@studious-lms/server 1.26.0 → 1.28.0

package/src/services/adminUser.ts

@@ -1,26 +1,70 @@
 import type { Prisma } from '@prisma/client';
 import { TRPCError } from '@trpc/server';
 import { prisma } from '../lib/prisma.js';
+import { classifyUser, suspectedUserWhere } from './adminSpam.js';
+import { listClassesForUserForAdmin } from './adminClass.js';
+
+export type AdminUserSpamFilter = 'all' | 'suspected' | 'clean';
+export type AdminUserActivityFilter = 'all' | 'active' | 'inactive';
+export type AdminUserSort = 'username' | 'recent' | 'activity';
 
 export async function searchUsersForAdmin(input: {
   page: number;
   pageSize: number;
   query?: string;
+  emailDomain?: string;
+  schoolId?: string;
+  verified?: boolean;
+  spam?: AdminUserSpamFilter;
+  activity?: AdminUserActivityFilter;
+  sort?: AdminUserSort;
 }) {
   const skip = input.page * input.pageSize;
-  const where: Prisma.UserWhereInput = {};
+  const filters: Prisma.UserWhereInput[] = [];
+
   const q = input.query?.trim();
   if (q) {
-    where.OR = [
-      { username: { contains: q, mode: 'insensitive' } },
-      { email: { contains: q, mode: 'insensitive' } },
-    ];
+    filters.push({
+      OR: [
+        { username: { contains: q, mode: 'insensitive' } },
+        { email: { contains: q, mode: 'insensitive' } },
+      ],
+    });
+  }
+
+  const domain = input.emailDomain?.trim().replace(/^@/, '');
+  if (domain) {
+    filters.push({ email: { endsWith: `@${domain}`, mode: 'insensitive' } });
+  }
+
+  if (input.schoolId) filters.push({ schoolId: input.schoolId });
+  if (input.verified !== undefined) filters.push({ verified: input.verified });
+
+  if (input.spam === 'suspected') filters.push(suspectedUserWhere());
+  if (input.spam === 'clean') filters.push({ NOT: suspectedUserWhere() });
+
+  // "Active" means the account is attached to at least one class — the cheapest
+  // proxy for a real account that is actually using the platform.
+  if (input.activity === 'active') {
+    filters.push({ OR: [{ teacherIn: { some: {} } }, { studentIn: { some: {} } }] });
+  }
+  if (input.activity === 'inactive') {
+    filters.push({ teacherIn: { none: {} }, studentIn: { none: {} } });
   }
 
+  const where: Prisma.UserWhereInput = filters.length ? { AND: filters } : {};
+
+  const orderBy: Prisma.UserOrderByWithRelationInput[] =
+    input.sort === 'recent'
+      ? [{ profile: { createdAt: 'desc' } }, { username: 'asc' }]
+      : input.sort === 'activity'
+        ? [{ submissions: { _count: 'desc' } }, { username: 'asc' }]
+        : [{ username: 'asc' }];
+
   const [items, total] = await Promise.all([
     prisma.user.findMany({
       where,
-      orderBy: { username: 'asc' },
+      orderBy,
       skip,
       take: input.pageSize,
       select: {
@@ -28,9 +72,15 @@ export async function searchUsersForAdmin(input: {
         username: true,
         email: true,
         verified: true,
+        profile: { select: { createdAt: true } },
         school: { select: { id: true, name: true } },
         _count: {
-          select: { teacherIn: true, studentIn: true, sessions: true },
+          select: {
+            teacherIn: true,
+            studentIn: true,
+            submissions: true,
+            sessions: { where: { type: 'AUTH' } },
+          },
         },
       },
     }),
@@ -38,7 +88,7 @@ export async function searchUsersForAdmin(input: {
   ]);
 
   return {
-    items,
+    items: items.map((user) => ({ ...user, signals: classifyUser(user) })),
     total,
     page: input.page,
     pageSize: input.pageSize,
@@ -70,15 +120,18 @@ export async function getUserForAdmin(id: string) {
         },
       },
       sessions: {
+        where: { type: 'AUTH' },
         orderBy: { createdAt: 'desc' },
         take: 10,
-        select: { id: true, type: true, createdAt: true, expiresAt: true },
+        // Session.id is the bearer token — never return it from admin APIs.
+        select: { type: true, createdAt: true, expiresAt: true },
       },
       _count: {
         select: {
           teacherIn: true,
           studentIn: true,
-          sessions: true,
+          // Keep the count consistent with the AUTH-only session list above.
+          sessions: { where: { type: 'AUTH' } },
           submissions: true,
           files: true,
         },
@@ -89,5 +142,7 @@ export async function getUserForAdmin(id: string) {
   if (!user) {
     throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
   }
-  return user;
+
+  const classes = await listClassesForUserForAdmin(id);
+  return { ...user, classes, signals: classifyUser(user) };
 }

package/src/services/aiChatStream.ts

@@ -14,12 +14,34 @@
 import { streamText, stepCountIs, type ModelMessage, type ToolSet } from 'ai';
 import { openai } from '@ai-sdk/openai';
 import { getRedis } from '../lib/redis.js';
+import { prisma } from '../lib/prisma.js';
 import { pusher, chatChannel } from '../lib/pusher.js';
 import { logger } from '../utils/logger.js';
 import { logInferenceUsage, type AiUsageAttribution } from '../utils/inference.js';
 
 const STREAM_REDIS_TTL = 600; // 10 minutes
 const STREAM_KEY_PREFIX = 'stream:';
+const CANCEL_KEY_PREFIX = 'stream:cancel:';
+const CANCEL_CHECK_INTERVAL_MS = 1_000;
+
+function streamCancelKey(aiMessageId: string): string {
+  return `${CANCEL_KEY_PREFIX}${aiMessageId}`;
+}
+
+/**
+ * Flag an in-flight stream for cancellation. `streamChatResponse` polls this
+ * key between chunks and aborts the model stream when it appears. The worker
+ * may run in a different process from the API, so the signal goes through
+ * Redis rather than an in-memory AbortController registry.
+ */
+export async function requestStreamCancellation(
+  aiMessageId: string,
+): Promise<void> {
+  const redis = getRedis();
+  if (redis) {
+    await redis.set(streamCancelKey(aiMessageId), '1', 'EX', STREAM_REDIS_TTL);
+  }
+}
 
 /** Default streaming model — matches the existing streamAIResponse path. */
 export const DEFAULT_STREAM_MODEL = 'gpt-4o-mini';
@@ -53,6 +75,10 @@ export type StreamPart =
       /** Set after generated files are persisted on the message. */
       fileId?: string;
       fileName?: string;
+      /** Links a propose_* tool call to its pending creation in message meta. */
+      proposalId?: string;
+      /** Class-files folder the generated file was saved into, if any. */
+      folderId?: string;
       status: 'executing' | 'completed' | 'failed';
     };
 
@@ -61,6 +87,7 @@ export interface GeneratedDocFileLink {
   fileId: string;
   fileName: string;
   format?: string;
+  folderId?: string;
 }
 
 /** Apply pipeline-resolved formats onto generate_document tool parts. */
@@ -136,6 +163,7 @@ export function enrichStreamPartsWithGeneratedFiles(
       fileName: file.fileName,
       status: 'completed',
       ...(file.format ? { format: file.format } : {}),
+      ...(file.folderId ? { folderId: file.folderId } : {}),
     };
   });
 }
@@ -162,7 +190,7 @@ function toolFieldFromInput(input: unknown, key: string): string | undefined {
 
 /** Pull a human-meaningful label out of a tool's input args, if present. */
 function toolTitleFromInput(input: unknown): string | undefined {
-  for (const key of ['title', 'name', 'query'] as const) {
+  for (const key of ['targetTitle', 'title', 'name', 'query'] as const) {
     const val = toolFieldFromInput(input, key);
     if (val) return val;
   }
@@ -191,6 +219,9 @@ export interface StreamChatResult {
   toolCalls: StreamedToolCall[];
   /** Ordered text/tool parts, in the exact order the model produced them. */
   parts: StreamPart[];
+  /** True when the stream was stopped by a cancellation request; `text` and
+   *  `parts` hold whatever was produced before the abort. */
+  cancelled: boolean;
 }
 
 /**
@@ -218,11 +249,39 @@ export async function streamChatResponse(
 
   const redis = getRedis();
   const streamKey = `${STREAM_KEY_PREFIX}${aiMessageId}`;
+  const cancelKey = streamCancelKey(aiMessageId);
   if (redis) {
     await redis.set(streamKey, '', 'EX', STREAM_REDIS_TTL);
+    // A stale flag from a previously cancelled run on the same message id
+    // (e.g. a rerun) must not kill this stream instantly.
+    await redis.del(cancelKey).catch(() => {});
   }
 
   let fullText = '';
+  let cancelled = false;
+  let lastCancelCheck = 0;
+  const abortController = new AbortController();
+
+  // Poll the cancel flag at most once a second: Redis when available,
+  // otherwise the message row (the cancel mutation flips it to CANCELLED).
+  const checkCancelled = async (): Promise<boolean> => {
+    if (cancelled) return true;
+    const now = Date.now();
+    if (now - lastCancelCheck < CANCEL_CHECK_INTERVAL_MS) return false;
+    lastCancelCheck = now;
+    if (redis) {
+      const flag = await redis.get(cancelKey).catch(() => null);
+      if (flag) cancelled = true;
+    } else {
+      const row = await prisma.message
+        .findUnique({ where: { id: aiMessageId }, select: { status: true } })
+        .catch(() => null);
+      if (row?.status === 'CANCELLED') cancelled = true;
+    }
+    if (cancelled) abortController.abort();
+    return cancelled;
+  };
+
   const parts: StreamPart[] = [];
   const toolCalls: StreamedToolCall[] = [];
   // Map AI SDK toolCallId -> index in `parts` so the executing indicator can
@@ -256,13 +315,20 @@ export async function streamChatResponse(
       temperature,
       maxOutputTokens,
       stopWhen: stepCountIs(maxSteps),
+      abortSignal: abortController.signal,
     });
 
     // `fullStream` yields text deltas AND tool events in a single, correctly
     // ordered sequence — this is what makes inline tool calls possible. We
     // build an ordered `parts` list and broadcast each event as it happens.
-    for await (const part of result.fullStream) {
-      switch (part.type) {
+    try {
+      for await (const part of result.fullStream) {
+        if (await checkCancelled()) break;
+        if (part.type === 'abort') {
+          cancelled = true;
+          break;
+        }
+        switch (part.type) {
         case 'text-delta': {
           appendText(part.text);
           if (redis) {
@@ -333,10 +399,19 @@ export async function streamChatResponse(
           });
           break;
         }
-        default:
-          // ignore reasoning/source/step/finish/raw parts
-          break;
+          default:
+            // ignore reasoning/source/step/finish/raw parts
+            break;
+        }
       }
+    } catch (streamError) {
+      // Aborting the model stream mid-iteration surfaces as an error from
+      // `fullStream`; when it is our own cancellation, keep the partials.
+      if (!cancelled) throw streamError;
+    }
+
+    if (cancelled) {
+      logger.info('AI chat stream cancelled', { aiMessageId, conversationId });
     }
 
     const usage = await Promise.resolve(result.totalUsage).catch(() => undefined);
@@ -356,7 +431,7 @@ export async function streamChatResponse(
       attribution,
     });
 
-    return { text: fullText, toolCalls, parts };
+    return { text: fullText, toolCalls, parts, cancelled };
   } catch (error) {
     await logInferenceUsage({
       model,
@@ -371,6 +446,7 @@ export async function streamChatResponse(
   } finally {
     if (redis) {
       await redis.del(streamKey).catch(() => {});
+      await redis.del(cancelKey).catch(() => {});
     }
   }
 }

package/src/services/aiGeneration.ts

@@ -0,0 +1,92 @@
+/**
+ * AI generation cancellation service.
+ *
+ * Cancels an in-flight AI chat generation (lab chat / Newton chat): flags the
+ * stream for abort via Redis so the worker's `streamChatResponse` loop stops,
+ * marks the linked RunJob CANCELLED (so a still-queued job never runs), and
+ * flips the placeholder message to CANCELLED immediately. The pipeline then
+ * persists whatever partial text/tool parts had already streamed.
+ */
+import { TRPCError } from "@trpc/server";
+import { JobStatus } from "@prisma/client";
+import { prisma } from "../lib/prisma.js";
+import { chatChannel, pusher } from "../lib/pusher.js";
+import { isAIUser } from "../utils/aiUser.js";
+import { requestStreamCancellation } from "./aiChatStream.js";
+import { logger } from "../utils/logger.js";
+
+export async function cancelAiGeneration(userId: string, messageId: string) {
+  const message = await prisma.message.findFirst({
+    where: {
+      id: messageId,
+      conversation: { members: { some: { userId } } },
+    },
+    select: {
+      id: true,
+      senderId: true,
+      status: true,
+      conversationId: true,
+    },
+  });
+
+  if (!message || !isAIUser(message.senderId)) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "AI message not found or access denied",
+    });
+  }
+
+  if (message.status !== JobStatus.PENDING) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "No generation in progress for this message",
+    });
+  }
+
+  // Signal the in-flight stream (worker process) to abort.
+  await requestStreamCancellation(messageId);
+
+  // Mark the backing RunJob CANCELLED so a queued-but-not-started job is
+  // skipped by the worker, and the audit record reflects the stop.
+  await prisma.runJob.updateMany({
+    where: {
+      status: { in: ["PENDING", "RUNNING"] },
+      input: { path: ["aiMessageId"], equals: messageId },
+    },
+    data: {
+      status: "CANCELLED",
+      error: "Cancelled by user",
+      finishedAt: new Date(),
+    },
+  });
+
+  // Flip the placeholder to CANCELLED right away: this is both the instant
+  // UI signal and the durable cancel marker the stream loop falls back to
+  // when Redis is unavailable. The pipeline later fills in partial content.
+  const updated = await prisma.message.update({
+    where: { id: messageId },
+    data: { status: JobStatus.CANCELLED },
+    select: { id: true, conversationId: true, status: true },
+  });
+
+  logger.info("AI generation cancellation requested", {
+    messageId,
+    conversationId: message.conversationId,
+    userId,
+  });
+
+  try {
+    await pusher.trigger(chatChannel(updated.conversationId), "message-updated", {
+      id: updated.id,
+      conversationId: updated.conversationId,
+      status: updated.status,
+    });
+  } catch (broadcastError) {
+    logger.error("Failed to broadcast cancelled AI generation:", {
+      error: broadcastError,
+      messageId,
+    });
+  }
+
+  return { success: true };
+}

package/src/services/aiProposalTools.ts

@@ -22,6 +22,9 @@ import type {
   WorksheetToCreate,
   SectionToCreate,
   DocToCreate,
+  AssignmentUpdate,
+  WorksheetUpdate,
+  SectionUpdate,
 } from '../pipelines/aiLabChatContract.js';
 
 export interface LabProposals {
@@ -29,10 +32,21 @@ export interface LabProposals {
   worksheets: WorksheetToCreate[];
   sections: SectionToCreate[];
   docs: DocToCreate[];
+  assignmentUpdates: AssignmentUpdate[];
+  worksheetUpdates: WorksheetUpdate[];
+  sectionUpdates: SectionUpdate[];
 }
 
 export function createLabProposals(): LabProposals {
-  return { assignments: [], worksheets: [], sections: [], docs: [] };
+  return {
+    assignments: [],
+    worksheets: [],
+    sections: [],
+    docs: [],
+    assignmentUpdates: [],
+    worksheetUpdates: [],
+    sectionUpdates: [],
+  };
 }
 
 function normalizeDueDate(input?: string | null): string {
@@ -82,6 +96,34 @@ interface ProposeAssignmentArgs {
   acceptWorksheet?: boolean;
 }
 
+interface ProposeUpdateAssignmentArgs {
+  id: string;
+  targetTitle: string;
+  title?: string;
+  instructions?: string;
+  dueDate?: string;
+  type?: AssignmentType;
+  maxGrade?: number;
+  acceptFiles?: boolean;
+  acceptExtendedResponse?: boolean;
+  acceptWorksheet?: boolean;
+  sectionId?: string | null;
+}
+
+interface ProposeUpdateWorksheetArgs {
+  id: string;
+  targetTitle: string;
+  name?: string;
+  addQuestions?: ProposeWorksheetArgs['questions'];
+}
+
+interface ProposeUpdateSectionArgs {
+  id: string;
+  targetTitle: string;
+  name: string;
+  color?: string | null;
+}
+
 interface GenerateDocumentArgs {
   title: string;
   content: string;
@@ -235,6 +277,129 @@ export function labProposalTools(proposals: LabProposals): ToolSet {
       },
     },
 
+    propose_update_assignment: {
+      description:
+        'Propose changes to an EXISTING assignment. Only pass the fields that should change; use the assignment id from CLASS CONTEXT.',
+      inputSchema: jsonSchema({
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'Database id of the existing assignment' },
+          targetTitle: { type: 'string', description: "The assignment's current title (shown on the approval card)" },
+          title: { type: 'string', description: 'New title, if renaming' },
+          instructions: { type: 'string' },
+          dueDate: { type: 'string', description: 'ISO 8601 datetime' },
+          type: { type: 'string', enum: ASSIGNMENT_TYPES as unknown as string[] },
+          maxGrade: { type: 'number' },
+          acceptFiles: { type: 'boolean' },
+          acceptExtendedResponse: { type: 'boolean' },
+          acceptWorksheet: { type: 'boolean' },
+          sectionId: { type: 'string', description: 'Move to this section (id from CLASS CONTEXT)' },
+        },
+        required: ['id', 'targetTitle'],
+      }),
+      execute: async (args: ProposeUpdateAssignmentArgs) => {
+        proposals.assignmentUpdates.push({
+          ...args,
+          dueDate: args.dueDate ? normalizeDueDate(args.dueDate) : undefined,
+        });
+        return `Update to assignment "${args.targetTitle}" proposed.`;
+      },
+    },
+
+    propose_update_worksheet: {
+      description:
+        'Propose changes to an EXISTING worksheet: rename it and/or append new questions. Use the worksheet id from CLASS CONTEXT.',
+      inputSchema: jsonSchema({
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'Database id of the existing worksheet' },
+          targetTitle: { type: 'string', description: "The worksheet's current name (shown on the approval card)" },
+          name: { type: 'string', description: 'New name, if renaming' },
+          addQuestions: {
+            type: 'array',
+            description: 'New questions to append to the worksheet',
+            items: {
+              type: 'object',
+              properties: {
+                type: { type: 'string', enum: QUESTION_TYPES as unknown as string[] },
+                question: { type: 'string' },
+                answer: { type: 'string' },
+                options: {
+                  type: 'array',
+                  items: {
+                    type: 'object',
+                    properties: {
+                      text: { type: 'string' },
+                      isCorrect: { type: 'boolean' },
+                    },
+                    required: ['text', 'isCorrect'],
+                  },
+                },
+                markScheme: {
+                  type: 'array',
+                  items: {
+                    type: 'object',
+                    properties: {
+                      points: { type: 'number' },
+                      description: { type: 'string' },
+                    },
+                    required: ['points', 'description'],
+                  },
+                },
+                points: { type: 'number' },
+              },
+              required: ['type', 'question'],
+            },
+          },
+        },
+        required: ['id', 'targetTitle'],
+      }),
+      execute: async ({ id, targetTitle, name, addQuestions }: ProposeUpdateWorksheetArgs) => {
+        proposals.worksheetUpdates.push({
+          id,
+          targetTitle,
+          name,
+          addQuestions: (addQuestions ?? []).map((q, index) => ({
+            type: q.type,
+            question: q.question,
+            answer: q.answer ?? '',
+            options: (q.options ?? []).map((o) => ({
+              id: v4(),
+              text: o.text,
+              isCorrect: o.isCorrect,
+            })),
+            markScheme: (q.markScheme ?? []).map((m) => ({
+              id: v4(),
+              points: m.points,
+              description: m.description,
+            })),
+            points: q.points ?? 0,
+            order: index,
+          })),
+        });
+        return `Update to worksheet "${targetTitle}" proposed.`;
+      },
+    },
+
+    propose_update_section: {
+      description:
+        'Propose changes to an EXISTING section (rename and/or recolor). Use the section id from CLASS CONTEXT. Always pass name (the resulting name, even if unchanged).',
+      inputSchema: jsonSchema({
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'Database id of the existing section' },
+          targetTitle: { type: 'string', description: "The section's current name (shown on the approval card)" },
+          name: { type: 'string', description: 'Resulting section name (pass the current name if only changing color)' },
+          color: { type: 'string', description: 'Optional hex color like #3b82f6' },
+        },
+        required: ['id', 'targetTitle', 'name'],
+      }),
+      execute: async ({ id, targetTitle, name, color }: ProposeUpdateSectionArgs) => {
+        proposals.sectionUpdates.push({ id, targetTitle, name, color: color ?? null });
+        return `Update to section "${targetTitle}" proposed.`;
+      },
+    },
+
     generate_document: {
       description:
         'Generate a downloadable file and attach it to this message. Pick the best format for the request — pptx for slides, xlsx/csv for data, docx for editable handouts, pdf for print-ready docs, png/jpeg for charts/diagrams/figures (NOT pdf for visuals). Use py/js/ts only when the teacher explicitly wants source code. Always set format explicitly.',