@studious-lms/server 1.27.0 → 1.28.0

package/tests/unit/services/adminClass.test.ts

@@ -0,0 +1,102 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+const prismaMocks = vi.hoisted(() => ({
+  class: { findMany: vi.fn(), count: vi.fn(), findUnique: vi.fn() },
+  submission: { groupBy: vi.fn() },
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import {
+  getClassForAdmin,
+  listClassesForAdmin,
+} from '../../../src/services/adminClass.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('listClassesForAdmin', () => {
+  test('filters empty classes and exposes the last assignment timestamp', async () => {
+    const createdAt = new Date('2026-09-01T00:00:00Z');
+    prismaMocks.class.findMany.mockResolvedValue([
+      { id: 'c1', name: 'Bio', assignments: [{ createdAt }] },
+      { id: 'c2', name: 'Art', assignments: [] },
+    ]);
+    prismaMocks.class.count.mockResolvedValue(2);
+
+    const result = await listClassesForAdmin({
+      page: 0,
+      pageSize: 25,
+      membership: 'empty',
+      sort: 'students',
+    });
+
+    expect(prismaMocks.class.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { AND: [{ students: { none: {} } }] },
+        orderBy: [{ students: { _count: 'desc' } }, { name: 'asc' }],
+      }),
+    );
+    expect(result.items[0]).toMatchObject({ lastAssignmentAt: createdAt });
+    expect(result.items[1]).toMatchObject({ lastAssignmentAt: null });
+    expect(result.items[0]).not.toHaveProperty('assignments');
+  });
+});
+
+describe('getClassForAdmin', () => {
+  test('scopes roster submission counts to the class and flags suspected members', async () => {
+    prismaMocks.class.findUnique.mockResolvedValue({
+      id: 'c1',
+      name: 'Bio',
+      teachers: [
+        {
+          id: 't1',
+          username: 'ada',
+          email: 'ada@example.com',
+          verified: true,
+          _count: { teacherIn: 1, studentIn: 0, submissions: 0 },
+        },
+      ],
+      students: [
+        {
+          id: 's1',
+          username: 'devin-bot',
+          email: 'bot@riverside.edu',
+          verified: false,
+          _count: { teacherIn: 0, studentIn: 1, submissions: 4 },
+        },
+      ],
+      assignments: [],
+      announcements: [],
+      _count: { students: 1, teachers: 1 },
+    });
+    prismaMocks.submission.groupBy.mockResolvedValue([
+      { studentId: 's1', _count: { _all: 2 } },
+    ]);
+
+    const cls = await getClassForAdmin('c1');
+
+    expect(prismaMocks.submission.groupBy).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { assignment: { classId: 'c1' } } }),
+    );
+    expect(cls.students[0]).toMatchObject({
+      submissionsInClass: 2,
+      signals: { suspected: true },
+    });
+    expect(cls.teachers[0]).toMatchObject({
+      submissionsInClass: 0,
+      signals: { suspected: false },
+    });
+    expect(cls.suspectedMembers).toBe(1);
+  });
+
+  test('throws NOT_FOUND for a missing class', async () => {
+    prismaMocks.class.findUnique.mockResolvedValue(null);
+    await expect(getClassForAdmin('nope')).rejects.toMatchObject({
+      code: 'NOT_FOUND',
+    });
+  });
+});

package/tests/unit/services/adminSpam.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: { user: { count: vi.fn(), findMany: vi.fn() }, $queryRaw: vi.fn() },
+}));
+
+import {
+  classifyEmail,
+  classifyUser,
+  suspectedUserWhere,
+} from '../../../src/services/adminSpam.js';
+
+const activeCounts = { teacherIn: 1, studentIn: 0, submissions: 3 };
+
+afterEach(() => {
+  delete process.env.ADMIN_SPAM_DOMAINS;
+  delete process.env.ADMIN_SPAM_BOT_PATTERNS;
+});
+
+describe('classifyUser', () => {
+  test('flags the blocked riverside.edu domain and its subdomains', () => {
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'Jane@Riverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toEqual(['BLOCKED_DOMAIN']);
+
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'jane@mail.riverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).suspected,
+    ).toBe(true);
+  });
+
+  test('does not flag domains that merely end with the blocked one', () => {
+    expect(
+      classifyUser({
+        username: 'jane',
+        email: 'jane@notriverside.edu',
+        verified: true,
+        _count: activeCounts,
+      }).suspected,
+    ).toBe(false);
+  });
+
+  test('flags bot accounts by username or email pattern', () => {
+    expect(
+      classifyUser({
+        username: 'devin-test-1',
+        email: 'real@school.org',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toContain('BOT_PATTERN');
+
+    expect(
+      classifyUser({
+        username: 'ada',
+        email: 'ada+devin@school.org',
+        verified: true,
+        _count: activeCounts,
+      }).reasons,
+    ).toContain('BOT_PATTERN');
+  });
+
+  test('flags unverified accounts with no classes and no submissions', () => {
+    expect(
+      classifyUser({
+        username: 'ghost',
+        email: 'ghost@school.org',
+        verified: false,
+        _count: { teacherIn: 0, studentIn: 0, submissions: 0 },
+      }).reasons,
+    ).toEqual(['NEVER_VERIFIED_INACTIVE']);
+  });
+
+  test('leaves real accounts alone', () => {
+    expect(
+      classifyUser({
+        username: 'ada',
+        email: 'ada@school.org',
+        verified: true,
+        _count: activeCounts,
+      }),
+    ).toEqual({ suspected: false, reasons: [] });
+  });
+
+  test('rules are overridable through env', () => {
+    process.env.ADMIN_SPAM_DOMAINS = 'spam.test';
+    expect(classifyEmail('a@spam.test').suspected).toBe(true);
+    expect(classifyEmail('a@riverside.edu').suspected).toBe(false);
+  });
+});
+
+describe('suspectedUserWhere', () => {
+  test('never matches on the inactivity heuristic, only on rule matches', () => {
+    const where = JSON.stringify(suspectedUserWhere());
+    expect(where).toContain('riverside.edu');
+    expect(where).toContain('devin');
+    expect(where).not.toContain('verified');
+  });
+});

package/tests/unit/services/adminSql.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import {
+  assertReadOnlySql,
+  buildBoundedQuery,
+  serializeValue,
+} from '../../../src/services/adminSql.js';
+
+describe('assertReadOnlySql', () => {
+  it('accepts read statements and strips the trailing semicolon', () => {
+    expect(assertReadOnlySql('SELECT 1;')).toBe('SELECT 1');
+    expect(assertReadOnlySql('  with t as (select 1) select * from t  ')).toBe(
+      'with t as (select 1) select * from t',
+    );
+    expect(assertReadOnlySql('EXPLAIN SELECT * FROM "User"')).toBe('EXPLAIN SELECT * FROM "User"');
+  });
+
+  it('rejects writes, DDL and data-modifying CTEs', () => {
+    expect(() => assertReadOnlySql('DELETE FROM "User"')).toThrow(/only/i);
+    expect(() => assertReadOnlySql('DROP TABLE "User"')).toThrow(/only/i);
+    expect(() =>
+      assertReadOnlySql('WITH x AS (DELETE FROM "User" RETURNING id) SELECT * FROM x'),
+    ).toThrow(/DELETE/);
+    expect(() => assertReadOnlySql('SELECT 1; DROP TABLE "User"')).toThrow(/single statement/i);
+    expect(() => assertReadOnlySql('SELECT pg_sleep(60)')).toThrow(/PG_SLEEP/);
+    expect(() => assertReadOnlySql('   ')).toThrow(/empty/i);
+  });
+
+  it('does not flag keywords inside strings, comments or identifiers', () => {
+    expect(assertReadOnlySql("SELECT * FROM \"User\" WHERE username = 'delete-me'")).toContain(
+      'delete-me',
+    );
+    expect(assertReadOnlySql('SELECT 1 -- drop table users')).toBe('SELECT 1 -- drop table users');
+    expect(assertReadOnlySql('SELECT "settings" FROM "User" OFFSET 5')).toContain('OFFSET');
+  });
+});
+
+describe('buildBoundedQuery', () => {
+  it('wraps row-returning statements in a capped subquery', () => {
+    expect(buildBoundedQuery('SELECT * FROM "User"', 10)).toBe(
+      'SELECT * FROM (SELECT * FROM "User") AS admin_sql_console LIMIT 10',
+    );
+  });
+
+  it('leaves EXPLAIN and SHOW untouched', () => {
+    expect(buildBoundedQuery('EXPLAIN SELECT 1', 10)).toBe('EXPLAIN SELECT 1');
+    expect(buildBoundedQuery('SHOW statement_timeout', 10)).toBe('SHOW statement_timeout');
+  });
+});
+
+describe('serializeValue', () => {
+  it('converts values the JSON transformer cannot handle', () => {
+    expect(serializeValue(12n)).toBe('12');
+    expect(serializeValue(new Date('2026-01-02T03:04:05.000Z'))).toBe('2026-01-02T03:04:05.000Z');
+    expect(serializeValue({ nested: [1n, null] })).toEqual({ nested: ['1', null] });
+  });
+});

package/tests/unit/services/adminTelemetry.test.ts

@@ -0,0 +1,47 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+const prismaMocks = vi.hoisted(() => ({
+  $queryRaw: vi.fn(),
+}));
+
+vi.mock('../../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+import { getActivitySeriesForAdmin } from '../../../src/services/adminTelemetry.js';
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('getActivitySeriesForAdmin', () => {
+  test('zero-fills every day in the window and keeps them ordered', async () => {
+    prismaMocks.$queryRaw.mockResolvedValue([]);
+
+    const { points } = await getActivitySeriesForAdmin({ days: 5 });
+
+    expect(points).toHaveLength(5);
+    expect(points.map((p) => p.date)).toEqual([...points.map((p) => p.date)].sort());
+    expect(points.every((p) => p.signups === 0 && p.logins === 0)).toBe(true);
+  });
+
+  test('maps counted rows onto their day', async () => {
+    const today = new Date();
+    today.setUTCHours(0, 0, 0, 0);
+    const key = today.toISOString().slice(0, 10);
+
+    // Same shape for every series query; only signups are asserted.
+    prismaMocks.$queryRaw.mockResolvedValue([{ day: today, total: 3n }]);
+
+    const { points } = await getActivitySeriesForAdmin({ days: 3 });
+    const todayPoint = points.find((p) => p.date === key);
+
+    expect(todayPoint).toMatchObject({ signups: 3, submissions: 3 });
+  });
+
+  test('clamps the window to at most 90 days', async () => {
+    prismaMocks.$queryRaw.mockResolvedValue([]);
+    const { points } = await getActivitySeriesForAdmin({ days: 500 });
+    expect(points).toHaveLength(90);
+  });
+});

package/tests/unit/services/adminUser.test.ts

@@ -3,6 +3,7 @@ import { TRPCError } from '@trpc/server';
 
 const prismaMocks = vi.hoisted(() => ({
   user: { findUnique: vi.fn() },
+  class: { findMany: vi.fn() },
 }));
 
 vi.mock('../../../src/lib/prisma.js', () => ({
@@ -13,6 +14,7 @@ import { getUserForAdmin } from '../../../src/services/adminUser.js';
 
 beforeEach(() => {
   vi.clearAllMocks();
+  prismaMocks.class.findMany.mockResolvedValue([]);
 });
 
 describe('getUserForAdmin', () => {

package/tests/unit/services/visualization.test.ts

@@ -0,0 +1,130 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { TRPCError } from "@trpc/server";
+
+const { prismaMocks, inferenceMock, teacherMock } = vi.hoisted(() => ({
+  prismaMocks: {
+    class: { findUnique: vi.fn() },
+    visualization: {
+      findFirst: vi.fn(),
+      findMany: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+    courseModuleItem: { deleteMany: vi.fn() },
+    $transaction: vi.fn(),
+  },
+  inferenceMock: vi.fn(),
+  teacherMock: vi.fn(),
+}));
+
+vi.mock("../../../src/lib/prisma.js", () => ({ prisma: prismaMocks }));
+vi.mock("../../../src/utils/inference.js", () => ({ inference: inferenceMock }));
+vi.mock("../../../src/models/class.js", () => ({ isTeacherInClass: teacherMock }));
+
+import {
+  createVisualization,
+  deleteVisualization,
+  getVisualization,
+  listVisualizations,
+  reviseVisualizationRecord,
+} from "../../../src/services/visualization.js";
+
+const HTML = "<!DOCTYPE html><html><body><canvas></canvas></body></html>";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  prismaMocks.class.findUnique.mockResolvedValue({
+    name: "Physics 10",
+    subject: "Physics",
+    schoolId: "s1",
+  });
+});
+
+describe("listVisualizations / getVisualization", () => {
+  test("students only see published visualisations", async () => {
+    teacherMock.mockResolvedValue(null);
+    prismaMocks.visualization.findMany.mockResolvedValue([]);
+    await listVisualizations("u1", "c1");
+    expect(prismaMocks.visualization.findMany.mock.calls[0][0].where).toEqual({
+      classId: "c1",
+      published: true,
+    });
+  });
+
+  test("teachers see drafts too", async () => {
+    teacherMock.mockResolvedValue({ id: "c1" });
+    prismaMocks.visualization.findMany.mockResolvedValue([]);
+    await listVisualizations("t1", "c1");
+    expect(prismaMocks.visualization.findMany.mock.calls[0][0].where).toEqual({
+      classId: "c1",
+    });
+  });
+
+  test("students get NOT_FOUND for drafts", async () => {
+    teacherMock.mockResolvedValue(null);
+    prismaMocks.visualization.findFirst.mockResolvedValue(null);
+    await expect(getVisualization("u1", "c1", "v1")).rejects.toBeInstanceOf(TRPCError);
+    expect(prismaMocks.visualization.findFirst.mock.calls[0][0].where).toEqual({
+      id: "v1",
+      classId: "c1",
+      published: true,
+    });
+  });
+});
+
+describe("createVisualization", () => {
+  test("generates via inference and stores an unpublished draft", async () => {
+    inferenceMock.mockResolvedValue({ title: "Projectile motion", html: HTML });
+    prismaMocks.visualization.create.mockImplementation(({ data }) => ({ id: "v1", ...data }));
+
+    const viz = await createVisualization("t1", { classId: "c1", prompt: "projectile sliders" });
+
+    expect(inferenceMock).toHaveBeenCalledTimes(1);
+    const [messages, , options] = inferenceMock.mock.calls[0];
+    expect(messages[1].content).toContain("projectile sliders");
+    expect(messages[1].content).toContain("Subject: Physics");
+    expect(options.attribution).toEqual({ userId: "t1", classId: "c1", schoolId: "s1" });
+    expect(viz).toMatchObject({ title: "Projectile motion", html: HTML, createdById: "t1" });
+    expect(prismaMocks.visualization.create.mock.calls[0][0].data.published).toBeUndefined();
+  });
+
+  test("rejects output that isn't an HTML document", async () => {
+    inferenceMock.mockResolvedValue({ title: "x", html: "just text" });
+    await expect(
+      createVisualization("t1", { classId: "c1", prompt: "anything" }),
+    ).rejects.toMatchObject({ code: "INTERNAL_SERVER_ERROR" });
+    expect(prismaMocks.visualization.create).not.toHaveBeenCalled();
+  });
+});
+
+describe("reviseVisualizationRecord", () => {
+  test("sends current html and saves the revision", async () => {
+    prismaMocks.visualization.findFirst.mockResolvedValue({
+      id: "v1",
+      title: "Waves",
+      html: HTML,
+      prompt: "waves",
+    });
+    inferenceMock.mockResolvedValue({ title: "Waves", html: HTML.replace("canvas", "svg") });
+    prismaMocks.visualization.update.mockResolvedValue({ id: "v1" });
+
+    await reviseVisualizationRecord("t1", { classId: "c1", id: "v1", instruction: "add damping" });
+
+    expect(inferenceMock.mock.calls[0][0][1].content).toContain(HTML);
+    expect(prismaMocks.visualization.update.mock.calls[0][0].data.prompt).toBe(
+      "waves\n\nadd damping",
+    );
+  });
+});
+
+describe("deleteVisualization", () => {
+  test("removes attached module items", async () => {
+    prismaMocks.visualization.findFirst.mockResolvedValue({ id: "v1" });
+    prismaMocks.$transaction.mockResolvedValue([]);
+    await deleteVisualization({ classId: "c1", id: "v1" });
+    expect(prismaMocks.courseModuleItem.deleteMany).toHaveBeenCalledWith({
+      where: { itemType: "VISUALIZATION", itemId: "v1" },
+    });
+  });
+});

package/tests/unit/utils/sentryTrpc.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+import { isReportableTrpcError } from '../../../src/utils/sentryTrpc.js';
+
+describe('isReportableTrpcError', () => {
+  it('reports server-side failures', () => {
+    expect(isReportableTrpcError({ code: 'INTERNAL_SERVER_ERROR' })).toBe(true);
+    expect(isReportableTrpcError({ code: 'TIMEOUT' })).toBe(true);
+  });
+
+  it('ignores expected client errors', () => {
+    for (const code of ['BAD_REQUEST', 'UNAUTHORIZED', 'FORBIDDEN', 'NOT_FOUND'] as const) {
+      expect(isReportableTrpcError({ code })).toBe(false);
+    }
+  });
+});