@studious-lms/server 1.4.1 → 1.4.2

package/tests/lib/cors.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, test } from 'vitest';
+import {
+  createCorsOriginMatcher,
+  isValidCorsOriginPatternList,
+  parseCorsOriginPatterns,
+  parseCorsOrigins,
+} from '../../src/lib/config/cors.js';
+
+describe('CORS configuration', () => {
+  test('parses comma-separated origins while trimming empty entries', () => {
+    expect(parseCorsOrigins(' https://one.example, ,https://two.example ')).toEqual([
+      'https://one.example',
+      'https://two.example',
+    ]);
+  });
+
+  test('normalizes configured origin URLs before matching', () => {
+    const { allowedOrigins, isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example/dashboard/',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example/some/path/, https://branch.example/',
+    });
+
+    expect(allowedOrigins).toContain('https://app.example');
+    expect(allowedOrigins).toContain('https://preview.example');
+    expect(allowedOrigins).toContain('https://branch.example');
+    expect(isAllowedOrigin('https://preview.example/')).toBe(true);
+    expect(isAllowedOrigin('https://branch.example/path')).toBe(true);
+  });
+
+  test('allows exact configured origins', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example,https://branch.example',
+    });
+
+    expect(isAllowedOrigin('https://www.studious.sh')).toBe(true);
+    expect(isAllowedOrigin('https://app.example')).toBe(true);
+    expect(isAllowedOrigin('https://preview.example')).toBe(true);
+    expect(isAllowedOrigin('https://branch.example')).toBe(true);
+  });
+
+  test('does not allow dev subdomains in production unless configured', () => {
+    const defaultProductionMatcher = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+    });
+    const configuredProductionMatcher = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://dev.studious.sh',
+    });
+
+    expect(defaultProductionMatcher.isAllowedOrigin('https://dev.studious.sh')).toBe(false);
+    expect(defaultProductionMatcher.isAllowedOrigin('https://www.dev.studious.sh')).toBe(false);
+    expect(configuredProductionMatcher.isAllowedOrigin('https://dev.studious.sh')).toBe(true);
+  });
+
+  test('allows narrow configured origin patterns', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      CORS_ALLOWED_ORIGIN_PATTERNS: '^https://studious-git-[a-z0-9-]+-studious-lms\\.vercel\\.app$',
+    });
+
+    expect(isAllowedOrigin('https://studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('https://malicious-studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(false);
+  });
+
+  test('rejects missing and unconfigured origins instead of using a fallback', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example',
+    });
+
+    expect(isAllowedOrigin()).toBe(false);
+    expect(isAllowedOrigin('https://evil.example')).toBe(false);
+    expect(isAllowedOrigin('http://localhost:3000')).toBe(false);
+  });
+
+  test('compiles configured regex patterns', () => {
+    expect(parseCorsOriginPatterns('^https://one\\.example$, ^https://two\\.example$').map((pattern) => pattern.source)).toEqual([
+      '^https:\\/\\/one\\.example$',
+      '^https:\\/\\/two\\.example$',
+    ]);
+  });
+
+  test('validates origin pattern syntax for env parsing', () => {
+    expect(isValidCorsOriginPatternList()).toBe(true);
+    expect(isValidCorsOriginPatternList('')).toBe(true);
+    expect(isValidCorsOriginPatternList('^https://one\\.example$')).toBe(true);
+    expect(isValidCorsOriginPatternList('(')).toBe(false);
+  });
+
+  test('rejects overly long origin patterns', () => {
+    expect(isValidCorsOriginPatternList(`^https://${'a'.repeat(250)}\\.example$`)).toBe(false);
+  });
+
+  test('rejects origin patterns with nested quantifiers', () => {
+    expect(isValidCorsOriginPatternList('^(a+)+$')).toBe(false);
+  });
+});

package/tests/pipelines/aiLabChat.test.ts

@@ -1,95 +1,75 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, test } from "vitest";
 
-const prismaMock = {
-  labChat: {
-    findUnique: vi.fn(),
-  },
-  message: {
-    update: vi.fn(),
-  },
-};
+import { sliceMessagesThroughAnchor } from "../../src/pipelines/aiLabChat.js";
 
-const pusherTriggerMock = vi.fn();
-const teacherChannelMock = vi.fn((classId: string) => `teacher-${classId}`);
-const loggerErrorMock = vi.fn();
-const consoleErrorMock = vi.spyOn(console, 'error').mockImplementation(() => {});
+describe("sliceMessagesThroughAnchor", () => {
+  const messages = [
+    {
+      id: "latest-teacher",
+      content: "Actually make it harder",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:04:00Z"),
+      sender: null,
+    },
+    {
+      id: "anchor-first",
+      content: "Create a quiz",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:03:00Z"),
+      sender: null,
+    },
+    {
+      id: "middle-ai",
+      content: "What topic should I cover?",
+      senderId: "ai-user",
+      createdAt: new Date("2026-04-08T12:02:00Z"),
+      sender: null,
+    },
+    {
+      id: "anchor-last",
+      content: "Earlier context",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:01:00Z"),
+      sender: null,
+    },
+  ];
 
-vi.mock('../../src/lib/prisma.js', () => ({
-  prisma: prismaMock,
-}));
-
-vi.mock('../../src/lib/pusher.js', () => ({
-  pusher: {
-    trigger: pusherTriggerMock,
-  },
-  teacherChannel: teacherChannelMock,
-}));
-
-vi.mock('../../src/utils/logger.js', () => ({
-  logger: {
-    error: loggerErrorMock,
-    info: vi.fn(),
-  },
-}));
-
-vi.mock('../../src/utils/aiUser.js', () => ({
-  getAIUserId: vi.fn(),
-  isAIUser: vi.fn(() => false),
-}));
-
-vi.mock('../../src/utils/inference.js', () => ({
-  inference: vi.fn(),
-  inferenceClient: {},
-  sendAIMessage: vi.fn(),
-}));
-
-vi.mock('../../src/lib/jsonConversion.js', () => ({
-  createPdf: vi.fn(),
-}));
-
-vi.mock('../../src/lib/googleCloudStorage.js', () => ({
-  bucket: {
-    file: vi.fn(),
-  },
-}));
-
-const { generateAndSendLabResponse } = await import('../../src/pipelines/aiLabChat.js');
+  test("drops messages newer than the anchor message", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-first")).toEqual([
+      messages[1],
+      messages[2],
+      messages[3],
+    ]);
+  });
 
-describe('generateAndSendLabResponse', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    consoleErrorMock.mockClear();
+  test("returns the first limit messages when no anchor is provided", () => {
+    expect(sliceMessagesThroughAnchor(messages, undefined, 2)).toEqual([
+      messages[0],
+      messages[1],
+    ]);
   });
 
-  it('broadcasts lab-response-failed even if marking the message as FAILED throws', async () => {
-    const generationError = new Error('boom');
-    const statusError = new Error('message missing');
+  test("returns the first limit messages when the anchor is not found", () => {
+    expect(sliceMessagesThroughAnchor(messages, "missing-anchor", 2)).toEqual([
+      messages[0],
+      messages[1],
+    ]);
+  });
 
-    prismaMock.labChat.findUnique.mockRejectedValueOnce(generationError);
-    prismaMock.message.update.mockRejectedValueOnce(statusError);
-    pusherTriggerMock.mockResolvedValueOnce(undefined);
+  test("returns an empty array when given no messages", () => {
+    expect(sliceMessagesThroughAnchor([], "missing-anchor")).toEqual([]);
+  });
 
-    await expect(
-      generateAndSendLabResponse('lab-chat-1', 'teacher prompt', {
-        classId: 'class-1',
-        messageId: 'message-1',
-      }),
-    ).rejects.toThrow(generationError);
+  test("returns the anchored slice when the anchor is the first eligible message", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-first", 2)).toEqual([
+      messages[1],
+      messages[2],
+    ]);
+  });
 
-    expect(prismaMock.message.update).toHaveBeenCalledWith({
-      where: { id: 'message-1' },
-      data: { status: 'FAILED' },
-    });
-    expect(teacherChannelMock).toHaveBeenCalledWith('class-1');
-    expect(pusherTriggerMock).toHaveBeenCalledWith('teacher-class-1', 'lab-response-failed', {
-      labChatId: 'lab-chat-1',
-      messageId: 'message-1',
-      error: 'AI response generation failed',
-    });
-    expect(loggerErrorMock).toHaveBeenCalledWith('Failed to set message status FAILED:', {
-      error: statusError,
-      labChatId: 'lab-chat-1',
-      messageId: 'message-1',
-    });
+  test("returns only the last message when the anchor is already the oldest", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-last", 3)).toEqual([
+      messages[3],
+    ]);
   });
 });

package/tests/routers/studentProgress.test.ts

@@ -53,16 +53,6 @@ describe("Student Progress Router", () => {
     const futureDueDate = new Date();
     futureDueDate.setDate(futureDueDate.getDate() + 2);
 
-    const futureAssignment = await user1Caller.assignment.create({
-      classId: testClass.id,
-      title: "Upcoming Quiz",
-      instructions: "Prepare for the upcoming quiz.",
-      dueDate: futureDueDate.toISOString(),
-      maxGrade: 100,
-      graded: true,
-      type: "QUIZ",
-    });
-
     const futureCompletedAssignment = await user1Caller.assignment.create({
       classId: testClass.id,
       title: "Completed Future Quiz",
@@ -110,17 +100,6 @@ describe("Student Progress Router", () => {
     expect(result.recommendations[0].assignmentId).toBe(assignment.id);
     expect(result.recommendations[0].reasons).toContain("Scored 50%");
 
-    const futureRecommendation = result.recommendations.find(
-      (recommendation) =>
-        recommendation.assignmentId === futureAssignment.id,
-    );
-    expect(futureRecommendation?.reasons).toContain(
-      "Upcoming graded assignment",
-    );
-    expect(futureRecommendation?.reasons).not.toContain(
-      "Awaiting grade or feedback",
-    );
-
     const completedFutureRecommendation = result.recommendations.find(
       (recommendation) =>
         recommendation.assignmentId === futureCompletedAssignment.id,
@@ -189,11 +168,7 @@ describe("Student Progress Router", () => {
     });
 
     expect(result.isFallback).toBe(true);
-    expect(result.message).toContain("current overall progress");
-    expect(result.message).toContain(
-      "not enough graded work to determine a recent trend",
-    );
-    expect(result.message).not.toContain("missing or low-scoring");
+    expect(result.message).toContain("current overall grade");
   });
 
   test("returns a flagged fallback chat response for empty model output", async () => {
@@ -208,11 +183,7 @@ describe("Student Progress Router", () => {
     });
 
     expect(result.isFallback).toBe(true);
-    expect(result.message).toContain("current overall progress");
-    expect(result.message).toContain(
-      "not enough graded work to determine a recent trend",
-    );
-    expect(result.message).not.toContain("missing or low-scoring");
+    expect(result.message).toContain("current overall grade");
   });
 
   test("prevents a student from chatting about another student's progress", async () => {

package/tests/utils/aiLabChatPrompt.test.ts

@@ -1,18 +1,126 @@
 import { describe, expect, test } from "vitest";
 
-import { buildLabChatSystemPrompt } from "../../src/pipelines/labChatPrompt";
+import {
+  buildLabChatResponseMessages,
+  buildLabChatSystemPrompt,
+} from "../../src/pipelines/labChatPrompt";
+import { labChatArrayFieldInstructions, labChatResponseFormat } from "../../src/pipelines/aiLabChatContract";
 
 describe("buildLabChatSystemPrompt", () => {
   test("requires arrays for worksheet and section structured output fields", () => {
     const prompt = buildLabChatSystemPrompt("Context");
 
-    expect(prompt).toContain(
-      '{ "text": string, "docs": null | array, "worksheetsToCreate": array, "sectionsToCreate": array, "assignmentsToCreate": null | array }',
-    );
-    expect(prompt).toContain('"worksheetsToCreate" must always be an array. Use [] when there are no worksheets to create.');
-    expect(prompt).toContain('"sectionsToCreate" must always be an array. Use [] when there are no sections to create.');
+    expect(prompt).toContain(labChatResponseFormat);
+    expect(prompt).toContain(labChatArrayFieldInstructions);
     expect(prompt).toContain('Do not return null for "worksheetsToCreate" or "sectionsToCreate".');
     expect(prompt).not.toContain('"worksheetsToCreate": null | array');
     expect(prompt).not.toContain('"sectionsToCreate": null | array');
   });
 });
+
+describe("buildLabChatResponseMessages", () => {
+  test("builds response messages from history without replaying the latest teacher turn", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          senderId: "teacher-1",
+          content: "Create a quiz on osmosis",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+        {
+          senderId: "ai-user",
+          content: "I can do that.",
+        },
+      ],
+      isAIUser: (senderId) => senderId === "ai-user",
+    });
+
+    const teacherTurns = messages.filter(
+      (message) =>
+        message.role === "user" &&
+        typeof message.content === "string" &&
+        message.content.includes("Create a quiz on osmosis"),
+    );
+
+    expect(teacherTurns).toHaveLength(1);
+    expect(messages.at(-2)).toMatchObject({
+      role: "developer",
+      content: expect.stringContaining("CLASS CONTEXT"),
+    });
+  });
+
+  test("sorts timestamped history into chronological order before prompt assembly", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          id: "assistant-later",
+          senderId: "ai-user",
+          content: "Second response",
+          createdAt: new Date("2026-04-08T12:02:00Z"),
+        },
+        {
+          id: "teacher-earlier",
+          senderId: "teacher-1",
+          content: "First request",
+          createdAt: new Date("2026-04-08T12:01:00Z"),
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+      ],
+      isAIUser: (senderId) => senderId === "ai-user",
+    });
+
+    expect(messages[1]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: First request",
+    });
+    expect(messages[2]).toMatchObject({
+      role: "assistant",
+      content: "Second response",
+    });
+  });
+
+  test("keeps original order among messages without timestamps", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          senderId: "teacher-1",
+          content: "First untimed request",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+        {
+          senderId: "teacher-1",
+          content: "Second untimed request",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+      ],
+      isAIUser: () => false,
+    });
+
+    expect(messages[1]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: First untimed request",
+    });
+    expect(messages[2]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: Second untimed request",
+    });
+  });
+});