@studious-lms/server 1.26.0 → 1.28.0

package/tests/unit/services/adminTelemetry.test.ts

@@ -0,0 +1,47 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+const prismaMocks = vi.hoisted(() => ({
+  $queryRaw: vi.fn(),
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import { getActivitySeriesForAdmin } from '../../../src/services/adminTelemetry.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('getActivitySeriesForAdmin', () => {
+  test('zero-fills every day in the window and keeps them ordered', async () => {
+    prismaMocks.$queryRaw.mockResolvedValue([]);
+
+    const { points } = await getActivitySeriesForAdmin({ days: 5 });
+
+    expect(points).toHaveLength(5);
+    expect(points.map((p) => p.date)).toEqual([...points.map((p) => p.date)].sort());
+    expect(points.every((p) => p.signups === 0 && p.logins === 0)).toBe(true);
+  });
+
+  test('maps counted rows onto their day', async () => {
+    const today = new Date();
+    today.setUTCHours(0, 0, 0, 0);
+    const key = today.toISOString().slice(0, 10);
+
+    // Same shape for every series query; only signups are asserted.
+    prismaMocks.$queryRaw.mockResolvedValue([{ day: today, total: 3n }]);
+
+    const { points } = await getActivitySeriesForAdmin({ days: 3 });
+    const todayPoint = points.find((p) => p.date === key);
+
+    expect(todayPoint).toMatchObject({ signups: 3, submissions: 3 });
+  });
+
+  test('clamps the window to at most 90 days', async () => {
+    prismaMocks.$queryRaw.mockResolvedValue([]);
+    const { points } = await getActivitySeriesForAdmin({ days: 500 });
+    expect(points).toHaveLength(90);
+  });
+});

package/tests/unit/services/adminUser.test.ts

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const prismaMocks = vi.hoisted(() => ({
+  user: { findUnique: vi.fn() },
+  class: { findMany: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import { getUserForAdmin } from '../../../src/services/adminUser.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  prismaMocks.class.findMany.mockResolvedValue([]);
+});
+
+describe('getUserForAdmin', () => {
+  test('does not select session ids (they are bearer tokens) and only returns AUTH sessions', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue({
+      id: 'user-1',
+      username: 'ada',
+      email: 'ada@example.com',
+      verified: true,
+      termsAcceptedAt: null,
+      termsVersion: null,
+      profile: null,
+      school: null,
+      schoolMemberships: [],
+      sessions: [
+        {
+          type: 'AUTH',
+          createdAt: new Date('2026-08-01T00:00:00Z'),
+          expiresAt: new Date('2026-09-01T00:00:00Z'),
+        },
+      ],
+      _count: {
+        teacherIn: 0,
+        studentIn: 0,
+        sessions: 1,
+        submissions: 0,
+        files: 0,
+      },
+    });
+
+    const user = await getUserForAdmin('user-1');
+
+    expect(prismaMocks.user.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'user-1' },
+        select: expect.objectContaining({
+          sessions: {
+            where: { type: 'AUTH' },
+            orderBy: { createdAt: 'desc' },
+            take: 10,
+            select: { type: true, createdAt: true, expiresAt: true },
+          },
+          _count: {
+            select: expect.objectContaining({
+              sessions: { where: { type: 'AUTH' } },
+            }),
+          },
+        }),
+      }),
+    );
+    expect(user.sessions[0]).not.toHaveProperty('id');
+  });
+
+  test('throws NOT_FOUND when the user is missing', async () => {
+    prismaMocks.user.findUnique.mockResolvedValue(null);
+    await expect(getUserForAdmin('missing')).rejects.toMatchObject({
+      code: 'NOT_FOUND',
+    } satisfies Partial<TRPCError>);
+  });
+});

package/tests/unit/services/visualization.test.ts

@@ -0,0 +1,130 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { TRPCError } from "@trpc/server";
+
+const { prismaMocks, inferenceMock, teacherMock } = vi.hoisted(() => ({
+  prismaMocks: {
+    class: { findUnique: vi.fn() },
+    visualization: {
+      findFirst: vi.fn(),
+      findMany: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+    courseModuleItem: { deleteMany: vi.fn() },
+    $transaction: vi.fn(),
+  },
+  inferenceMock: vi.fn(),
+  teacherMock: vi.fn(),
+}));
+
+vi.mock("../../../src/lib/prisma.js", () => ({ prisma: prismaMocks }));
+vi.mock("../../../src/utils/inference.js", () => ({ inference: inferenceMock }));
+vi.mock("../../../src/models/class.js", () => ({ isTeacherInClass: teacherMock }));
+
+import {
+  createVisualization,
+  deleteVisualization,
+  getVisualization,
+  listVisualizations,
+  reviseVisualizationRecord,
+} from "../../../src/services/visualization.js";
+
+const HTML = "<!DOCTYPE html><html><body><canvas></canvas></body></html>";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  prismaMocks.class.findUnique.mockResolvedValue({
+    name: "Physics 10",
+    subject: "Physics",
+    schoolId: "s1",
+  });
+});
+
+describe("listVisualizations / getVisualization", () => {
+  test("students only see published visualisations", async () => {
+    teacherMock.mockResolvedValue(null);
+    prismaMocks.visualization.findMany.mockResolvedValue([]);
+    await listVisualizations("u1", "c1");
+    expect(prismaMocks.visualization.findMany.mock.calls[0][0].where).toEqual({
+      classId: "c1",
+      published: true,
+    });
+  });
+
+  test("teachers see drafts too", async () => {
+    teacherMock.mockResolvedValue({ id: "c1" });
+    prismaMocks.visualization.findMany.mockResolvedValue([]);
+    await listVisualizations("t1", "c1");
+    expect(prismaMocks.visualization.findMany.mock.calls[0][0].where).toEqual({
+      classId: "c1",
+    });
+  });
+
+  test("students get NOT_FOUND for drafts", async () => {
+    teacherMock.mockResolvedValue(null);
+    prismaMocks.visualization.findFirst.mockResolvedValue(null);
+    await expect(getVisualization("u1", "c1", "v1")).rejects.toBeInstanceOf(TRPCError);
+    expect(prismaMocks.visualization.findFirst.mock.calls[0][0].where).toEqual({
+      id: "v1",
+      classId: "c1",
+      published: true,
+    });
+  });
+});
+
+describe("createVisualization", () => {
+  test("generates via inference and stores an unpublished draft", async () => {
+    inferenceMock.mockResolvedValue({ title: "Projectile motion", html: HTML });
+    prismaMocks.visualization.create.mockImplementation(({ data }) => ({ id: "v1", ...data }));
+
+    const viz = await createVisualization("t1", { classId: "c1", prompt: "projectile sliders" });
+
+    expect(inferenceMock).toHaveBeenCalledTimes(1);
+    const [messages, , options] = inferenceMock.mock.calls[0];
+    expect(messages[1].content).toContain("projectile sliders");
+    expect(messages[1].content).toContain("Subject: Physics");
+    expect(options.attribution).toEqual({ userId: "t1", classId: "c1", schoolId: "s1" });
+    expect(viz).toMatchObject({ title: "Projectile motion", html: HTML, createdById: "t1" });
+    expect(prismaMocks.visualization.create.mock.calls[0][0].data.published).toBeUndefined();
+  });
+
+  test("rejects output that isn't an HTML document", async () => {
+    inferenceMock.mockResolvedValue({ title: "x", html: "just text" });
+    await expect(
+      createVisualization("t1", { classId: "c1", prompt: "anything" }),
+    ).rejects.toMatchObject({ code: "INTERNAL_SERVER_ERROR" });
+    expect(prismaMocks.visualization.create).not.toHaveBeenCalled();
+  });
+});
+
+describe("reviseVisualizationRecord", () => {
+  test("sends current html and saves the revision", async () => {
+    prismaMocks.visualization.findFirst.mockResolvedValue({
+      id: "v1",
+      title: "Waves",
+      html: HTML,
+      prompt: "waves",
+    });
+    inferenceMock.mockResolvedValue({ title: "Waves", html: HTML.replace("canvas", "svg") });
+    prismaMocks.visualization.update.mockResolvedValue({ id: "v1" });
+
+    await reviseVisualizationRecord("t1", { classId: "c1", id: "v1", instruction: "add damping" });
+
+    expect(inferenceMock.mock.calls[0][0][1].content).toContain(HTML);
+    expect(prismaMocks.visualization.update.mock.calls[0][0].data.prompt).toBe(
+      "waves\n\nadd damping",
+    );
+  });
+});
+
+describe("deleteVisualization", () => {
+  test("removes attached module items", async () => {
+    prismaMocks.visualization.findFirst.mockResolvedValue({ id: "v1" });
+    prismaMocks.$transaction.mockResolvedValue([]);
+    await deleteVisualization({ classId: "c1", id: "v1" });
+    expect(prismaMocks.courseModuleItem.deleteMany).toHaveBeenCalledWith({
+      where: { itemType: "VISUALIZATION", itemId: "v1" },
+    });
+  });
+});

package/tests/unit/utils/adminPanelAccess.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from 'vitest';
+import { TRPCError } from '@trpc/server';
+import type { Request } from 'express';
+import { assertAdminPanelPassword } from '../../../src/utils/adminPanelAccess.js';
+
+function reqWithHeader(value: string | string[] | undefined): Request {
+  return { headers: { 'x-admin-password': value } } as unknown as Request;
+}
+
+describe('assertAdminPanelPassword', () => {
+  test('accepts the configured admin password header', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader('alan6767'))).not.toThrow();
+  });
+
+  test('rejects a missing or wrong header with FORBIDDEN', () => {
+    expect(() => assertAdminPanelPassword(reqWithHeader(undefined))).toThrow(
+      TRPCError,
+    );
+    try {
+      assertAdminPanelPassword(reqWithHeader('nope'));
+    } catch (error) {
+      expect(error).toBeInstanceOf(TRPCError);
+      expect((error as TRPCError).code).toBe('FORBIDDEN');
+    }
+  });
+});

package/tests/unit/utils/sentryTrpc.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+import { isReportableTrpcError } from '../../../src/utils/sentryTrpc.js';
+
+describe('isReportableTrpcError', () => {
+  it('reports server-side failures', () => {
+    expect(isReportableTrpcError({ code: 'INTERNAL_SERVER_ERROR' })).toBe(true);
+    expect(isReportableTrpcError({ code: 'TIMEOUT' })).toBe(true);
+  });
+
+  it('ignores expected client errors', () => {
+    for (const code of ['BAD_REQUEST', 'UNAUTHORIZED', 'FORBIDDEN', 'NOT_FOUND'] as const) {
+      expect(isReportableTrpcError({ code })).toBe(false);
+    }
+  });
+});