@studious-lms/server 1.26.0 → 1.28.0

package/src/services/aiProposals.ts

@@ -0,0 +1,428 @@
+/**
+ * AI creation proposals – defer-and-confirm flow for Lab chat.
+ *
+ * The lab pipeline records every `propose_*` tool call as a pending creation
+ * on the AI message's meta (`meta.pendingCreations`). Nothing is created at
+ * generation time: the teacher approves or dismisses each proposal from the
+ * chat, and approval creates the real entity server-side.
+ */
+import { TRPCError } from "@trpc/server";
+import { v4 } from "uuid";
+import { prisma } from "../lib/prisma.js";
+import { chatChannel, pusher } from "../lib/pusher.js";
+import { logger } from "../utils/logger.js";
+import {
+  findConversationMembership,
+  findMessageByIdMinimal,
+  messageFileSelect,
+} from "../models/message.js";
+import { createAssignmentRecord, updateAssignmentRecord } from "./assignment.js";
+import {
+  createWorksheetRecord,
+  addQuestionToWorksheet,
+  updateWorksheetRecord,
+} from "./worksheet.js";
+import { createSectionRecord, updateSectionRecord } from "./section.js";
+import type { StreamPart } from "./aiChatStream.js";
+import type { LabProposals } from "./aiProposalTools.js";
+import type {
+  AssignmentToCreate,
+  WorksheetToCreate,
+  SectionToCreate,
+  AssignmentUpdate,
+  WorksheetUpdate,
+  SectionUpdate,
+} from "../pipelines/aiLabChatContract.js";
+
+export type PendingCreationStatus = "pending" | "approved" | "dismissed";
+
+export type PendingCreation =
+  | { id: string; kind: "assignment"; title: string; payload: AssignmentToCreate; status: PendingCreationStatus; createdId?: string }
+  | { id: string; kind: "worksheet"; title: string; payload: WorksheetToCreate; status: PendingCreationStatus; createdId?: string }
+  | { id: string; kind: "section"; title: string; payload: SectionToCreate; status: PendingCreationStatus; createdId?: string }
+  | { id: string; kind: "assignmentUpdate"; title: string; payload: AssignmentUpdate; status: PendingCreationStatus; createdId?: string }
+  | { id: string; kind: "worksheetUpdate"; title: string; payload: WorksheetUpdate; status: PendingCreationStatus; createdId?: string }
+  | { id: string; kind: "sectionUpdate"; title: string; payload: SectionUpdate; status: PendingCreationStatus; createdId?: string };
+
+const PROPOSAL_TOOL_KIND: Record<string, PendingCreation["kind"]> = {
+  propose_assignment: "assignment",
+  propose_worksheet: "worksheet",
+  propose_section: "section",
+  propose_update_assignment: "assignmentUpdate",
+  propose_update_worksheet: "worksheetUpdate",
+  propose_update_section: "sectionUpdate",
+};
+
+/**
+ * Turn the stream's accumulated proposals into pending creations and stamp
+ * each `propose_*` tool part with its proposal id so the client can render
+ * the confirmation card inline at the tool-call position.
+ */
+export function buildPendingCreations(
+  proposals: LabProposals,
+  parts: StreamPart[],
+): { pendingCreations: PendingCreation[]; parts: StreamPart[] } {
+  const pendingCreations: PendingCreation[] = [
+    ...proposals.assignments.map((payload): PendingCreation => ({
+      id: v4(), kind: "assignment", title: payload.title, payload, status: "pending",
+    })),
+    ...proposals.worksheets.map((payload): PendingCreation => ({
+      id: v4(), kind: "worksheet", title: payload.title, payload, status: "pending",
+    })),
+    ...proposals.sections.map((payload): PendingCreation => ({
+      id: v4(), kind: "section", title: payload.name, payload, status: "pending",
+    })),
+    ...proposals.assignmentUpdates.map((payload): PendingCreation => ({
+      id: v4(), kind: "assignmentUpdate", title: payload.targetTitle, payload, status: "pending",
+    })),
+    ...proposals.worksheetUpdates.map((payload): PendingCreation => ({
+      id: v4(), kind: "worksheetUpdate", title: payload.targetTitle, payload, status: "pending",
+    })),
+    ...proposals.sectionUpdates.map((payload): PendingCreation => ({
+      id: v4(), kind: "sectionUpdate", title: payload.targetTitle, payload, status: "pending",
+    })),
+  ];
+
+  const remaining = new Map<PendingCreation["kind"], PendingCreation[]>();
+  for (const creation of pendingCreations) {
+    const list = remaining.get(creation.kind) ?? [];
+    list.push(creation);
+    remaining.set(creation.kind, list);
+  }
+
+  const stamped = parts.map((part) => {
+    if (part.type !== "tool") return part;
+    const kind = PROPOSAL_TOOL_KIND[part.toolName];
+    if (!kind) return part;
+    const list = remaining.get(kind);
+    if (!list || list.length === 0) return part;
+    // Prefer a title match; fall back to stream order.
+    const idx = part.title
+      ? list.findIndex((c) => c.title.trim().toLowerCase() === part.title!.trim().toLowerCase())
+      : 0;
+    const creation = list.splice(idx >= 0 ? idx : 0, 1)[0];
+    return { ...part, proposalId: creation.id };
+  });
+
+  return { pendingCreations, parts: stamped };
+}
+
+const RESOLVE_MAX_RETRIES = 5;
+
+/**
+ * Compare-and-swap a proposal's status inside message meta. Returns the new
+ * meta on success, or null when the proposal was not in `fromStatus`.
+ */
+async function casProposalStatus(
+  messageId: string,
+  proposalId: string,
+  fromStatus: PendingCreationStatus,
+  patch: Partial<Pick<PendingCreation, "status" | "createdId">>,
+): Promise<Record<string, unknown> | null> {
+  for (let attempt = 0; attempt < RESOLVE_MAX_RETRIES; attempt++) {
+    const msg = await prisma.message.findUnique({
+      where: { id: messageId },
+      select: { meta: true },
+    });
+    if (!msg) {
+      throw new TRPCError({ code: "NOT_FOUND", message: "Message not found" });
+    }
+
+    const currentMeta = (msg.meta as Record<string, unknown>) ?? {};
+    const creations = Array.isArray(currentMeta.pendingCreations)
+      ? (currentMeta.pendingCreations as PendingCreation[])
+      : [];
+    const target = creations.find((c) => c.id === proposalId);
+    if (!target) {
+      throw new TRPCError({ code: "NOT_FOUND", message: "Proposal not found" });
+    }
+    if (target.status !== fromStatus) return null;
+
+    const newMeta = {
+      ...currentMeta,
+      pendingCreations: creations.map((c) =>
+        c.id === proposalId ? { ...c, ...patch } : c,
+      ),
+    };
+
+    const newMetaJson = JSON.stringify(newMeta);
+    const currentMetaJson = msg.meta === null ? null : JSON.stringify(msg.meta);
+    const updatedCount =
+      currentMetaJson === null
+        ? await prisma.$executeRaw`
+            UPDATE "Message" SET meta = ${newMetaJson}::jsonb
+            WHERE id = ${messageId} AND meta IS NULL
+          `
+        : await prisma.$executeRaw`
+            UPDATE "Message" SET meta = ${newMetaJson}::jsonb
+            WHERE id = ${messageId} AND meta = ${currentMetaJson}::jsonb
+          `;
+
+    if (Number(updatedCount) > 0) return newMeta;
+  }
+
+  throw new TRPCError({
+    code: "CONFLICT",
+    message: "Failed to update proposal after retries due to concurrent updates",
+  });
+}
+
+async function broadcastMessageMeta(messageId: string, conversationId: string) {
+  const updated = await prisma.message.findUnique({
+    where: { id: messageId },
+    include: {
+      sender: {
+        select: {
+          id: true,
+          username: true,
+          profile: { select: { displayName: true, profilePicture: true } },
+        },
+      },
+      attachments: { select: messageFileSelect },
+      mentions: { select: { userId: true } },
+    },
+  });
+  if (!updated) return;
+
+  try {
+    await pusher.trigger(chatChannel(conversationId), "message-updated", {
+      id: updated.id,
+      content: updated.content,
+      senderId: updated.senderId,
+      conversationId: updated.conversationId,
+      status: updated.status,
+      createdAt: updated.createdAt,
+      sender: updated.sender,
+      attachments: updated.attachments ?? [],
+      meta: updated.meta,
+      mentionedUserIds: updated.mentions.map((m) => m.userId),
+    });
+  } catch (error) {
+    logger.error("Failed to broadcast proposal resolution via Pusher", {
+      error,
+      messageId,
+    });
+  }
+}
+
+/** Create or update the proposed entity; returns the affected entity's id. */
+async function createProposedEntity(
+  userId: string,
+  classId: string,
+  proposal: PendingCreation,
+): Promise<string> {
+  switch (proposal.kind) {
+    case "sectionUpdate": {
+      const payload = proposal.payload;
+      await updateSectionRecord(userId, {
+        id: payload.id,
+        classId,
+        name: payload.name,
+        color: payload.color ?? undefined,
+      });
+      return payload.id;
+    }
+    case "worksheetUpdate": {
+      const payload = proposal.payload;
+      if (payload.name) {
+        await updateWorksheetRecord(payload.id, userId, { name: payload.name });
+      }
+      for (const question of payload.addQuestions ?? []) {
+        await addQuestionToWorksheet(payload.id, userId, {
+          question: question.question,
+          answer: question.answer,
+          points: question.points,
+          options: question.options,
+          markScheme: question.markScheme,
+          type: question.type,
+          order: question.order,
+        });
+      }
+      return payload.id;
+    }
+    case "assignmentUpdate": {
+      const payload = proposal.payload;
+      await updateAssignmentRecord(userId, {
+        id: payload.id,
+        classId,
+        title: payload.title,
+        instructions: payload.instructions,
+        dueDate: payload.dueDate,
+        type: payload.type,
+        maxGrade: payload.maxGrade,
+        acceptFiles: payload.acceptFiles,
+        acceptExtendedResponse: payload.acceptExtendedResponse,
+        acceptWorksheet: payload.acceptWorksheet,
+        sectionId: payload.sectionId,
+      });
+      return payload.id;
+    }
+    case "section": {
+      const section = await createSectionRecord(userId, {
+        classId,
+        name: proposal.payload.name,
+        color: proposal.payload.color ?? undefined,
+      });
+      return section.id;
+    }
+    case "worksheet": {
+      const worksheet = await createWorksheetRecord(classId, proposal.payload.title);
+      for (const question of proposal.payload.questions) {
+        await addQuestionToWorksheet(worksheet.id, userId, {
+          question: question.question,
+          answer: question.answer,
+          points: question.points,
+          options: question.options,
+          markScheme: question.markScheme,
+          type: question.type,
+          order: question.order,
+        });
+      }
+      return worksheet.id;
+    }
+    case "assignment": {
+      const payload = proposal.payload;
+      const assignment = await createAssignmentRecord(userId, {
+        classId,
+        title: payload.title,
+        instructions: payload.instructions,
+        dueDate: payload.dueDate,
+        type: payload.type,
+        maxGrade: payload.maxGrade,
+        acceptFiles: payload.acceptFiles,
+        acceptExtendedResponse: payload.acceptExtendedResponse,
+        acceptWorksheet: payload.acceptWorksheet,
+        gradingBoundaryId: payload.gradingBoundaryId ?? undefined,
+        markSchemeId: payload.markSchemeId ?? undefined,
+        worksheetIds: payload.worksheetIds,
+        studentIds: payload.studentIds,
+        sectionId: payload.sectionId ?? undefined,
+        existingFileIds: payload.attachments.map((a) => a.id),
+      });
+      return assignment.id;
+    }
+  }
+}
+
+/**
+ * Approve or dismiss a pending AI creation proposal. Approval creates the
+ * entity server-side; both outcomes persist to message meta and broadcast a
+ * `message-updated` event so every client (and reloads) see the final state.
+ */
+export async function resolveAiProposal(
+  userId: string,
+  input: { messageId: string; proposalId: string; action: "approve" | "dismiss" },
+) {
+  const { messageId, proposalId, action } = input;
+
+  const message = await findMessageByIdMinimal(messageId);
+  if (!message) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Message not found" });
+  }
+
+  const membership = await findConversationMembership(
+    message.conversationId,
+    userId,
+  );
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Not a member of this conversation",
+    });
+  }
+
+  const labChat = await prisma.labChat.findFirst({
+    where: { conversationId: message.conversationId },
+    select: { classId: true },
+  });
+  if (!labChat) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Proposals can only be resolved in lab chats",
+    });
+  }
+
+  const teaches = await prisma.class.findFirst({
+    where: { id: labChat.classId, teachers: { some: { id: userId } } },
+    select: { id: true },
+  });
+  if (!teaches) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only class teachers can resolve proposals",
+    });
+  }
+
+  const currentMeta = await prisma.message.findUnique({
+    where: { id: messageId },
+    select: { meta: true },
+  });
+  const creations = Array.isArray(
+    (currentMeta?.meta as Record<string, unknown> | null)?.pendingCreations,
+  )
+    ? ((currentMeta!.meta as Record<string, unknown>)
+        .pendingCreations as PendingCreation[])
+    : [];
+  const proposal = creations.find((c) => c.id === proposalId);
+  if (!proposal) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Proposal not found" });
+  }
+  if (proposal.status !== "pending") {
+    return {
+      status: proposal.status,
+      createdId: proposal.createdId ?? null,
+    };
+  }
+
+  if (action === "dismiss") {
+    const meta = await casProposalStatus(messageId, proposalId, "pending", {
+      status: "dismissed",
+    });
+    if (meta) {
+      await broadcastMessageMeta(messageId, message.conversationId);
+    }
+    return { status: "dismissed" as const, createdId: null };
+  }
+
+  // Approve: claim the proposal first so concurrent approvals create at most
+  // one entity, then create and record the created id (roll back on failure).
+  const claimed = await casProposalStatus(messageId, proposalId, "pending", {
+    status: "approved",
+  });
+  if (!claimed) {
+    const msg = await prisma.message.findUnique({
+      where: { id: messageId },
+      select: { meta: true },
+    });
+    const latest = (
+      ((msg?.meta as Record<string, unknown> | null)?.pendingCreations ??
+        []) as PendingCreation[]
+    ).find((c) => c.id === proposalId);
+    return {
+      status: latest?.status ?? "pending",
+      createdId: latest?.createdId ?? null,
+    };
+  }
+
+  try {
+    const createdId = await createProposedEntity(userId, labChat.classId, proposal);
+    await casProposalStatus(messageId, proposalId, "approved", { createdId });
+    await broadcastMessageMeta(messageId, message.conversationId);
+    return { status: "approved" as const, createdId };
+  } catch (error) {
+    logger.error("Failed to create approved AI proposal", {
+      error,
+      messageId,
+      proposalId,
+      kind: proposal.kind,
+    });
+    await casProposalStatus(messageId, proposalId, "approved", {
+      status: "pending",
+    }).catch(() => null);
+    await broadcastMessageMeta(messageId, message.conversationId);
+    throw new TRPCError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Failed to create the approved item",
+    });
+  }
+}

package/src/services/auth.ts

@@ -182,7 +182,10 @@ export async function resendVerificationEmail(email: string) {
     });
   }
 
-  await deleteSessionsByUserId(user.id);
+  // Do NOT delete the user's sessions here — resending a verification email
+  // must never log the account out of its active devices. A previously issued
+  // verification token simply expires on its own; issuing a fresh one is
+  // enough.
 
   const verificationToken = await createSession({
     id: uuidv4(),
@@ -298,6 +301,9 @@ export async function resetPassword(token: string, password: string) {
   }
 
   await updateUserPassword(session.userId, await hash(password, 10));
-  await deleteSessionById(token);
+  // Revoke every session (AUTH + any other reset/verification tokens), not
+  // just the consumed reset token, so a stolen bearer token can't outlive a
+  // password reset.
+  await deleteSessionsByUserId(session.userId);
   return { success: true };
 }

package/src/services/fees.ts

@@ -428,8 +428,12 @@ export async function getReceiptPdf(userId: string, paymentId: string) {
       },
       {
         label: "Paid at",
+        // Format in UTC rather than a hardcoded country timezone — Studious is
+        // used internationally, and this matches the UTC basis already used
+        // for invoice month labels. A per-school timezone setting is the
+        // proper long-term home for this (see docs/audits bug audit §2).
         value: new Intl.DateTimeFormat("en-CA", {
-          timeZone: "Asia/Kathmandu",
+          timeZone: "UTC",
           year: "numeric",
           month: "2-digit",
           day: "2-digit",

package/src/services/labChat.ts

@@ -11,6 +11,7 @@ import {
   findLabChatByMember,
   findLabChatByTeacher,
   findLabChatById,
+  findClassContextForStarterPrompts,
   findClassMembership,
   findLabChatsByClass,
   findLabChatForPost,
@@ -203,6 +204,70 @@ export async function getLabChat(userId: string, labChatId: string) {
   };
 }
 
+const GENERIC_STARTER_PROMPTS = [
+  "Create a quiz on this week's topic",
+  "Draft a worksheet with 10 practice questions",
+  "Plan a lesson with objectives and activities",
+  "Suggest an assignment with a mark scheme",
+];
+
+const MAX_STARTER_PROMPTS = 5;
+
+/**
+ * Suggest starter prompts for a class's lab chat, derived from recent
+ * class context (upcoming due work, recent assignments, units, subject).
+ * Pure heuristics — no LLM call — so it stays cheap and fast. Falls back
+ * to generic defaults when the class has no usable context.
+ */
+export async function getStarterPrompts(userId: string, classId: string) {
+  const classContext = await findClassContextForStarterPrompts(
+    classId,
+    userId
+  );
+  if (!classContext) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Not a teacher in this class",
+    });
+  }
+
+  const prompts: string[] = [];
+  const now = new Date();
+
+  const published = classContext.assignments.filter((a) => !a.inProgress);
+  const upcoming = published
+    .filter((a) => a.dueDate > now)
+    .sort((a, b) => a.dueDate.getTime() - b.dueDate.getTime())[0];
+  if (upcoming) {
+    prompts.push(
+      `Create a worksheet to help students prepare for "${upcoming.title}"`
+    );
+  }
+
+  const recent = published.find((a) => a.title !== upcoming?.title);
+  if (recent) {
+    prompts.push(`Draft a quiz reviewing "${recent.title}"`);
+  }
+
+  const unit = classContext.sections[0];
+  if (unit) {
+    prompts.push(`Plan a lesson for the unit "${unit.name}"`);
+  }
+
+  if (classContext.subject) {
+    prompts.push(
+      `Suggest a ${classContext.subject} assignment with a mark scheme`
+    );
+  }
+
+  for (const generic of GENERIC_STARTER_PROMPTS) {
+    if (prompts.length >= 3) break;
+    if (!prompts.includes(generic)) prompts.push(generic);
+  }
+
+  return { prompts: prompts.slice(0, MAX_STARTER_PROMPTS) };
+}
+
 export async function listLabChats(userId: string, classId: string) {
   const classMembership = await findClassMembership(classId, userId);
   if (!classMembership) {