@studious-lms/server 1.4.2 → 1.4.3

package/src/utils/inference.ts

@@ -7,10 +7,9 @@ import { prisma } from '../lib/prisma.js';
 import { chatChannel, pusher } from '../lib/pusher.js';
 import { ensureAIUserExists, getAIUserId } from './aiUser.js';
 import { env } from '../lib/config/env.js';
+import { Prisma } from '@prisma/client';
 import { ZodSchema } from 'zod';
-import { zodTextFormat } from "openai/helpers/zod";
-
-
+import { zodTextFormat } from 'openai/helpers/zod';
 
 export const inferenceClient = new OpenAI({
   apiKey: env.INFERENCE_API_KEY,
@@ -19,6 +18,38 @@ export const inferenceClient = new OpenAI({
 
 export const openAIClient = new OpenAI();
 
+const DEFAULT_INFERENCE_MODEL = 'gpt-5-nano';
+
+type InferenceMessage = {
+  role: 'user' | 'assistant' | 'system';
+  content: string;
+};
+
+export interface InferenceOptions {
+  reason?: string;
+  metadata?: Prisma.InputJsonValue;
+  model?: string;
+  temperature?: number;
+  maxTokens?: number;
+}
+
+interface InferenceUsage {
+  promptTokens?: number;
+  completionTokens?: number;
+  totalTokens?: number;
+}
+
+interface InferenceAuditLog {
+  model: string;
+  operation: 'chat.completions' | 'responses.parse';
+  success: boolean;
+  estimatedInputTokens: number;
+  reason: string;
+  metadata?: Prisma.InputJsonValue;
+  usage?: InferenceUsage;
+  error?: unknown;
+}
+
 // Types for lab chat context
 export interface LabChatContext {
   subject: string;
@@ -39,6 +70,116 @@ export interface InferenceResponse {
   finishReason: string;
 }
 
+function normalizeInferenceInput(
+  content: string | OpenAI.Chat.Completions.ChatCompletionMessageParam[],
+): InferenceMessage[] {
+  if (typeof content === 'string') {
+    return [{ role: 'user', content }];
+  }
+
+  return content.map((message) => ({
+    role: message.role as InferenceMessage['role'],
+    content: typeof message.content === 'string' ? message.content : JSON.stringify(message.content),
+  }));
+}
+
+function getInferenceReason(options?: InferenceOptions) {
+  return options?.reason?.trim() || 'unspecified';
+}
+
+function serializeInferenceError(error: unknown) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+
+  if (typeof error === 'string') {
+    return error;
+  }
+
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return 'Unknown inference error';
+  }
+}
+
+async function logInferenceUsage({
+  model,
+  operation,
+  success,
+  estimatedInputTokens,
+  reason,
+  metadata,
+  usage,
+  error,
+}: InferenceAuditLog) {
+  const context = {
+    reason,
+    model,
+    operation,
+    success,
+    estimatedInputTokens,
+    promptTokens: usage?.promptTokens,
+    completionTokens: usage?.completionTokens,
+    totalTokens: usage?.totalTokens,
+    metadata,
+    ...(error ? { error: serializeInferenceError(error) } : {}),
+  };
+
+  try {
+    await prisma.aiUsageLog.create({
+      data: {
+        reason,
+        model,
+        operation,
+        success,
+        estimatedInputTokens,
+        promptTokens: usage?.promptTokens,
+        completionTokens: usage?.completionTokens,
+        totalTokens: usage?.totalTokens,
+        ...(metadata !== undefined ? { metadata } : {}),
+        ...(error ? { error: serializeInferenceError(error) } : {}),
+      },
+    });
+  } catch (loggingError) {
+    logger.error('Failed to persist AI usage log', {
+      ...context,
+      loggingError: serializeInferenceError(loggingError),
+    });
+    return;
+  }
+
+  logger.info('AI usage logged', context);
+}
+
+function getChatCompletionUsage(completion: {
+  usage?: {
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    total_tokens?: number;
+  };
+}): InferenceUsage {
+  return {
+    promptTokens: completion.usage?.prompt_tokens,
+    completionTokens: completion.usage?.completion_tokens,
+    totalTokens: completion.usage?.total_tokens,
+  };
+}
+
+function getResponseUsage(completion: {
+  usage?: {
+    input_tokens?: number;
+    output_tokens?: number;
+    total_tokens?: number;
+  };
+}): InferenceUsage {
+  return {
+    promptTokens: completion.usage?.input_tokens,
+    completionTokens: completion.usage?.output_tokens,
+    totalTokens: completion.usage?.total_tokens,
+  };
+}
+
 /**
  * Centralized function to send AI messages to conversations
  * Handles database storage and Pusher broadcasting
@@ -65,10 +206,8 @@ export async function sendAIMessage(
   createdAt: Date;
   meta?: Record<string, any>;
 }> {
-  // Ensure AI user exists
   await ensureAIUserExists();
 
-  // Create message in database
   const aiMessage = await prisma.message.create({
     data: {
       content,
@@ -94,17 +233,15 @@ export async function sendAIMessage(
     contentLength: content.length,
   });
 
-  // Prepare sender info
   const senderInfo = {
     id: getAIUserId(),
     username: 'Newton_AI',
     profile: {
-      displayName: "Newton AI",
+      displayName: 'Newton AI',
       profilePicture: options.customSender?.profilePicture || null,
     },
   };
 
-  // Broadcast via Pusher
   try {
     await pusher.trigger(chatChannel(conversationId), 'new-message', {
       id: aiMessage.id,
@@ -115,7 +252,7 @@ export async function sendAIMessage(
       sender: senderInfo,
       mentionedUserIds: [],
       meta: aiMessage.meta,
-      attachments: aiMessage.attachments.map(attachment => ({
+      attachments: aiMessage.attachments.map((attachment) => ({
         id: attachment.id,
         attachmentId: attachment.id,
         name: attachment.name,
@@ -140,67 +277,85 @@ export async function sendAIMessage(
 
 export async function inference<T>(
   content: string | OpenAI.Chat.Completions.ChatCompletionMessageParam[],
-  format?: ZodSchema
+  format?: ZodSchema,
+  options?: InferenceOptions,
 ): Promise<T> {
-  try {
+  const input = normalizeInferenceInput(content);
+  const reason = getInferenceReason(options);
+  const model = options?.model ?? DEFAULT_INFERENCE_MODEL;
+  const estimatedInputTokens = input.reduce(
+    (total, message) => total + estimateTokenCount(message.content),
+    0,
+  );
+  const operation = format ? 'responses.parse' : 'chat.completions';
 
+  try {
     if (!format) {
       const completion = await openAIClient.chat.completions.create({
-        model: 'gpt-5-nano',
-        messages: typeof content === 'string' ? [
-          {
-            role: 'user',
-            content: content,
-          },
-        ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
+        model,
+        messages: input,
+        ...(options?.temperature !== undefined
+          ? { temperature: options.temperature }
+          : {}),
+        ...(options?.maxTokens !== undefined
+          ? { max_tokens: options.maxTokens }
+          : {}),
+      });
+
+      await logInferenceUsage({
+        model,
+        operation,
+        success: true,
+        estimatedInputTokens,
+        reason,
+        metadata: options?.metadata,
+        usage: getChatCompletionUsage(completion),
       });
 
       return completion.choices[0]?.message?.content as T;
     }
 
     const completion = await openAIClient.responses.parse({
-      model: 'gpt-5-nano',
-      input: typeof content === 'string' ? [
-        {
-          role: 'user',
-          content: content,
-        },
-      ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
-      ...(format ? { text: {
-          format: zodTextFormat(format, "newton_response_format"),
-        },
-      } : {}),
+      model,
+      input,
+      text: {
+        format: zodTextFormat(format, 'newton_response_format'),
+      },
     });
 
-    console.log({
-      model: 'gpt-5-nano',
-      input: typeof content === 'string' ? [
-        {
-          role: 'user',
-          content: content,
-        },
-      ] : content as Array<{ role: 'user' | 'assistant' | 'system'; content: string }>,
-      ...(format ? { text: {
-          format: zodTextFormat(format, "newton_response_format"),
-        },
-      } : {}),
-    });
-
-
     if (!completion) {
       throw new Error('No response generated from inference API');
     }
 
-    // if (format) {
-    //   if (typeof completion.output === 'string') {
-    //     return JSON.parse(completion.output);
-    //   }
-    //   return JSON.parse(completion.output);
-    // }
+    await logInferenceUsage({
+      model,
+      operation,
+      success: true,
+      estimatedInputTokens,
+      reason,
+      metadata: options?.metadata,
+      usage: getResponseUsage(completion),
+    });
 
-    return completion.output_parsed;
+    return completion.output_parsed as T;
   } catch (error) {
-    logger.error('Failed to generate inference response', { error });
+    await logInferenceUsage({
+      model,
+      operation,
+      success: false,
+      estimatedInputTokens,
+      reason,
+      metadata: options?.metadata,
+      error,
+    });
+
+    logger.error('Failed to generate inference response', {
+      error,
+      reason,
+      model,
+      operation,
+      metadata: options?.metadata,
+    });
     throw error;
   }
 }
@@ -217,7 +372,7 @@ export async function getAvailableModels(): Promise<string[]> {
       .sort();
   } catch (error) {
     logger.error('Failed to fetch inference models', { error });
-    return ['command-r-plus', 'command-r', 'command-light']; // Fallback Cohere models
+    return ['command-r-plus', 'command-r', 'command-light'];
   }
 }
 
@@ -225,6 +380,5 @@ export async function getAvailableModels(): Promise<string[]> {
  * Estimate token count for a message (rough approximation)
  */
 export function estimateTokenCount(text: string): number {
-  // Rough approximation: 1 token ≈ 4 characters for English text
   return Math.ceil(text.length / 4);
-}
+}

package/tests/globalSetup.ts

@@ -9,6 +9,7 @@ import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
 import { clearDatabase } from '../src/seedDatabase';
 import { execSync } from 'child_process';
+import { SessionType } from '@prisma/client';
 
 async function runSetup() {
   const ctx = await createTRPCContext({
@@ -40,9 +41,18 @@ async function runSetup() {
     confirmPassword: 'password_is_1234',
   });
 
-  const session1 = await prisma.session.findFirst({ where: { userId: user1.user.id } });
-  const session2 = await prisma.session.findFirst({ where: { userId: user2.user.id } });
-  const session3 = await prisma.session.findFirst({ where: { userId: user3.user.id } });
+  const session1 = await prisma.session.findFirst({
+    where: { userId: user1.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
+  const session2 = await prisma.session.findFirst({
+    where: { userId: user2.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
+  const session3 = await prisma.session.findFirst({
+    where: { userId: user3.user.id, type: SessionType.EMAIL_VERIFICATION },
+    orderBy: { createdAt: 'desc' },
+  });
 
   if (!session1 || !session2 || !session3) {
     throw new Error('Failed to create sessions for test users');
@@ -59,4 +69,3 @@ export default async function setup(project: TestProject) {
   project.onTestsRerun(runSetup);
   await runSetup();
 }
-

package/tests/routers/auth.test.ts

@@ -1,12 +1,58 @@
 // @note: some sloppy impl
 
+import { randomUUID } from 'crypto';
+import { SessionType } from '@prisma/client';
 import { test, expect, describe } from 'vitest';
 import { appRouter } from '../../src/routers/_app';
 import { createTRPCContext } from '../../src/trpc';
 import { prisma } from '../../src/lib/prisma';
-import { caller, login1, login2, login3, session1, session2, session3, user1Caller, user2Caller, user3Caller, verification1, verification2, verification3 } from '../setup';
+import {
+  caller,
+  login1,
+  login2,
+  login3,
+  session1,
+  session2,
+  session3,
+  user1Caller,
+  user2Caller,
+  user3Caller,
+  verification1,
+  verification2,
+  verification3,
+} from '../setup';
 import { expectUnauth } from '../helpers';
 
+type TokenHeaderSource = 'x-user' | 'authorization';
+
+const createCallerForToken = async (
+  token: string,
+  source: TokenHeaderSource = 'x-user'
+) => {
+  const headers =
+    source === 'x-user'
+      ? { 'x-user': token }
+      : { authorization: `Bearer ${token}` };
+
+  const ctx = await createTRPCContext({
+    req: {
+      headers,
+    } as any,
+    res: {} as any,
+  });
+
+  return appRouter.createCaller(ctx);
+};
+
+const expectTokenRejected = async (token: string) => {
+  for (const source of ['x-user', 'authorization'] as const) {
+    const protectedCaller = await createCallerForToken(token, source);
+    await expect(protectedCaller.auth.check()).rejects.toThrow(
+      'Invalid or expired session'
+    );
+  }
+};
+
 describe('Auth Router', () => {
   test('check returns user when authenticated', async () => {
     const result = await user1Caller.auth.check();
@@ -15,8 +61,7 @@ describe('Auth Router', () => {
     expect(result.user.username).toBe('testuser1');
   });
 
-  test('check fails when unauthenticated', () =>
-    expectUnauth((c) => c.auth.check()));
+  test('check fails when unauthenticated', () => expectUnauth((c) => c.auth.check()));
 
   test('resendVerificationEmail succeeds for existing user', async () => {
     await caller.auth.register({
@@ -39,16 +84,77 @@ describe('Auth Router', () => {
     expect(result.success).toBe(true);
   });
 
+  test('expired auth sessions are rejected', async () => {
+    const expiredSession = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.AUTH,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() - 60_000),
+      },
+    });
+
+    await expectTokenRejected(expiredSession.id);
+  });
+
+  test('password reset tokens cannot authenticate API calls', async () => {
+    const resetToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.PASSWORD_RESET,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(resetToken.id);
+  });
+
+  test('email verification tokens cannot authenticate API calls', async () => {
+    const verificationToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.EMAIL_VERIFICATION,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(verificationToken.id);
+  });
+
+  test('class invite tokens cannot authenticate API calls', async () => {
+    const inviteClass = await prisma.class.create({
+      data: {
+        id: randomUUID(),
+        name: 'Auth Invite Guard',
+        subject: 'Security',
+        section: 'A',
+        teachers: { connect: { id: login1.user.id } },
+      },
+    });
+
+    const inviteToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.CLASS_INVITE,
+        classId: inviteClass.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(inviteToken.id);
+  });
+
   test('resetPassword works with valid token', async () => {
     await caller.auth.requestPasswordReset({ email: 'test@studious.sh' });
-    // Reset tokens expire within 2hr; login sessions expire in 30 days
     const twoHoursFromNow = new Date(Date.now() + 2 * 60 * 60 * 1000);
     const resetSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
-        createdAt: { gte: new Date(Date.now() - 60_000) }, // created in last minute
+        createdAt: { gte: new Date(Date.now() - 60_000) },
       },
       orderBy: { createdAt: 'desc' },
     });
@@ -71,7 +177,7 @@ describe('Auth Router', () => {
     const restoreSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
         createdAt: { gte: new Date(Date.now() - 60_000) },
       },
@@ -95,6 +201,7 @@ describe('Auth Router', () => {
   test('email verification works', async () => {
     expect(verification1).toBeDefined();
     expect(verification2).toBeDefined();
+    expect(verification3).toBeDefined();
   });
 
   test('login returns valid tokens', async () => {
@@ -141,9 +248,7 @@ describe('Auth Router', () => {
   });
 
   test('verify fails with invalid token', async () => {
-    await expect(
-      caller.auth.verify({ token: 'invalid-token-12345' })
-    ).rejects.toThrow();
+    await expect(caller.auth.verify({ token: 'invalid-token-12345' })).rejects.toThrow();
   });
 
   test('resetPassword fails with invalid token', async () => {
@@ -161,11 +266,9 @@ describe('Auth Router', () => {
     expect(logout).toBeDefined();
     expect(logout.success).toBe(true);
 
-    const ctx = await createTRPCContext({
-      req: { headers: { authorization: `Bearer ${login3.token}`, 'x-user': login3.token } } as any,
-      res: {} as any,
-    });
-    const router = appRouter.createCaller(ctx);
-    await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    for (const source of ['x-user', 'authorization'] as const) {
+      const router = await createCallerForToken(login3.token, source);
+      await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    }
   });
-});
+});

package/tests/routers/class.test.ts

@@ -96,6 +96,12 @@ describe('Class Router', () => {
       expect(classData.class.name).toBe('Test Class 1');
     });
 
+    test('should forbid non-members from getting class data', async () => {
+      await expect(
+        user3Caller.class.get({ classId: testClass.id })
+      ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+
     test('should fail to get non-existent class', () =>
       expectRejects(() => user1Caller.class.get({ classId: 'non-existent-id' })));
 
@@ -349,4 +355,4 @@ describe('Class Router', () => {
       ).rejects.toThrow();
     });
   });
-}); 
+});