@studious-lms/server 1.4.1 → 1.4.3

package/tests/routers/newtonChat.test.ts

@@ -0,0 +1,81 @@
+import { beforeAll, describe, expect, test } from 'vitest';
+import { prisma } from '../../src/lib/prisma';
+import { user1Caller, user2Caller } from '../setup';
+
+describe('Newton Chat Router', () => {
+  let testClass: any;
+  let assignment: any;
+  let submission: any;
+  let newtonChatId: string;
+  let conversationId: string;
+  let user2Id: string;
+
+  beforeAll(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Newton Chat Test Class',
+      subject: 'Physics',
+      section: '10th Grade',
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    user2Id = user2Profile.id;
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Id,
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: 'Newton Chat Assignment',
+      instructions: 'Ask Newton for help with this assignment.',
+      dueDate: dueDate.toISOString(),
+      type: 'HOMEWORK',
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    const tutorConversation = await user2Caller.newtonChat.getTutorConversation({
+      assignmentId: assignment.id,
+      classId: testClass.id,
+    });
+
+    newtonChatId = tutorConversation.newtonChatId;
+    conversationId = tutorConversation.conversationId;
+  });
+
+  test('rejects attachment-only Newton chat posts', async () => {
+    const [uploadTarget] = await user2Caller.message.getUploadUrls({
+      conversationId,
+      files: [
+        {
+          name: 'newton-attachment-only.pdf',
+          type: 'application/pdf',
+          size: 1024,
+        },
+      ],
+    });
+
+    await prisma.file.update({
+      where: { id: uploadTarget!.id },
+      data: {
+        uploadStatus: 'COMPLETED',
+        uploadedAt: new Date(),
+      },
+    });
+
+    await expect(
+      user2Caller.newtonChat.postToNewtonChat({
+        newtonChatId,
+        content: '   ',
+        fileIds: [uploadTarget!.id],
+      }),
+    ).rejects.toThrow();
+  });
+});

package/tests/routers/notification.test.ts

@@ -40,6 +40,18 @@ describe('Notification Router', () => {
     expect(notification!.title).toBe('Test Notification');
   });
 
+  test('should not get another user\'s notification', async () => {
+    await expect(
+      user1Caller.notification.get({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
+  test('should not mark another user\'s notification as read', async () => {
+    await expect(
+      user1Caller.notification.markAsRead({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
   test('should mark notification as read', async () => {
     const notification = await user2Caller.notification.markAsRead({ id: notificationId });
 

package/tests/routers/studentProgress.test.ts

@@ -53,16 +53,6 @@ describe("Student Progress Router", () => {
     const futureDueDate = new Date();
     futureDueDate.setDate(futureDueDate.getDate() + 2);
 
-    const futureAssignment = await user1Caller.assignment.create({
-      classId: testClass.id,
-      title: "Upcoming Quiz",
-      instructions: "Prepare for the upcoming quiz.",
-      dueDate: futureDueDate.toISOString(),
-      maxGrade: 100,
-      graded: true,
-      type: "QUIZ",
-    });
-
     const futureCompletedAssignment = await user1Caller.assignment.create({
       classId: testClass.id,
       title: "Completed Future Quiz",
@@ -110,17 +100,6 @@ describe("Student Progress Router", () => {
     expect(result.recommendations[0].assignmentId).toBe(assignment.id);
     expect(result.recommendations[0].reasons).toContain("Scored 50%");
 
-    const futureRecommendation = result.recommendations.find(
-      (recommendation) =>
-        recommendation.assignmentId === futureAssignment.id,
-    );
-    expect(futureRecommendation?.reasons).toContain(
-      "Upcoming graded assignment",
-    );
-    expect(futureRecommendation?.reasons).not.toContain(
-      "Awaiting grade or feedback",
-    );
-
     const completedFutureRecommendation = result.recommendations.find(
       (recommendation) =>
         recommendation.assignmentId === futureCompletedAssignment.id,
@@ -189,11 +168,7 @@ describe("Student Progress Router", () => {
     });
 
     expect(result.isFallback).toBe(true);
-    expect(result.message).toContain("current overall progress");
-    expect(result.message).toContain(
-      "not enough graded work to determine a recent trend",
-    );
-    expect(result.message).not.toContain("missing or low-scoring");
+    expect(result.message).toContain("current overall grade");
   });
 
   test("returns a flagged fallback chat response for empty model output", async () => {
@@ -208,11 +183,7 @@ describe("Student Progress Router", () => {
     });
 
     expect(result.isFallback).toBe(true);
-    expect(result.message).toContain("current overall progress");
-    expect(result.message).toContain(
-      "not enough graded work to determine a recent trend",
-    );
-    expect(result.message).not.toContain("missing or low-scoring");
+    expect(result.message).toContain("current overall grade");
   });
 
   test("prevents a student from chatting about another student's progress", async () => {

package/tests/routers/worksheet.test.ts

@@ -0,0 +1,194 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { user1Caller, user2Caller, user3Caller } from "../setup";
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+describe("Worksheet Router Security", () => {
+  let testClass: any;
+  let worksheet: any;
+  let question: any;
+  let multipleChoiceQuestion: any;
+  let submission: any;
+  let worksheetResponse: any;
+  let progressId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: `Worksheet Security ${Date.now()}`,
+      subject: "Physics",
+      section: "12th Grade",
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Profile.id,
+    });
+
+    worksheet = await user1Caller.worksheet.create({
+      classId: testClass.id,
+      name: "Security Worksheet",
+    });
+
+    question = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is force?",
+      answer: "Mass times acceleration",
+      points: 5,
+      type: "SHORT_ANSWER",
+    });
+
+    multipleChoiceQuestion = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is the SI unit of force?",
+      answer: "newton",
+      points: 1,
+      type: "MULTIPLE_CHOICE",
+      options: [
+        { id: "a", text: "Joule", isCorrect: false },
+        { id: "b", text: "Newton", isCorrect: true },
+      ],
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    const assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: "Worksheet Assignment",
+      instructions: "Complete the worksheet.",
+      dueDate: dueDate.toISOString(),
+      acceptWorksheet: true,
+      gradeWithAI: true,
+      worksheetIds: [worksheet.id],
+      type: "HOMEWORK",
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    worksheetResponse = await user2Caller.worksheet.getWorksheetSubmission({
+      worksheetId: worksheet.id,
+      submissionId: submission.id,
+    });
+
+    const answered = await user2Caller.worksheet.answerQuestion({
+      worksheetResponseId: worksheetResponse.id,
+      questionId: question.id,
+      response: "Mass times acceleration",
+    });
+
+    progressId = answered.responses[0].id;
+  });
+
+  test("redacts worksheet answers and correctness metadata for students", async () => {
+    const studentWorksheet = await user2Caller.worksheet.getWorksheet({
+      worksheetId: worksheet.id,
+    });
+
+    const shortAnswerQuestion = studentWorksheet.questions.find(
+      (item: any) => item.id === question.id,
+    );
+    expect(shortAnswerQuestion.answer).toBe("");
+    expect(shortAnswerQuestion.markScheme).toBeNull();
+
+    const studentMcq = studentWorksheet.questions.find(
+      (item: any) => item.id === multipleChoiceQuestion.id,
+    );
+    expect(studentMcq.answer).toBe("");
+    expect(studentMcq.options).toEqual([
+      { id: "a", text: "Joule" },
+      { id: "b", text: "Newton" },
+    ]);
+  });
+
+  test("blocks cross-class worksheet reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheet({ worksheetId: worksheet.id }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet submission reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheetSubmission({
+        worksheetId: worksheet.id,
+        submissionId: submission.id,
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet answer mutations", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.answerQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        questionId: question.id,
+        response: "Unauthorized answer",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from teacher worksheet mutations", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.updateWorksheet({
+        worksheetId: worksheet.id,
+        name: "Student update",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addQuestion({
+        worksheetId: worksheet.id,
+        question: "Student-created question",
+        answer: "Nope",
+        type: "SHORT_ANSWER",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from grading and feedback actions", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.gradeAnswer({
+        questionId: question.id,
+        responseId: progressId,
+        studentWorksheetResponseId: worksheetResponse.id,
+        isCorrect: true,
+        feedback: "Nice work",
+        points: 5,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addComment({
+        responseId: progressId,
+        comment: "Teacher feedback",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.cancelGrading({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.regradeQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+  });
+});

package/tests/setup.ts

@@ -6,7 +6,7 @@ import { beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
 import { logger } from '../src/utils/logger';
 import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
-import { Session } from '@prisma/client';
+import { Session, SessionType } from '@prisma/client';
 
 // Load test environment variables
 config({ path: resolve(process.cwd(), '.env.test') });
@@ -35,9 +35,26 @@ beforeAll(async () => {
     throw new Error('Failed to get login tokens — ensure globalSetup ran');
   }
 
-  session1 = await prisma.session.findFirst({ where: { userId: login1.user.id } }) as Session;
-  session2 = await prisma.session.findFirst({ where: { userId: login2.user.id } }) as Session;
-  session3 = await prisma.session.findFirst({ where: { userId: login3.user.id } }) as Session;
+  const authSession1 = await prisma.session.findFirst({
+    where: { userId: login1.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession2 = await prisma.session.findFirst({
+    where: { userId: login2.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession3 = await prisma.session.findFirst({
+    where: { userId: login3.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+
+  if (!authSession1 || !authSession2 || !authSession3) {
+    throw new Error('Failed to retrieve AUTH sessions for test users');
+  }
+
+  session1 = authSession1;
+  session2 = authSession2;
+  session3 = authSession3;
 
   verification1 = { verified: true };
   verification2 = { verified: true };
@@ -69,4 +86,4 @@ export let verification2: any;
 export let verification3: any;
 export let login1: any;
 export let login2: any;
-export let login3: any;
+export let login3: any;

package/tests/utils/aiLabChatPrompt.test.ts

@@ -1,18 +1,126 @@
 import { describe, expect, test } from "vitest";
 
-import { buildLabChatSystemPrompt } from "../../src/pipelines/labChatPrompt";
+import {
+  buildLabChatResponseMessages,
+  buildLabChatSystemPrompt,
+} from "../../src/pipelines/labChatPrompt";
+import { labChatArrayFieldInstructions, labChatResponseFormat } from "../../src/pipelines/aiLabChatContract";
 
 describe("buildLabChatSystemPrompt", () => {
   test("requires arrays for worksheet and section structured output fields", () => {
     const prompt = buildLabChatSystemPrompt("Context");
 
-    expect(prompt).toContain(
-      '{ "text": string, "docs": null | array, "worksheetsToCreate": array, "sectionsToCreate": array, "assignmentsToCreate": null | array }',
-    );
-    expect(prompt).toContain('"worksheetsToCreate" must always be an array. Use [] when there are no worksheets to create.');
-    expect(prompt).toContain('"sectionsToCreate" must always be an array. Use [] when there are no sections to create.');
+    expect(prompt).toContain(labChatResponseFormat);
+    expect(prompt).toContain(labChatArrayFieldInstructions);
     expect(prompt).toContain('Do not return null for "worksheetsToCreate" or "sectionsToCreate".');
     expect(prompt).not.toContain('"worksheetsToCreate": null | array');
     expect(prompt).not.toContain('"sectionsToCreate": null | array');
   });
 });
+
+describe("buildLabChatResponseMessages", () => {
+  test("builds response messages from history without replaying the latest teacher turn", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          senderId: "teacher-1",
+          content: "Create a quiz on osmosis",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+        {
+          senderId: "ai-user",
+          content: "I can do that.",
+        },
+      ],
+      isAIUser: (senderId) => senderId === "ai-user",
+    });
+
+    const teacherTurns = messages.filter(
+      (message) =>
+        message.role === "user" &&
+        typeof message.content === "string" &&
+        message.content.includes("Create a quiz on osmosis"),
+    );
+
+    expect(teacherTurns).toHaveLength(1);
+    expect(messages.at(-2)).toMatchObject({
+      role: "developer",
+      content: expect.stringContaining("CLASS CONTEXT"),
+    });
+  });
+
+  test("sorts timestamped history into chronological order before prompt assembly", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          id: "assistant-later",
+          senderId: "ai-user",
+          content: "Second response",
+          createdAt: new Date("2026-04-08T12:02:00Z"),
+        },
+        {
+          id: "teacher-earlier",
+          senderId: "teacher-1",
+          content: "First request",
+          createdAt: new Date("2026-04-08T12:01:00Z"),
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+      ],
+      isAIUser: (senderId) => senderId === "ai-user",
+    });
+
+    expect(messages[1]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: First request",
+    });
+    expect(messages[2]).toMatchObject({
+      role: "assistant",
+      content: "Second response",
+    });
+  });
+
+  test("keeps original order among messages without timestamps", () => {
+    const messages = buildLabChatResponseMessages({
+      context: "Topic context",
+      classContext: "CLASS: Biology",
+      recentMessages: [
+        {
+          senderId: "teacher-1",
+          content: "First untimed request",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+        {
+          senderId: "teacher-1",
+          content: "Second untimed request",
+          sender: {
+            username: "teacher",
+            profile: { displayName: "Ms Patel" },
+          },
+        },
+      ],
+      isAIUser: () => false,
+    });
+
+    expect(messages[1]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: First untimed request",
+    });
+    expect(messages[2]).toMatchObject({
+      role: "user",
+      content: "Ms Patel: Second untimed request",
+    });
+  });
+});