@studious-lms/server 1.26.0 → 1.27.0

package/src/workers/processors/createRunJobWorker.ts

@@ -91,6 +91,14 @@ export function createRunJobWorker<T extends RunJobType>({
         return existing.result;
       }
 
+      if (existing.status === 'CANCELLED') {
+        logger.info(`${name} RunJob cancelled before start; skipping`, {
+          runJobId,
+          bullJobId: job.id,
+        });
+        return existing.result;
+      }
+
       await prisma.runJob.update({
         where: { id: runJobId },
         data: {
@@ -108,8 +116,10 @@ export function createRunJobWorker<T extends RunJobType>({
         classId: existing.classId ?? null,
       });
 
-      await prisma.runJob.update({
-        where: { id: runJobId },
+      // `updateMany` with a status guard so a cancellation that landed while
+      // the run was in flight is not overwritten with SUCCEEDED.
+      await prisma.runJob.updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           status: 'SUCCEEDED',
           finishedAt: new Date(),
@@ -146,29 +156,19 @@ export function createRunJobWorker<T extends RunJobType>({
 
     if (!runJobId) return;
 
+    // Status guard: don't let a late failure (e.g. from an aborted stream)
+    // overwrite a RunJob the user already cancelled.
     await prisma.runJob
-      .update({
-        where: { id: runJobId },
+      .updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           error: err.message,
           ...(isFinalAttempt
-            ? { status: 'FAILED', finishedAt: new Date() }
+            ? { status: 'FAILED' as const, finishedAt: new Date() }
             : {}),
         },
       })
       .catch((updateError) => {
-        // P2025 = record not found. The RunJob row is gone (orphaned job from a
-        // shared/reset Redis), so there's nothing to flag as FAILED — log
-        // quietly instead of as an error to avoid noise.
-        if (
-          updateError instanceof Prisma.PrismaClientKnownRequestError &&
-          updateError.code === 'P2025'
-        ) {
-          logger.warn(`${name} failure not recorded; RunJob no longer exists`, {
-            runJobId,
-          });
-          return;
-        }
         logger.error(`Failed to record ${name} failure on RunJob`, {
           runJobId,
           error:

package/tests/unit/services/adminUser.test.ts

@@ -0,0 +1,75 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const prismaMocks = vi.hoisted(() => ({
+  user: { findUnique: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import { getUserForAdmin } from '../../../src/services/adminUser.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('getUserForAdmin', () => {
+  test('does not select session ids (they are bearer tokens) and only returns AUTH sessions', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue({
+      id: 'user-1',
+      username: 'ada',
+      email: 'ada@example.com',
+      verified: true,
+      termsAcceptedAt: null,
+      termsVersion: null,
+      profile: null,
+      school: null,
+      schoolMemberships: [],
+      sessions: [
+        {
+          type: 'AUTH',
+          createdAt: new Date('2026-08-01T00:00:00Z'),
+          expiresAt: new Date('2026-09-01T00:00:00Z'),
+        },
+      ],
+      _count: {
+        teacherIn: 0,
+        studentIn: 0,
+        sessions: 1,
+        submissions: 0,
+        files: 0,
+      },
+    });
+
+    const user = await getUserForAdmin('user-1');
+
+    expect(prismaMocks.user.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'user-1' },
+        select: expect.objectContaining({
+          sessions: {
+            where: { type: 'AUTH' },
+            orderBy: { createdAt: 'desc' },
+            take: 10,
+            select: { type: true, createdAt: true, expiresAt: true },
+          },
+          _count: {
+            select: expect.objectContaining({
+              sessions: { where: { type: 'AUTH' } },
+            }),
+          },
+        }),
+      }),
+    );
+    expect(user.sessions[0]).not.toHaveProperty('id');
+  });
+
+  test('throws NOT_FOUND when the user is missing', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue(null);
+    await expect(getUserForAdmin('missing')).rejects.toMatchObject({
+      code: 'NOT_FOUND',
+    } satisfies Partial<TRPCError>);
+  });
+});

package/tests/unit/utils/adminPanelAccess.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from 'vitest';
+import { TRPCError } from '@trpc/server';
+import type { Request } from 'express';
+import { assertAdminPanelPassword } from '../../../src/utils/adminPanelAccess.js';
+
+function reqWithHeader(value: string | string[] | undefined): Request {
+  return { headers: { 'x-admin-password': value } } as unknown as Request;
+}
+
+describe('assertAdminPanelPassword', () => {
+  test('accepts the configured admin password header', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader('alan6767'))).not.toThrow();
+  });
+
+  test('rejects a missing or wrong header with FORBIDDEN', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader(undefined))).toThrow(
+      TRPCError,
+    );
+    try {
+      assertAdminPanelPassword(reqWithHeader('nope'));
+    } catch (error) {
+      expect(error).toBeInstanceOf(TRPCError);
+      expect((error as TRPCError).code).toBe('FORBIDDEN');
+    }
+  });
+});