@studious-lms/server 1.26.0 → 1.28.0

package/src/services/visualization.ts

@@ -0,0 +1,147 @@
+import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
+import { isTeacherInClass } from "../models/class.js";
+import {
+  generateVisualization,
+  MAX_VISUALIZATION_HTML_LENGTH,
+  reviseVisualization,
+} from "../pipelines/generateVisualization.js";
+
+const summarySelect = {
+  id: true,
+  classId: true,
+  title: true,
+  prompt: true,
+  published: true,
+  createdAt: true,
+  updatedAt: true,
+} as const;
+
+const detailSelect = { ...summarySelect, html: true } as const;
+
+async function getClassContext(classId: string) {
+  return prisma.class.findUnique({
+    where: { id: classId },
+    select: { name: true, subject: true, schoolId: true },
+  });
+}
+
+async function findTeacherVisualization(classId: string, id: string) {
+  const viz = await prisma.visualization.findFirst({
+    where: { id, classId },
+    select: detailSelect,
+  });
+  if (!viz) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Visualisation not found" });
+  }
+  return viz;
+}
+
+function aiError(error: unknown): never {
+  throw new TRPCError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: "Newton couldn't build that visualisation. Try rephrasing it.",
+    cause: error,
+  });
+}
+
+/** Teachers see every visualisation in the class; students only published ones. */
+export async function listVisualizations(userId: string, classId: string) {
+  const isTeacher = !!(await isTeacherInClass(classId, userId));
+  return prisma.visualization.findMany({
+    where: { classId, ...(isTeacher ? {} : { published: true }) },
+    select: summarySelect,
+    orderBy: { updatedAt: "desc" },
+  });
+}
+
+export async function getVisualization(userId: string, classId: string, id: string) {
+  const isTeacher = !!(await isTeacherInClass(classId, userId));
+  const viz = await prisma.visualization.findFirst({
+    where: { id, classId, ...(isTeacher ? {} : { published: true }) },
+    select: detailSelect,
+  });
+  if (!viz) {
+    throw new TRPCError({ code: "NOT_FOUND", message: "Visualisation not found" });
+  }
+  return viz;
+}
+
+export async function createVisualization(
+  userId: string,
+  input: { classId: string; prompt: string; title?: string },
+) {
+  const cls = await getClassContext(input.classId);
+  const generated = await generateVisualization(input.prompt, {
+    className: cls?.name,
+    subject: cls?.subject,
+    attribution: { userId, classId: input.classId, schoolId: cls?.schoolId },
+  }).catch(aiError);
+
+  return prisma.visualization.create({
+    data: {
+      classId: input.classId,
+      createdById: userId,
+      title: input.title?.trim() || generated.title,
+      prompt: input.prompt,
+      html: generated.html,
+    },
+    select: detailSelect,
+  });
+}
+
+export async function reviseVisualizationRecord(
+  userId: string,
+  input: { classId: string; id: string; instruction: string },
+) {
+  const current = await findTeacherVisualization(input.classId, input.id);
+  const cls = await getClassContext(input.classId);
+  const revised = await reviseVisualization(current, input.instruction, {
+    className: cls?.name,
+    subject: cls?.subject,
+    attribution: { userId, classId: input.classId, schoolId: cls?.schoolId },
+  }).catch(aiError);
+
+  return prisma.visualization.update({
+    where: { id: current.id },
+    data: {
+      html: revised.html,
+      prompt: [current.prompt, input.instruction].filter(Boolean).join("\n\n"),
+    },
+    select: detailSelect,
+  });
+}
+
+export async function updateVisualization(input: {
+  classId: string;
+  id: string;
+  title?: string;
+  html?: string;
+  published?: boolean;
+}) {
+  const current = await findTeacherVisualization(input.classId, input.id);
+  if (input.html !== undefined && input.html.length > MAX_VISUALIZATION_HTML_LENGTH) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "Visualisation is too large" });
+  }
+  return prisma.visualization.update({
+    where: { id: current.id },
+    data: {
+      ...(input.title !== undefined ? { title: input.title } : {}),
+      ...(input.html !== undefined ? { html: input.html } : {}),
+      ...(input.published !== undefined ? { published: input.published } : {}),
+    },
+    select: detailSelect,
+  });
+}
+
+/** Deletes the visualisation and any module items that pointed at it. */
+export async function deleteVisualization(input: { classId: string; id: string }) {
+  const current = await findTeacherVisualization(input.classId, input.id);
+  await prisma.$transaction([
+    prisma.courseModuleItem.deleteMany({
+      where: { itemType: "VISUALIZATION", itemId: current.id },
+    }),
+    prisma.visualization.delete({ where: { id: current.id } }),
+  ]);
+  return { id: current.id };
+}

package/src/utils/inference.ts

@@ -476,6 +476,77 @@ export async function completePendingAIMessage(
   };
 }
 
+/**
+ * Persist the partial output of a cancelled generation and flip the AI
+ * message to CANCELLED. Whatever text/tool parts streamed before the stop
+ * are kept on the row (content + meta) so they survive reloads. Broadcasts
+ * `message-updated` so clients patch the bubble in place.
+ */
+export async function cancelPendingAIMessage(
+  messageId: string,
+  content: string,
+  options: {
+    meta?: Record<string, any>;
+    customSender?: AIMessageSenderInfo;
+  } = {},
+): Promise<void> {
+  try {
+    const updated = await prisma.message.update({
+      where: { id: messageId },
+      data: {
+        content,
+        status: JobStatus.CANCELLED,
+        ...(options.meta !== undefined && {
+          meta: options.meta as Prisma.InputJsonValue,
+        }),
+      },
+      include: {
+        attachments: true,
+      },
+    });
+
+    logger.info('AI message cancelled', {
+      messageId: updated.id,
+      conversationId: updated.conversationId,
+      contentLength: content.length,
+    });
+
+    const senderInfo = buildAISenderInfo(options.customSender);
+
+    try {
+      await pusher.trigger(chatChannel(updated.conversationId), 'message-updated', {
+        id: updated.id,
+        content: updated.content,
+        senderId: updated.senderId,
+        conversationId: updated.conversationId,
+        status: updated.status,
+        createdAt: updated.createdAt,
+        sender: senderInfo,
+        mentionedUserIds: [],
+        meta: updated.meta ?? {},
+        attachments: updated.attachments.map((attachment) => ({
+          id: attachment.id,
+          attachmentId: attachment.id,
+          name: attachment.name,
+          type: attachment.type,
+          size: attachment.size,
+          path: attachment.path,
+        })),
+      });
+    } catch (broadcastError) {
+      logger.error('Failed to broadcast cancelled AI message:', {
+        error: broadcastError,
+        messageId,
+      });
+    }
+  } catch (error) {
+    logger.error('Failed to mark AI message as cancelled:', {
+      error,
+      messageId,
+    });
+  }
+}
+
 /**
  * Flip a PENDING AI message to FAILED and broadcast the status change.
  * Does NOT throw — failure paths in the pipelines call this in catch blocks
@@ -486,6 +557,20 @@ export async function failPendingAIMessage(
   options: { reason?: string } = {},
 ): Promise<void> {
   try {
+    const current = await prisma.message.findUnique({
+      where: { id: messageId },
+      select: { status: true },
+    });
+    // A message the user already cancelled must stay CANCELLED — late
+    // failures from the aborted pipeline are a consequence of the cancel.
+    if (current?.status === JobStatus.CANCELLED) {
+      logger.info('Skipping FAILED flip; AI message already cancelled', {
+        messageId,
+        reason: options.reason,
+      });
+      return;
+    }
+
     const updated = await prisma.message.update({
       where: { id: messageId },
       data: { status: JobStatus.FAILED },

package/src/utils/sentryTrpc.ts

@@ -0,0 +1,25 @@
+import type { TRPCError } from '@trpc/server';
+
+/**
+ * Error codes that mean "the caller did something wrong" — noise in Sentry.
+ * Everything else (server faults, unhandled Prisma/AI failures) is reported.
+ */
+const EXPECTED_CODES = new Set([
+  'BAD_REQUEST',
+  'PARSE_ERROR',
+  'UNAUTHORIZED',
+  'FORBIDDEN',
+  'NOT_FOUND',
+  'CONFLICT',
+  'PRECONDITION_FAILED',
+  'PAYLOAD_TOO_LARGE',
+  'UNPROCESSABLE_CONTENT',
+  'TOO_MANY_REQUESTS',
+  'CLIENT_CLOSED_REQUEST',
+  'METHOD_NOT_SUPPORTED',
+  'UNSUPPORTED_MEDIA_TYPE',
+]);
+
+export function isReportableTrpcError(error: Pick<TRPCError, 'code'>): boolean {
+  return !EXPECTED_CODES.has(error.code);
+}

package/src/workers/processors/createRunJobWorker.ts

@@ -91,6 +91,14 @@ export function createRunJobWorker<T extends RunJobType>({
         return existing.result;
       }
 
+      if (existing.status === 'CANCELLED') {
+        logger.info(`${name} RunJob cancelled before start; skipping`, {
+          runJobId,
+          bullJobId: job.id,
+        });
+        return existing.result;
+      }
+
       await prisma.runJob.update({
         where: { id: runJobId },
         data: {
@@ -108,8 +116,10 @@ export function createRunJobWorker<T extends RunJobType>({
         classId: existing.classId ?? null,
       });
 
-      await prisma.runJob.update({
-        where: { id: runJobId },
+      // `updateMany` with a status guard so a cancellation that landed while
+      // the run was in flight is not overwritten with SUCCEEDED.
+      await prisma.runJob.updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           status: 'SUCCEEDED',
           finishedAt: new Date(),
@@ -146,29 +156,19 @@ export function createRunJobWorker<T extends RunJobType>({
 
     if (!runJobId) return;
 
+    // Status guard: don't let a late failure (e.g. from an aborted stream)
+    // overwrite a RunJob the user already cancelled.
     await prisma.runJob
-      .update({
-        where: { id: runJobId },
+      .updateMany({
+        where: { id: runJobId, status: { not: 'CANCELLED' } },
         data: {
           error: err.message,
           ...(isFinalAttempt
-            ? { status: 'FAILED', finishedAt: new Date() }
+            ? { status: 'FAILED' as const, finishedAt: new Date() }
             : {}),
         },
       })
       .catch((updateError) => {
-        // P2025 = record not found. The RunJob row is gone (orphaned job from a
-        // shared/reset Redis), so there's nothing to flag as FAILED — log
-        // quietly instead of as an error to avoid noise.
-        if (
-          updateError instanceof Prisma.PrismaClientKnownRequestError &&
-          updateError.code === 'P2025'
-        ) {
-          logger.warn(`${name} failure not recorded; RunJob no longer exists`, {
-            runJobId,
-          });
-          return;
-        }
         logger.error(`Failed to record ${name} failure on RunJob`, {
           runJobId,
           error:

package/tests/unit/lib/fileUploadSession.test.ts

@@ -0,0 +1,67 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const prismaMocks = vi.hoisted(() => ({
+  file: { findFirst: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({ prisma: prismaMocks }));
+// GCS client construction touches credentials at import — stub it out.
+vi.mock('../../../src/lib/googleCloudStorage.js', () => ({
+  getSignedUrl: vi.fn(),
+  objectExists: vi.fn(),
+}));
+// env.ts validates process.env at import; the function under test never reads
+// env, so a bare stub keeps the import graph from exiting the process.
+vi.mock('../../../src/lib/config/env.js', () => ({ env: {} }));
+
+import { validateDirectUploadSession } from '../../../src/lib/fileUpload.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('validateDirectUploadSession', () => {
+  test('rejects when no upload session id is supplied', async () => {
+    await expect(
+      validateDirectUploadSession({ filePath: 'a/b.png', uploadSessionId: undefined }),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' } satisfies Partial<TRPCError>);
+    expect(prismaMocks.file.findFirst).not.toHaveBeenCalled();
+  });
+
+  test('rejects when no pending record matches the path + session', async () => {
+    prismaMocks.file.findFirst.mockResolvedValue(null);
+    await expect(
+      validateDirectUploadSession({ filePath: 'a/b.png', uploadSessionId: 'sess-1' }),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' } satisfies Partial<TRPCError>);
+
+    // Capability is keyed on path + session + unexpired + not orphaned.
+    const where = prismaMocks.file.findFirst.mock.calls[0][0].where;
+    expect(where).toMatchObject({
+      path: 'a/b.png',
+      uploadSessionId: 'sess-1',
+      isOrphaned: false,
+    });
+    expect(where.uploadExpiresAt.gt).toBeInstanceOf(Date);
+  });
+
+  test('rejects a record that is no longer accepting data', async () => {
+    prismaMocks.file.findFirst.mockResolvedValue({
+      id: 'f1',
+      uploadStatus: 'COMPLETED',
+    });
+    await expect(
+      validateDirectUploadSession({ filePath: 'a/b.png', uploadSessionId: 'sess-1' }),
+    ).rejects.toMatchObject({ code: 'BAD_REQUEST' } satisfies Partial<TRPCError>);
+  });
+
+  test('accepts a pending record for the exact path + session', async () => {
+    prismaMocks.file.findFirst.mockResolvedValue({
+      id: 'f1',
+      uploadStatus: 'PENDING',
+    });
+    await expect(
+      validateDirectUploadSession({ filePath: 'a/b.png', uploadSessionId: 'sess-1' }),
+    ).resolves.toMatchObject({ id: 'f1' });
+  });
+});

package/tests/unit/services/adminClass.test.ts

@@ -0,0 +1,102 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+const prismaMocks = vi.hoisted(() => ({
+  class: { findMany: vi.fn(), count: vi.fn(), findUnique: vi.fn() },
+  submission: { groupBy: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import {
+  getClassForAdmin,
+  listClassesForAdmin,
+} from '../../../src/services/adminClass.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('listClassesForAdmin', () => {
+  test('filters empty classes and exposes the last assignment timestamp', async () => {
+    const createdAt = new Date('2026-09-01T00:00:00Z');
+    prismaMocks.class.findMany.mockResolvedValue([
+      { id: 'c1', name: 'Bio', assignments: [{ createdAt }] },
+      { id: 'c2', name: 'Art', assignments: [] },
+    ]);
+    prismaMocks.class.count.mockResolvedValue(2);
+
+    const result = await listClassesForAdmin({
+      page: 0,
+      pageSize: 25,
+      membership: 'empty',
+      sort: 'students',
+    });
+
+    expect(prismaMocks.class.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { AND: [{ students: { none: {} } }] },
+        orderBy: [{ students: { _count: 'desc' } }, { name: 'asc' }],
+      }),
+    );
+    expect(result.items[0]).toMatchObject({ lastAssignmentAt: createdAt });
+    expect(result.items[1]).toMatchObject({ lastAssignmentAt: null });
+    expect(result.items[0]).not.toHaveProperty('assignments');
+  });
+});
+
+describe('getClassForAdmin', () => {
+  test('scopes roster submission counts to the class and flags suspected members', async () => {
+    prismaMocks.class.findUnique.mockResolvedValue({
+      id: 'c1',
+      name: 'Bio',
+      teachers: [
+        {
+          id: 't1',
+          username: 'ada',
+          email: 'ada@example.com',
+          verified: true,
+          _count: { teacherIn: 1, studentIn: 0, submissions: 0 },
+        },
+      ],
+      students: [
+        {
+          id: 's1',
+          username: 'devin-bot',
+          email: 'bot@riverside.edu',
+          verified: false,
+          _count: { teacherIn: 0, studentIn: 1, submissions: 4 },
+        },
+      ],
+      assignments: [],
+      announcements: [],
+      _count: { students: 1, teachers: 1 },
+    });
+    prismaMocks.submission.groupBy.mockResolvedValue([
+      { studentId: 's1', _count: { _all: 2 } },
+    ]);
+
+    const cls = await getClassForAdmin('c1');
+
+    expect(prismaMocks.submission.groupBy).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { assignment: { classId: 'c1' } } }),
+    );
+    expect(cls.students[0]).toMatchObject({
+      submissionsInClass: 2,
+      signals: { suspected: true },
+    });
+    expect(cls.teachers[0]).toMatchObject({
+      submissionsInClass: 0,
+      signals: { suspected: false },
+    });
+    expect(cls.suspectedMembers).toBe(1);
+  });
+
+  test('throws NOT_FOUND for a missing class', async () => {
+    prismaMocks.class.findUnique.mockResolvedValue(null);
+    await expect(getClassForAdmin('nope')).rejects.toMatchObject({
+      code: 'NOT_FOUND',
+    });
+  });
+});

package/tests/unit/services/adminSpam.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: { user: { count: vi.fn(), findMany: vi.fn() }, $queryRaw: vi.fn() },
+}));
+
+import {
+  classifyEmail,
+  classifyUser,
+  suspectedUserWhere,
+} from '../../../src/services/adminSpam.js';
+
+const activeCounts = { teacherIn: 1, studentIn: 0, submissions: 3 };
+
+afterEach(() => {
+  delete process.env.ADMIN_SPAM_DOMAINS;
+  delete process.env.ADMIN_SPAM_BOT_PATTERNS;
+});
+
+describe('classifyUser', () => {
+  test('flags the blocked riverside.edu domain and its subdomains', () => {
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'Jane@Riverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toEqual(['BLOCKED_DOMAIN']);
+
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'jane@mail.riverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).suspected,
+    ).toBe(true);
+  });
+
+  test('does not flag domains that merely end with the blocked one', () => {
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'jane@notriverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).suspected,
+    ).toBe(false);
+  });
+
+  test('flags bot accounts by username or email pattern', () => {
+    expect(
+      classifyUser({
+        username: 'devin-test-1',
+        email: 'real@school.org',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toContain('BOT_PATTERN');
+
+    expect(
+      classifyUser({
+        username: 'ada',
+        email: 'ada+devin@school.org',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toContain('BOT_PATTERN');
+  });
+
+  test('flags unverified accounts with no classes and no submissions', () => {
+    expect(
+      classifyUser({
+        username: 'ghost',
+        email: 'ghost@school.org',
+        verified: false,
+        _count: { teacherIn: 0, studentIn: 0, submissions: 0 },
+      }).reasons,
+    ).toEqual(['NEVER_VERIFIED_INACTIVE']);
+  });
+
+  test('leaves real accounts alone', () => {
+    expect(
+      classifyUser({
+        username: 'ada',
+        email: 'ada@school.org',
+        verified: true,
+        _count: activeCounts,
+      }),
+    ).toEqual({ suspected: false, reasons: [] });
+  });
+
+  test('rules are overridable through env', () => {
+    process.env.ADMIN_SPAM_DOMAINS = 'spam.test';
+    expect(classifyEmail('a@spam.test').suspected).toBe(true);
+    expect(classifyEmail('a@riverside.edu').suspected).toBe(false);
+  });
+});
+
+describe('suspectedUserWhere', () => {
+  test('never matches on the inactivity heuristic, only on rule matches', () => {
+    const where = JSON.stringify(suspectedUserWhere());
+    expect(where).toContain('riverside.edu');
+    expect(where).toContain('devin');
+    expect(where).not.toContain('verified');
+  });
+});

package/tests/unit/services/adminSql.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import {
+  assertReadOnlySql,
+  buildBoundedQuery,
+  serializeValue,
+} from '../../../src/services/adminSql.js';
+
+describe('assertReadOnlySql', () => {
+  it('accepts read statements and strips the trailing semicolon', () => {
+    expect(assertReadOnlySql('SELECT 1;')).toBe('SELECT 1');
+    expect(assertReadOnlySql('  with t as (select 1) select * from t  ')).toBe(
+      'with t as (select 1) select * from t',
+    );
+    expect(assertReadOnlySql('EXPLAIN SELECT * FROM "User"')).toBe('EXPLAIN SELECT * FROM "User"');
+  });
+
+  it('rejects writes, DDL and data-modifying CTEs', () => {
+    expect(() => assertReadOnlySql('DELETE FROM "User"')).toThrow(/only/i);
+    expect(() => assertReadOnlySql('DROP TABLE "User"')).toThrow(/only/i);
+    expect(() =>
+      assertReadOnlySql('WITH x AS (DELETE FROM "User" RETURNING id) SELECT * FROM x'),
+    ).toThrow(/DELETE/);
+    expect(() => assertReadOnlySql('SELECT 1; DROP TABLE "User"')).toThrow(/single statement/i);
+    expect(() => assertReadOnlySql('SELECT pg_sleep(60)')).toThrow(/PG_SLEEP/);
+    expect(() => assertReadOnlySql('   ')).toThrow(/empty/i);
+  });
+
+  it('does not flag keywords inside strings, comments or identifiers', () => {
+    expect(assertReadOnlySql("SELECT * FROM \"User\" WHERE username = 'delete-me'")).toContain(
+      'delete-me',
+    );
+    expect(assertReadOnlySql('SELECT 1 -- drop table users')).toBe('SELECT 1 -- drop table users');
+    expect(assertReadOnlySql('SELECT "settings" FROM "User" OFFSET 5')).toContain('OFFSET');
+  });
+});
+
+describe('buildBoundedQuery', () => {
+  it('wraps row-returning statements in a capped subquery', () => {
+    expect(buildBoundedQuery('SELECT * FROM "User"', 10)).toBe(
+      'SELECT * FROM (SELECT * FROM "User") AS admin_sql_console LIMIT 10',
+    );
+  });
+
+  it('leaves EXPLAIN and SHOW untouched', () => {
+    expect(buildBoundedQuery('EXPLAIN SELECT 1', 10)).toBe('EXPLAIN SELECT 1');
+    expect(buildBoundedQuery('SHOW statement_timeout', 10)).toBe('SHOW statement_timeout');
+  });
+});
+
+describe('serializeValue', () => {
+  it('converts values the JSON transformer cannot handle', () => {
+    expect(serializeValue(12n)).toBe('12');
+    expect(serializeValue(new Date('2026-01-02T03:04:05.000Z'))).toBe('2026-01-02T03:04:05.000Z');
+    expect(serializeValue({ nested: [1n, null] })).toEqual({ nested: ['1', null] });
+  });
+});