@studious-lms/server 1.4.1 → 1.4.3

package/tests/pipelines/aiLabChat.test.ts

@@ -1,95 +1,75 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, test } from "vitest";
 
-const prismaMock = {
-  labChat: {
-    findUnique: vi.fn(),
-  },
-  message: {
-    update: vi.fn(),
-  },
-};
+import { sliceMessagesThroughAnchor } from "../../src/pipelines/aiLabChat.js";
 
-const pusherTriggerMock = vi.fn();
-const teacherChannelMock = vi.fn((classId: string) => `teacher-${classId}`);
-const loggerErrorMock = vi.fn();
-const consoleErrorMock = vi.spyOn(console, 'error').mockImplementation(() => {});
+describe("sliceMessagesThroughAnchor", () => {
+  const messages = [
+    {
+      id: "latest-teacher",
+      content: "Actually make it harder",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:04:00Z"),
+      sender: null,
+    },
+    {
+      id: "anchor-first",
+      content: "Create a quiz",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:03:00Z"),
+      sender: null,
+    },
+    {
+      id: "middle-ai",
+      content: "What topic should I cover?",
+      senderId: "ai-user",
+      createdAt: new Date("2026-04-08T12:02:00Z"),
+      sender: null,
+    },
+    {
+      id: "anchor-last",
+      content: "Earlier context",
+      senderId: "teacher-1",
+      createdAt: new Date("2026-04-08T12:01:00Z"),
+      sender: null,
+    },
+  ];
 
-vi.mock('../../src/lib/prisma.js', () => ({
-  prisma: prismaMock,
-}));
-
-vi.mock('../../src/lib/pusher.js', () => ({
-  pusher: {
-    trigger: pusherTriggerMock,
-  },
-  teacherChannel: teacherChannelMock,
-}));
-
-vi.mock('../../src/utils/logger.js', () => ({
-  logger: {
-    error: loggerErrorMock,
-    info: vi.fn(),
-  },
-}));
-
-vi.mock('../../src/utils/aiUser.js', () => ({
-  getAIUserId: vi.fn(),
-  isAIUser: vi.fn(() => false),
-}));
-
-vi.mock('../../src/utils/inference.js', () => ({
-  inference: vi.fn(),
-  inferenceClient: {},
-  sendAIMessage: vi.fn(),
-}));
-
-vi.mock('../../src/lib/jsonConversion.js', () => ({
-  createPdf: vi.fn(),
-}));
-
-vi.mock('../../src/lib/googleCloudStorage.js', () => ({
-  bucket: {
-    file: vi.fn(),
-  },
-}));
-
-const { generateAndSendLabResponse } = await import('../../src/pipelines/aiLabChat.js');
+  test("drops messages newer than the anchor message", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-first")).toEqual([
+      messages[1],
+      messages[2],
+      messages[3],
+    ]);
+  });
 
-describe('generateAndSendLabResponse', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    consoleErrorMock.mockClear();
+  test("returns the first limit messages when no anchor is provided", () => {
+    expect(sliceMessagesThroughAnchor(messages, undefined, 2)).toEqual([
+      messages[0],
+      messages[1],
+    ]);
   });
 
-  it('broadcasts lab-response-failed even if marking the message as FAILED throws', async () => {
-    const generationError = new Error('boom');
-    const statusError = new Error('message missing');
+  test("returns the first limit messages when the anchor is not found", () => {
+    expect(sliceMessagesThroughAnchor(messages, "missing-anchor", 2)).toEqual([
+      messages[0],
+      messages[1],
+    ]);
+  });
 
-    prismaMock.labChat.findUnique.mockRejectedValueOnce(generationError);
-    prismaMock.message.update.mockRejectedValueOnce(statusError);
-    pusherTriggerMock.mockResolvedValueOnce(undefined);
+  test("returns an empty array when given no messages", () => {
+    expect(sliceMessagesThroughAnchor([], "missing-anchor")).toEqual([]);
+  });
 
-    await expect(
-      generateAndSendLabResponse('lab-chat-1', 'teacher prompt', {
-        classId: 'class-1',
-        messageId: 'message-1',
-      }),
-    ).rejects.toThrow(generationError);
+  test("returns the anchored slice when the anchor is the first eligible message", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-first", 2)).toEqual([
+      messages[1],
+      messages[2],
+    ]);
+  });
 
-    expect(prismaMock.message.update).toHaveBeenCalledWith({
-      where: { id: 'message-1' },
-      data: { status: 'FAILED' },
-    });
-    expect(teacherChannelMock).toHaveBeenCalledWith('class-1');
-    expect(pusherTriggerMock).toHaveBeenCalledWith('teacher-class-1', 'lab-response-failed', {
-      labChatId: 'lab-chat-1',
-      messageId: 'message-1',
-      error: 'AI response generation failed',
-    });
-    expect(loggerErrorMock).toHaveBeenCalledWith('Failed to set message status FAILED:', {
-      error: statusError,
-      labChatId: 'lab-chat-1',
-      messageId: 'message-1',
-    });
+  test("returns only the last message when the anchor is already the oldest", () => {
+    expect(sliceMessagesThroughAnchor(messages, "anchor-last", 3)).toEqual([
+      messages[3],
+    ]);
   });
 });

package/tests/routers/auth.test.ts

@@ -1,12 +1,58 @@
 // @note: some sloppy impl
 
+import { randomUUID } from 'crypto';
+import { SessionType } from '@prisma/client';
 import { test, expect, describe } from 'vitest';
 import { appRouter } from '../../src/routers/_app';
 import { createTRPCContext } from '../../src/trpc';
 import { prisma } from '../../src/lib/prisma';
-import { caller, login1, login2, login3, session1, session2, session3, user1Caller, user2Caller, user3Caller, verification1, verification2, verification3 } from '../setup';
+import {
+  caller,
+  login1,
+  login2,
+  login3,
+  session1,
+  session2,
+  session3,
+  user1Caller,
+  user2Caller,
+  user3Caller,
+  verification1,
+  verification2,
+  verification3,
+} from '../setup';
 import { expectUnauth } from '../helpers';
 
+type TokenHeaderSource = 'x-user' | 'authorization';
+
+const createCallerForToken = async (
+  token: string,
+  source: TokenHeaderSource = 'x-user'
+) => {
+  const headers =
+    source === 'x-user'
+      ? { 'x-user': token }
+      : { authorization: `Bearer ${token}` };
+
+  const ctx = await createTRPCContext({
+    req: {
+      headers,
+    } as any,
+    res: {} as any,
+  });
+
+  return appRouter.createCaller(ctx);
+};
+
+const expectTokenRejected = async (token: string) => {
+  for (const source of ['x-user', 'authorization'] as const) {
+    const protectedCaller = await createCallerForToken(token, source);
+    await expect(protectedCaller.auth.check()).rejects.toThrow(
+      'Invalid or expired session'
+    );
+  }
+};
+
 describe('Auth Router', () => {
   test('check returns user when authenticated', async () => {
     const result = await user1Caller.auth.check();
@@ -15,8 +61,7 @@ describe('Auth Router', () => {
     expect(result.user.username).toBe('testuser1');
   });
 
-  test('check fails when unauthenticated', () =>
-    expectUnauth((c) => c.auth.check()));
+  test('check fails when unauthenticated', () => expectUnauth((c) => c.auth.check()));
 
   test('resendVerificationEmail succeeds for existing user', async () => {
     await caller.auth.register({
@@ -39,16 +84,77 @@ describe('Auth Router', () => {
     expect(result.success).toBe(true);
   });
 
+  test('expired auth sessions are rejected', async () => {
+    const expiredSession = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.AUTH,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() - 60_000),
+      },
+    });
+
+    await expectTokenRejected(expiredSession.id);
+  });
+
+  test('password reset tokens cannot authenticate API calls', async () => {
+    const resetToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.PASSWORD_RESET,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(resetToken.id);
+  });
+
+  test('email verification tokens cannot authenticate API calls', async () => {
+    const verificationToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.EMAIL_VERIFICATION,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(verificationToken.id);
+  });
+
+  test('class invite tokens cannot authenticate API calls', async () => {
+    const inviteClass = await prisma.class.create({
+      data: {
+        id: randomUUID(),
+        name: 'Auth Invite Guard',
+        subject: 'Security',
+        section: 'A',
+        teachers: { connect: { id: login1.user.id } },
+      },
+    });
+
+    const inviteToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.CLASS_INVITE,
+        classId: inviteClass.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(inviteToken.id);
+  });
+
   test('resetPassword works with valid token', async () => {
     await caller.auth.requestPasswordReset({ email: 'test@studious.sh' });
-    // Reset tokens expire within 2hr; login sessions expire in 30 days
     const twoHoursFromNow = new Date(Date.now() + 2 * 60 * 60 * 1000);
     const resetSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
-        createdAt: { gte: new Date(Date.now() - 60_000) }, // created in last minute
+        createdAt: { gte: new Date(Date.now() - 60_000) },
       },
       orderBy: { createdAt: 'desc' },
     });
@@ -71,7 +177,7 @@ describe('Auth Router', () => {
     const restoreSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
         createdAt: { gte: new Date(Date.now() - 60_000) },
       },
@@ -95,6 +201,7 @@ describe('Auth Router', () => {
   test('email verification works', async () => {
     expect(verification1).toBeDefined();
     expect(verification2).toBeDefined();
+    expect(verification3).toBeDefined();
   });
 
   test('login returns valid tokens', async () => {
@@ -141,9 +248,7 @@ describe('Auth Router', () => {
   });
 
   test('verify fails with invalid token', async () => {
-    await expect(
-      caller.auth.verify({ token: 'invalid-token-12345' })
-    ).rejects.toThrow();
+    await expect(caller.auth.verify({ token: 'invalid-token-12345' })).rejects.toThrow();
   });
 
   test('resetPassword fails with invalid token', async () => {
@@ -161,11 +266,9 @@ describe('Auth Router', () => {
     expect(logout).toBeDefined();
     expect(logout.success).toBe(true);
 
-    const ctx = await createTRPCContext({
-      req: { headers: { authorization: `Bearer ${login3.token}`, 'x-user': login3.token } } as any,
-      res: {} as any,
-    });
-    const router = appRouter.createCaller(ctx);
-    await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    for (const source of ['x-user', 'authorization'] as const) {
+      const router = await createCallerForToken(login3.token, source);
+      await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    }
   });
-});
+});

package/tests/routers/class.test.ts

@@ -96,6 +96,12 @@ describe('Class Router', () => {
       expect(classData.class.name).toBe('Test Class 1');
     });
 
+    test('should forbid non-members from getting class data', async () => {
+      await expect(
+        user3Caller.class.get({ classId: testClass.id })
+      ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+
     test('should fail to get non-existent class', () =>
       expectRejects(() => user1Caller.class.get({ classId: 'non-existent-id' })));
 
@@ -349,4 +355,4 @@ describe('Class Router', () => {
       ).rejects.toThrow();
     });
   });
-}); 
+}); 

package/tests/routers/message.test.ts

@@ -1,5 +1,36 @@
 import { test, expect, describe, beforeAll } from 'vitest';
 import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { prisma } from '../../src/lib/prisma';
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+const createAttachmentViaUpload = async (
+  caller: typeof user1Caller,
+  conversationId: string,
+  file: {
+    name: string;
+    type: string;
+    size: number;
+  },
+) => {
+  const [uploadTarget] = await caller.message.getUploadUrls({
+    conversationId,
+    files: [file],
+  });
+
+  await prisma.file.update({
+    where: { id: uploadTarget!.id },
+    data: {
+      uploadStatus: 'COMPLETED',
+      uploadedAt: new Date(),
+      uploadProgress: 100,
+    },
+  });
+
+  return uploadTarget!;
+};
 
 describe('Message Router', () => {
   let conversationId: string;
@@ -46,28 +77,222 @@ describe('Message Router', () => {
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.send({
           conversationId,
           content: 'Unauthorized message',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
+    });
+
+    test('should create chat upload targets for conversation members', async () => {
+      const uploadTargets = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'chat-upload.pdf',
+            type: 'application/pdf',
+            size: 2048,
+          },
+        ],
+      });
+
+      expect(uploadTargets).toHaveLength(1);
+      expect(uploadTargets[0]?.id).toBeTruthy();
+      expect(uploadTargets[0]?.uploadSessionId).toBeTruthy();
+      expect(uploadTargets[0]?.uploadExpiresAt).toBeInstanceOf(Date);
+      expect(uploadTargets[0]!.uploadExpiresAt.getTime()).toBeGreaterThan(Date.now());
+      expect(uploadTargets[0]?.uploadUrl).toContain('/api/upload/');
+      expect(uploadTargets[0]?.uploadUrl).toContain('uploadSessionId=');
+    });
+
+    test('should reject upload targets for non-members', async () => {
+      await expectTRPCError(
+        user3Caller.message.getUploadUrls({
+          conversationId,
+          files: [
+            {
+              name: 'unauthorized-chat-upload.pdf',
+              type: 'application/pdf',
+              size: 2048,
+            },
+          ],
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should send a message with uploaded attachments', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'lesson-notes.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Please review the attached file',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.attachments).toHaveLength(1);
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject reusing an already attached file', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'single-use-attachment.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      await user1Caller.message.send({
+        conversationId,
+        content: 'First use of attachment',
+        fileIds: [attachment.id],
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Second use of attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+
+    test('should allow attachment-only messages', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'blank-message-upload.png',
+        type: 'image/png',
+        size: 512,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: '',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.content).toBe('');
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject files uploaded by another user', async () => {
+      const attachment = await createAttachmentViaUpload(user2Caller, conversationId, {
+        name: 'other-user.docx',
+        type: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        size: 1500,
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Trying to steal an attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+  });
+
+  describe('confirmUpload', () => {
+    test('should reject upload confirmation for non-members', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-non-member.pdf',
+            type: 'application/pdf',
+            size: 512,
+          },
+        ],
+      });
+
+      await expectTRPCError(
+        user3Caller.message.confirmUpload({
+          conversationId,
+          fileId: uploadTarget!.id,
+          uploadSuccess: false,
+          errorMessage: 'Unauthorized confirmation attempt',
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should mark uploads as failed when confirmation reports failure', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-failure.pdf',
+            type: 'application/pdf',
+            size: 1024,
+          },
+        ],
+      });
+
+      const result = await user1Caller.message.confirmUpload({
+        conversationId,
+        fileId: uploadTarget!.id,
+        uploadSuccess: false,
+        errorMessage: 'Simulated upload failure',
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.message).toBe('Upload failed');
+
+      const fileRecord = await prisma.file.findUnique({
+        where: { id: uploadTarget!.id },
+        select: {
+          uploadStatus: true,
+          uploadError: true,
+          uploadProgress: true,
+          uploadedAt: true,
+        },
+      });
+
+      expect(fileRecord?.uploadStatus).toBe('FAILED');
+      expect(fileRecord?.uploadError).toBe('Simulated upload failure');
+      expect(fileRecord?.uploadProgress).toBe(0);
+      expect(fileRecord?.uploadedAt).toBeNull();
     });
   });
 
   describe('list', () => {
     test('should list messages in conversation', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'list-message-attachment.pdf',
+        type: 'application/pdf',
+        size: 768,
+      });
+
+      const seededMessage = await user1Caller.message.send({
+        conversationId,
+        content: 'Seeded list message',
+        fileIds: [attachment.id],
+      });
+
       const result = await user1Caller.message.list({ conversationId });
+      const listedMessage = result.messages.find(
+        (message) => message.id === seededMessage.id,
+      );
 
       expect(result.messages).toBeDefined();
       expect(Array.isArray(result.messages)).toBe(true);
-      expect(result.messages.length).toBeGreaterThanOrEqual(2);
+      expect(listedMessage).toBeDefined();
+      expect(listedMessage?.content).toBe('Seeded list message');
+      expect(listedMessage?.attachments).toHaveLength(1);
+      expect(listedMessage?.attachments[0]?.id).toBe(attachment.id);
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.list({ conversationId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -82,12 +307,13 @@ describe('Message Router', () => {
     });
 
     test('should fail to update another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.update({
           messageId,
           content: 'Unauthorized edit',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -110,9 +336,10 @@ describe('Message Router', () => {
 
   describe('delete', () => {
     test('should fail to delete another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.delete({ messageId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
 
     test('should delete own message', async () => {