && submission.assignment.maxGrade
+      ? Math.round(
+          (submission.gradeReceived / submission.assignment.maxGrade) * 1000,
+        ) / 10
+      : null;
+
+  const draft = await inference<FollowUpAssignmentDraft>(
+    [
+      {
+        role: "system" as const,
+        content:
+          "You are an experienced teacher creating a targeted follow-up assignment for one student. Ground the task in the source assignment and the teacher's request. Do not fabricate material beyond the source assignment's topic. Return a concise title and clear, student-facing instructions.",
+      },
+      {
+        role: "user" as const,
+        content: JSON.stringify({
+          student: { displayName },
+          sourceAssignment: {
+            title: submission.assignment.title,
+            instructions: submission.assignment.instructions,
+            type: submission.assignment.type,
+            maxGrade: submission.assignment.maxGrade,
+            section: submission.assignment.section?.name ?? null,
+          },
+          submission: {
+            gradeReceived: submission.gradeReceived,
+            percentage,
+            teacherFeedback: submission.teacherComments,
+          },
+        }),
+      },
+      { role: "user" as const, content: input.prompt },
+    ],
+    followUpAssignmentSchema,
+    {
+      reason: "student_progress_follow_up_assignment",
+      metadata: {
+        viewerId,
+        classId: input.classId,
+        studentId: input.studentId,
+        submissionId: input.submissionId,
+      },
+      attribution: { userId: viewerId, classId: input.classId },
+    },
+  );
+
+  const dueDate =
+    input.dueDate ??
+    new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+
+  const assignment = await createAssignmentRecord(viewerId, {
+    classId: input.classId,
+    title: draft.title,
+    instructions: draft.instructions,
+    dueDate,
+    studentIds: [input.studentId],
+    maxGrade: submission.assignment.maxGrade ?? 100,
+    graded: true,
+    weight: submission.assignment.weight || 1,
+    sectionId: submission.assignment.section?.id ?? undefined,
+    type: normalizeAssignmentType(submission.assignment.type),
+    acceptExtendedResponse: true,
+    sourceAssignmentId: submission.assignment.id,
+  });
+
+  return { assignment, draft };
+}
+
 function buildProgressSummary(submissions: GradeSubmission[]) {
   return submissions.map((submission) => ({
     title: submission.assignment.title,

package/src/utils/inference.ts

@@ -476,6 +476,77 @@ export async function completePendingAIMessage(
   };
 }
 
+/**
+ * Persist the partial output of a cancelled generation and flip the AI
+ * message to CANCELLED. Whatever text/tool parts streamed before the stop
+ * are kept on the row (content + meta) so they survive reloads. Broadcasts
+ * `message-updated` so clients patch the bubble in place.
+ */
+export async function cancelPendingAIMessage(
+  messageId: string,
+  content: string,
+  options: {
+    meta?: Record<string, any>;
+    customSender?: AIMessageSenderInfo;
+  } = {},
+): Promise<void> {
+  try {
+    const updated = await prisma.message.update({
+      where: { id: messageId },
+      data: {
+        content,
+        status: JobStatus.CANCELLED,
+        ...(options.meta !== undefined && {
+          meta: options.meta as Prisma.InputJsonValue,
+        }),
+      },
+      include: {
+        attachments: true,
+      },
+    });
+
+    logger.info('AI message cancelled', {
+      messageId: updated.id,
+      conversationId: updated.conversationId,
+      contentLength: content.length,
+    });
+
+    const senderInfo = buildAISenderInfo(options.customSender);
+
+    try {
+      await pusher.trigger(chatChannel(updated.conversationId), 'message-updated', {
+        id: updated.id,
+        content: updated.content,
+        senderId: updated.senderId,
+        conversationId: updated.conversationId,
+        status: updated.status,
+        createdAt: updated.createdAt,
+        sender: senderInfo,
+        mentionedUserIds: [],
+        meta: updated.meta ?? {},
+        attachments: updated.attachments.map((attachment) => ({
+          id: attachment.id,
+          attachmentId: attachment.id,
+          name: attachment.name,
+          type: attachment.type,
+          size: attachment.size,
+          path: attachment.path,
+        })),
+      });
+    } catch (broadcastError) {
+      logger.error('Failed to broadcast cancelled AI message:', {
+        error: broadcastError,
+        messageId,
+      });
+    }
+  } catch (error) {
+    logger.error('Failed to mark AI message as cancelled:', {
+      error,
+      messageId,
+    });
+  }
+}
+
 /**
  * Flip a PENDING AI message to FAILED and broadcast the status change.
  * Does NOT throw — failure paths in the pipelines call this in catch blocks
@@ -486,6 +557,20 @@ export async function failPendingAIMessage(
   options: { reason?: string } = {},
 ): Promise<void> {
   try {
+    const current = await prisma.message.findUnique({
+      where: { id: messageId },
+      select: { status: true },
+    });
+    // A message the user already cancelled must stay CANCELLED — late
+    // failures from the aborted pipeline are a consequence of the cancel.
+    if (current?.status === JobStatus.CANCELLED) {
+      logger.info('Skipping FAILED flip; AI message already cancelled', {
+        messageId,
+        reason: options.reason,
+      });
+      return;
+    }
+
     const updated = await prisma.message.update({
       where: { id: messageId },
       data: { status: JobStatus.FAILED },

package/src/workers/processors/createRunJobWorker.ts

@@ -91,6 +91,14 @@ export function createRunJobWorker<T extends RunJobType>({
         return existing.result;
       }
 
+      if (existing.status === 'CANCELLED') {
+        logger.info(`${name} RunJob cancelled before start; skipping`, {
+          runJobId,
+          bullJobId: job.id,
+        });
+        return existing.result;
+      }
+
       await prisma.runJob.update({
         where: { id: runJobId },
         data: {
@@ -108,8 +116,10 @@ export function createRunJobWorker<T extends RunJobType>({
         classId: existing.classId ?? null,
       });
 
-      await prisma.runJob.update({
-        where: { id: runJobId },
+      // `updateMany` with a status guard so a cancellation that landed while
+      // the run was in flight is not overwritten with SUCCEEDED.
+      await prisma.runJob.updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           status: 'SUCCEEDED',
           finishedAt: new Date(),
@@ -146,29 +156,19 @@ export function createRunJobWorker<T extends RunJobType>({
 
     if (!runJobId) return;
 
+    // Status guard: don't let a late failure (e.g. from an aborted stream)
+    // overwrite a RunJob the user already cancelled.
     await prisma.runJob
-      .update({
-        where: { id: runJobId },
+      .updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           error: err.message,
           ...(isFinalAttempt
-            ? { status: 'FAILED', finishedAt: new Date() }
+            ? { status: 'FAILED' as const, finishedAt: new Date() }
             : {}),
         },
       })
       .catch((updateError) => {
-        // P2025 = record not found. The RunJob row is gone (orphaned job from a
-        // shared/reset Redis), so there's nothing to flag as FAILED — log
-        // quietly instead of as an error to avoid noise.
-        if (
-          updateError instanceof Prisma.PrismaClientKnownRequestError &&
-          updateError.code === 'P2025'
-        ) {
-          logger.warn(`${name} failure not recorded; RunJob no longer exists`, {
-            runJobId,
-          });
-          return;
-        }
         logger.error(`Failed to record ${name} failure on RunJob`, {
           runJobId,
           error:

package/tests/unit/services/adminUser.test.ts

@@ -0,0 +1,75 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const prismaMocks = vi.hoisted(() => ({
+  user: { findUnique: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import { getUserForAdmin } from '../../../src/services/adminUser.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('getUserForAdmin', () => {
+  test('does not select session ids (they are bearer tokens) and only returns AUTH sessions', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue({
+      id: 'user-1',
+      username: 'ada',
+      email: 'ada@example.com',
+      verified: true,
+      termsAcceptedAt: null,
+      termsVersion: null,
+      profile: null,
+      school: null,
+      schoolMemberships: [],
+      sessions: [
+        {
+          type: 'AUTH',
+          createdAt: new Date('2026-08-01T00:00:00Z'),
+          expiresAt: new Date('2026-09-01T00:00:00Z'),
+        },
+      ],
+      _count: {
+        teacherIn: 0,
+        studentIn: 0,
+        sessions: 1,
+        submissions: 0,
+        files: 0,
+      },
+    });
+
+    const user = await getUserForAdmin('user-1');
+
+    expect(prismaMocks.user.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'user-1' },
+        select: expect.objectContaining({
+          sessions: {
+            where: { type: 'AUTH' },
+            orderBy: { createdAt: 'desc' },
+            take: 10,
+            select: { type: true, createdAt: true, expiresAt: true },
+          },
+          _count: {
+            select: expect.objectContaining({
+              sessions: { where: { type: 'AUTH' } },
+            }),
+          },
+        }),
+      }),
+    );
+    expect(user.sessions[0]).not.toHaveProperty('id');
+  });
+
+  test('throws NOT_FOUND when the user is missing', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue(null);
+    await expect(getUserForAdmin('missing')).rejects.toMatchObject({
+      code: 'NOT_FOUND',
+    } satisfies Partial<TRPCError>);
+  });
+});

package/tests/unit/utils/adminPanelAccess.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from 'vitest';
+import { TRPCError } from '@trpc/server';
+import type { Request } from 'express';
+import { assertAdminPanelPassword } from '../../../src/utils/adminPanelAccess.js';
+
+function reqWithHeader(value: string | string[] | undefined): Request {
+  return { headers: { 'x-admin-password': value } } as unknown as Request;
+}
+
+describe('assertAdminPanelPassword', () => {
+  test('accepts the configured admin password header', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader('alan6767'))).not.toThrow();
+  });
+
+  test('rejects a missing or wrong header with FORBIDDEN', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader(undefined))).toThrow(
+      TRPCError,
+    );
+    try {
+      assertAdminPanelPassword(reqWithHeader('nope'));
+    } catch (error) {
+      expect(error).toBeInstanceOf(TRPCError);
+      expect((error as TRPCError).code).toBe('FORBIDDEN');
+    }
+  });
+});