@studious-lms/server 1.4.1 → 1.4.3

package/src/utils/inference.ts

@@ -7,10 +7,9 @@ import { prisma } from '../lib/prisma.js';
 import { chatChannel, pusher } from '../lib/pusher.js';
 import { ensureAIUserExists, getAIUserId } from './aiUser.js';
 import { env } from '../lib/config/env.js';
+import { Prisma } from '@prisma/client';
 import { ZodSchema } from 'zod';
-import { zodTextFormat } from "openai/helpers/zod";
-
-
+import { zodTextFormat } from 'openai/helpers/zod';
 
 export const inferenceClient = new OpenAI({
   apiKey: env.INFERENCE_API_KEY,
@@ -19,6 +18,38 @@ export const inferenceClient = new OpenAI({
 
 export const openAIClient = new OpenAI();
 
+const DEFAULT_INFERENCE_MODEL = 'gpt-5-nano';
+
+type InferenceMessage = {
+  role: 'user' | 'assistant' | 'system';
+  content: string;
+};
+
+export interface InferenceOptions {
+  reason?: string;
+  metadata?: Prisma.InputJsonValue;
+  model?: string;
+  temperature?: number;
+  maxTokens?: number;
+}
+
+interface InferenceUsage {
+  promptTokens?: number;
+  completionTokens?: number;
+  totalTokens?: number;
+}
+
+interface InferenceAuditLog {
+  model: string;
+  operation: 'chat.completions' | 'responses.parse';
+  success: boolean;
+  estimatedInputTokens: number;
+  reason: string;
+  metadata?: Prisma.InputJsonValue;
+  usage?: InferenceUsage;
+  error?: unknown;
+}
+
 // Types for lab chat context
 export interface LabChatContext {
   subject: string;
@@ -39,6 +70,116 @@ export interface InferenceResponse {
   finishReason: string;
 }
 
+function normalizeInferenceInput(
+  content: string | OpenAI.Chat.Completions.ChatCompletionMessageParam[],
+): InferenceMessage[] {
+  if (typeof content === 'string') {
+    return [{ role: 'user', content }];
+  }
+
+  return content.map((message) => ({
+    role: message.role as InferenceMessage['role'],
+    content: typeof message.content === 'string' ? message.content : JSON.stringify(message.content),
+  }));
+}
+
+function getInferenceReason(options?: InferenceOptions) {
+  return options?.reason?.trim() || 'unspecified';
+}
+
+function serializeInferenceError(error: unknown) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+
+  if (typeof error === 'string') {
+    return error;
+  }
+
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return 'Unknown inference error';
+  }
+}
+
+async function logInferenceUsage({
+  model,
+  operation,
+  success,
+  estimatedInputTokens,
+  reason,
+  metadata,
+  usage,
+  error,
+}: InferenceAuditLog) {
+  const context = {
+    reason,
+    model,
+    operation,
+    success,
+    estimatedInputTokens,
+    promptTokens: usage?.promptTokens,
+    completionTokens: usage?.completionTokens,
+    totalTokens: usage?.totalTokens,
+    metadata,
+    ...(error ? { error: serializeInferenceError(error) } : {}),
+  };
+
+  try {
+    await prisma.aiUsageLog.create({
+      data: {
+        reason,
+        model,
+        operation,
+        success,
+        estimatedInputTokens,
+        promptTokens: usage?.promptTokens,
+        completionTokens: usage?.completionTokens,
+        totalTokens: usage?.totalTokens,
+        ...(metadata !== undefined ? { metadata } : {}),
+        ...(error ? { error: serializeInferenceError(error) } : {}),
+      },
+    });
+  } catch (loggingError) {
+    logger.error('Failed to persist AI usage log', {
+      ...context,
+      loggingError: serializeInferenceError(loggingError),
+    });
+    return;
+  }
+
+  logger.info('AI usage logged', context);
+}
+
+function getChatCompletionUsage(completion: {
+  usage?: {
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    total_tokens?: number;
+  };
+}): InferenceUsage {
+  return {
+    promptTokens: completion.usage?.prompt_tokens,
+    completionTokens: completion.usage?.completion_tokens,
+    totalTokens: completion.usage?.total_tokens,
+  };
+}
+
+function getResponseUsage(completion: {
+  usage?: {
+    input_tokens?: number;
+    output_tokens?: number;
+    total_tokens?: number;
+  };
+}): InferenceUsage {
+  return {
+    promptTokens: completion.usage?.input_tokens,
+    completionTokens: completion.usage?.output_tokens,
+    totalTokens: completion.usage?.total_tokens,
+  };
+}
+
 /**
  * Centralized function to send AI messages to conversations
  * Handles database storage and Pusher broadcasting
@@ -65,10 +206,8 @@ export async function sendAIMessage(
   createdAt: Date;
   meta?: Record<string, any>;
 }> {
-  // Ensure AI user exists
   await ensureAIUserExists();
 
-  // Create message in database
   const aiMessage = await prisma.message.create({
     data: {
       content,
@@ -94,17 +233,15 @@ export async function sendAIMessage(
     contentLength: content.length,
   });
 
-  // Prepare sender info
   const senderInfo = {
     id: getAIUserId(),
     username: 'Newton_AI',
     profile: {
-      displayName: "Newton AI",
+      displayName: 'Newton AI',
       profilePicture: options.customSender?.profilePicture || null,
     },
   };
 
-  // Broadcast via Pusher
   try {
     await pusher.trigger(chatChannel(conversationId), 'new-message', {
       id: aiMessage.id,
@@ -115,7 +252,7 @@ export async function sendAIMessage(
       sender: senderInfo,
       mentionedUserIds: [],
       meta: aiMessage.meta,
-      attachments: aiMessage.attachments.map(attachment => ({
+      attachments: aiMessage.attachments.map((attachment) => ({
         id: attachment.id,
         attachmentId: attachment.id,
         name: attachment.name,
@@ -140,132 +277,89 @@ export async function sendAIMessage(
 
 export async function inference<T>(
   content: string | OpenAI.Chat.Completions.ChatCompletionMessageParam[],
-  format?: ZodSchema
+  format?: ZodSchema,
+  options?: InferenceOptions,
 ): Promise<T> {
-  try {
+  const input = normalizeInferenceInput(content);
+  const reason = getInferenceReason(options);
+  const model = options?.model ?? DEFAULT_INFERENCE_MODEL;
+  const estimatedInputTokens = input.reduce(
+    (total, message) => total + estimateTokenCount(message.content),
+    0,
+  );
+  const operation = format ? 'responses.parse' : 'chat.completions';
 
+  try {
     if (!format) {
       const completion = await openAIClient.chat.completions.create({
-        model: 'gpt-5-nano',
-        messages: typeof content === 'string' ? [
-          {
-            role: 'user',
-            content: content,
-          },
-        ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
+        model,
+        messages: input,
+        ...(options?.temperature !== undefined
+          ? { temperature: options.temperature }
+          : {}),
+        ...(options?.maxTokens !== undefined
+          ? { max_tokens: options.maxTokens }
+          : {}),
+      });
+
+      await logInferenceUsage({
+        model,
+        operation,
+        success: true,
+        estimatedInputTokens,
+        reason,
+        metadata: options?.metadata,
+        usage: getChatCompletionUsage(completion),
       });
 
       return completion.choices[0]?.message?.content as T;
     }
 
     const completion = await openAIClient.responses.parse({
-      model: 'gpt-5-nano',
-      input: typeof content === 'string' ? [
-        {
-          role: 'user',
-          content: content,
-        },
-      ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
-      ...(format ? { text: {
-          format: zodTextFormat(format, "newton_response_format"),
-        },
-      } : {}),
-    });
-
-    console.log({
-      model: 'gpt-5-nano',
-      input: typeof content === 'string' ? [
-        {
-          role: 'user',
-          content: content,
-        },
-      ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
-      ...(format ? { text: {
-          format: zodTextFormat(format, "newton_response_format"),
-        },
-      } : {}),
+      model,
+      input,
+      text: {
+        format: zodTextFormat(format, 'newton_response_format'),
+      },
     });
 
-
     if (!completion) {
       throw new Error('No response generated from inference API');
     }
 
-    // if (format) {
-    //   if (typeof completion.output === 'string') {
-    //     return JSON.parse(completion.output);
-    //   }
-    //   return JSON.parse(completion.output);
-    // }
+    await logInferenceUsage({
+      model,
+      operation,
+      success: true,
+      estimatedInputTokens,
+      reason,
+      metadata: options?.metadata,
+      usage: getResponseUsage(completion),
+    });
 
-    return completion.output_parsed;
+    return completion.output_parsed as T;
   } catch (error) {
-    logger.error('Failed to generate inference response', { error });
-    throw error;
-  }
-}
-
-/**
- * Simple inference function for general use
- */
-export async function generateInferenceResponse(
-  subject: string,
-  question: string,
-  options: {
-    model?: string;
-    maxTokens?: number;
-  } = {}
-): Promise<InferenceResponse> {
-  const { model = 'gpt-5-nano', maxTokens = 500 } = options;
-
-  try {
-    const completion = await openAIClient.chat.completions.create({
+    await logInferenceUsage({
       model,
-      messages: [
-        {
-          role: 'system',
-          content: `You are a helpful educational assistant for ${subject}. Provide clear, concise, and accurate answers. Keep responses educational and appropriate for students.`,
-        },
-        {
-          role: 'user',
-          content: question,
-        },
-      ],
-      max_tokens: maxTokens,
-      temperature: 0.5,
-      // Remove OpenAI-specific parameters for Cohere compatibility
+      operation,
+      success: false,
+      estimatedInputTokens,
+      reason,
+      metadata: options?.metadata,
+      error,
     });
 
-    const response = completion.choices[0]?.message?.content;
-    
-    if (!response) {
-      throw new Error('No response generated from inference API');
-    }
-
-    return {
-      content: response,
+    logger.error('Failed to generate inference response', {
+      error,
+      reason,
       model,
-      tokensUsed: completion.usage?.total_tokens || 0,
-      finishReason: completion.choices[0]?.finish_reason || 'unknown',
-    };
-
-  } catch (error) {
-    logger.error('Failed to generate inference response', { error, subject, question: question.substring(0, 50) + '...' });
+      operation,
+      metadata: options?.metadata,
+    });
     throw error;
   }
 }
 
-/**
- * Validate inference configuration
- */
-export function validateInferenceConfig(): boolean {
-  if (!env.INFERENCE_API_KEY) {
-    logger.error('Inference API key not configured for Cohere');
-    return false;
-  }
-  return true;
-}
-
 /**
  * Get available inference models (for admin/config purposes)
  */
@@ -278,7 +372,7 @@ export async function getAvailableModels(): Promise<string[]> {
       .sort();
   } catch (error) {
     logger.error('Failed to fetch inference models', { error });
-    return ['command-r-plus', 'command-r', 'command-light']; // Fallback Cohere models
+    return ['command-r-plus', 'command-r', 'command-light'];
   }
 }
 
@@ -286,6 +380,5 @@ export async function getAvailableModels(): Promise<string[]> {
  * Estimate token count for a message (rough approximation)
  */
 export function estimateTokenCount(text: string): number {
-  // Rough approximation: 1 token ≈ 4 characters for English text
   return Math.ceil(text.length / 4);
-}
+}

package/tests/globalSetup.ts

@@ -9,6 +9,7 @@ import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
 import { clearDatabase } from '../src/seedDatabase';
 import { execSync } from 'child_process';
+import { SessionType } from '@prisma/client';
 
 async function runSetup() {
   const ctx = await createTRPCContext({
@@ -40,9 +41,18 @@ async function runSetup() {
     confirmPassword: 'password_is_1234',
   });
 
-  const session1 = await prisma.session.findFirst({ where: { userId: user1.user.id } });
-  const session2 = await prisma.session.findFirst({ where: { userId: user2.user.id } });
-  const session3 = await prisma.session.findFirst({ where: { userId: user3.user.id } });
+  const session1 = await prisma.session.findFirst({
+    where: { userId: user1.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
+  const session2 = await prisma.session.findFirst({
+    where: { userId: user2.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
+  const session3 = await prisma.session.findFirst({
+    where: { userId: user3.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
 
   if (!session1 || !session2 || !session3) {
     throw new Error('Failed to create sessions for test users');
@@ -59,4 +69,3 @@ export default async function setup(project: TestProject) {
   project.onTestsRerun(runSetup);
   await runSetup();
 }
-

package/tests/lib/cors.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, test } from 'vitest';
+import {
+  createCorsOriginMatcher,
+  isValidCorsOriginPatternList,
+  parseCorsOriginPatterns,
+  parseCorsOrigins,
+} from '../../src/lib/config/cors.js';
+
+describe('CORS configuration', () => {
+  test('parses comma-separated origins while trimming empty entries', () => {
+    expect(parseCorsOrigins(' https://one.example, ,https://two.example ')).toEqual([
+      'https://one.example',
+      'https://two.example',
+    ]);
+  });
+
+  test('normalizes configured origin URLs before matching', () => {
+    const { allowedOrigins, isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example/dashboard/',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example/some/path/, https://branch.example/',
+    });
+
+    expect(allowedOrigins).toContain('https://app.example');
+    expect(allowedOrigins).toContain('https://preview.example');
+    expect(allowedOrigins).toContain('https://branch.example');
+    expect(isAllowedOrigin('https://preview.example/')).toBe(true);
+    expect(isAllowedOrigin('https://branch.example/path')).toBe(true);
+  });
+
+  test('allows exact configured origins', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example,https://branch.example',
+    });
+
+    expect(isAllowedOrigin('https://www.studious.sh')).toBe(true);
+    expect(isAllowedOrigin('https://app.example')).toBe(true);
+    expect(isAllowedOrigin('https://preview.example')).toBe(true);
+    expect(isAllowedOrigin('https://branch.example')).toBe(true);
+  });
+
+  test('does not allow dev subdomains in production unless configured', () => {
+    const defaultProductionMatcher = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+    });
+    const configuredProductionMatcher = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://dev.studious.sh',
+    });
+
+    expect(defaultProductionMatcher.isAllowedOrigin('https://dev.studious.sh')).toBe(false);
+    expect(defaultProductionMatcher.isAllowedOrigin('https://www.dev.studious.sh')).toBe(false);
+    expect(configuredProductionMatcher.isAllowedOrigin('https://dev.studious.sh')).toBe(true);
+  });
+
+  test('allows narrow configured origin patterns', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      CORS_ALLOWED_ORIGIN_PATTERNS: '^https://studious-git-[a-z0-9-]+-studious-lms\\.vercel\\.app$',
+    });
+
+    expect(isAllowedOrigin('https://studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(true);
+    expect(isAllowedOrigin('https://malicious-studious-git-configure-vercel-cors-studious-lms.vercel.app')).toBe(false);
+  });
+
+  test('rejects missing and unconfigured origins instead of using a fallback', () => {
+    const { isAllowedOrigin } = createCorsOriginMatcher({
+      NODE_ENV: 'production',
+      NEXT_PUBLIC_APP_URL: 'https://app.example',
+      CORS_ALLOWED_ORIGINS: 'https://preview.example',
+    });
+
+    expect(isAllowedOrigin()).toBe(false);
+    expect(isAllowedOrigin('https://evil.example')).toBe(false);
+    expect(isAllowedOrigin('http://localhost:3000')).toBe(false);
+  });
+
+  test('compiles configured regex patterns', () => {
+    expect(parseCorsOriginPatterns('^https://one\\.example$, ^https://two\\.example$').map((pattern) => pattern.source)).toEqual([
+      '^https:\\/\\/one\\.example$',
+      '^https:\\/\\/two\\.example$',
+    ]);
+  });
+
+  test('validates origin pattern syntax for env parsing', () => {
+    expect(isValidCorsOriginPatternList()).toBe(true);
+    expect(isValidCorsOriginPatternList('')).toBe(true);
+    expect(isValidCorsOriginPatternList('^https://one\\.example$')).toBe(true);
+    expect(isValidCorsOriginPatternList('(')).toBe(false);
+  });
+
+  test('rejects overly long origin patterns', () => {
+    expect(isValidCorsOriginPatternList(`^https://${'a'.repeat(250)}\\.example$`)).toBe(false);
+  });
+
+  test('rejects origin patterns with nested quantifiers', () => {
+    expect(isValidCorsOriginPatternList('^(a+)+$')).toBe(false);
+  });
+});