@studious-lms/server 1.4.2 → 1.4.3

package/tests/routers/message.test.ts

@@ -1,5 +1,36 @@
 import { test, expect, describe, beforeAll } from 'vitest';
 import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { prisma } from '../../src/lib/prisma';
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+const createAttachmentViaUpload = async (
+  caller: typeof user1Caller,
+  conversationId: string,
+  file: {
+    name: string;
+    type: string;
+    size: number;
+  },
+) => {
+  const [uploadTarget] = await caller.message.getUploadUrls({
+    conversationId,
+    files: [file],
+  });
+
+  await prisma.file.update({
+    where: { id: uploadTarget!.id },
+    data: {
+      uploadStatus: 'COMPLETED',
+      uploadedAt: new Date(),
+      uploadProgress: 100,
+    },
+  });
+
+  return uploadTarget!;
+};
 
 describe('Message Router', () => {
   let conversationId: string;
@@ -46,28 +77,222 @@ describe('Message Router', () => {
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.send({
           conversationId,
           content: 'Unauthorized message',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
+    });
+
+    test('should create chat upload targets for conversation members', async () => {
+      const uploadTargets = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'chat-upload.pdf',
+            type: 'application/pdf',
+            size: 2048,
+          },
+        ],
+      });
+
+      expect(uploadTargets).toHaveLength(1);
+      expect(uploadTargets[0]?.id).toBeTruthy();
+      expect(uploadTargets[0]?.uploadSessionId).toBeTruthy();
+      expect(uploadTargets[0]?.uploadExpiresAt).toBeInstanceOf(Date);
+      expect(uploadTargets[0]!.uploadExpiresAt.getTime()).toBeGreaterThan(Date.now());
+      expect(uploadTargets[0]?.uploadUrl).toContain('/api/upload/');
+      expect(uploadTargets[0]?.uploadUrl).toContain('uploadSessionId=');
+    });
+
+    test('should reject upload targets for non-members', async () => {
+      await expectTRPCError(
+        user3Caller.message.getUploadUrls({
+          conversationId,
+          files: [
+            {
+              name: 'unauthorized-chat-upload.pdf',
+              type: 'application/pdf',
+              size: 2048,
+            },
+          ],
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should send a message with uploaded attachments', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'lesson-notes.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Please review the attached file',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.attachments).toHaveLength(1);
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject reusing an already attached file', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'single-use-attachment.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      await user1Caller.message.send({
+        conversationId,
+        content: 'First use of attachment',
+        fileIds: [attachment.id],
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Second use of attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+
+    test('should allow attachment-only messages', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'blank-message-upload.png',
+        type: 'image/png',
+        size: 512,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: '',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.content).toBe('');
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject files uploaded by another user', async () => {
+      const attachment = await createAttachmentViaUpload(user2Caller, conversationId, {
+        name: 'other-user.docx',
+        type: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        size: 1500,
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Trying to steal an attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+  });
+
+  describe('confirmUpload', () => {
+    test('should reject upload confirmation for non-members', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-non-member.pdf',
+            type: 'application/pdf',
+            size: 512,
+          },
+        ],
+      });
+
+      await expectTRPCError(
+        user3Caller.message.confirmUpload({
+          conversationId,
+          fileId: uploadTarget!.id,
+          uploadSuccess: false,
+          errorMessage: 'Unauthorized confirmation attempt',
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should mark uploads as failed when confirmation reports failure', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-failure.pdf',
+            type: 'application/pdf',
+            size: 1024,
+          },
+        ],
+      });
+
+      const result = await user1Caller.message.confirmUpload({
+        conversationId,
+        fileId: uploadTarget!.id,
+        uploadSuccess: false,
+        errorMessage: 'Simulated upload failure',
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.message).toBe('Upload failed');
+
+      const fileRecord = await prisma.file.findUnique({
+        where: { id: uploadTarget!.id },
+        select: {
+          uploadStatus: true,
+          uploadError: true,
+          uploadProgress: true,
+          uploadedAt: true,
+        },
+      });
+
+      expect(fileRecord?.uploadStatus).toBe('FAILED');
+      expect(fileRecord?.uploadError).toBe('Simulated upload failure');
+      expect(fileRecord?.uploadProgress).toBe(0);
+      expect(fileRecord?.uploadedAt).toBeNull();
     });
   });
 
   describe('list', () => {
     test('should list messages in conversation', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'list-message-attachment.pdf',
+        type: 'application/pdf',
+        size: 768,
+      });
+
+      const seededMessage = await user1Caller.message.send({
+        conversationId,
+        content: 'Seeded list message',
+        fileIds: [attachment.id],
+      });
+
       const result = await user1Caller.message.list({ conversationId });
+      const listedMessage = result.messages.find(
+        (message) => message.id === seededMessage.id,
+      );
 
       expect(result.messages).toBeDefined();
       expect(Array.isArray(result.messages)).toBe(true);
-      expect(result.messages.length).toBeGreaterThanOrEqual(2);
+      expect(listedMessage).toBeDefined();
+      expect(listedMessage?.content).toBe('Seeded list message');
+      expect(listedMessage?.attachments).toHaveLength(1);
+      expect(listedMessage?.attachments[0]?.id).toBe(attachment.id);
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.list({ conversationId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -82,12 +307,13 @@ describe('Message Router', () => {
     });
 
     test('should fail to update another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.update({
           messageId,
           content: 'Unauthorized edit',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -110,9 +336,10 @@ describe('Message Router', () => {
 
   describe('delete', () => {
     test('should fail to delete another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.delete({ messageId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
 
     test('should delete own message', async () => {

package/tests/routers/newtonChat.test.ts

@@ -0,0 +1,81 @@
+import { beforeAll, describe, expect, test } from 'vitest';
+import { prisma } from '../../src/lib/prisma';
+import { user1Caller, user2Caller } from '../setup';
+
+describe('Newton Chat Router', () => {
+  let testClass: any;
+  let assignment: any;
+  let submission: any;
+  let newtonChatId: string;
+  let conversationId: string;
+  let user2Id: string;
+
+  beforeAll(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Newton Chat Test Class',
+      subject: 'Physics',
+      section: '10th Grade',
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    user2Id = user2Profile.id;
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Id,
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: 'Newton Chat Assignment',
+      instructions: 'Ask Newton for help with this assignment.',
+      dueDate: dueDate.toISOString(),
+      type: 'HOMEWORK',
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    const tutorConversation = await user2Caller.newtonChat.getTutorConversation({
+      assignmentId: assignment.id,
+      classId: testClass.id,
+    });
+
+    newtonChatId = tutorConversation.newtonChatId;
+    conversationId = tutorConversation.conversationId;
+  });
+
+  test('rejects attachment-only Newton chat posts', async () => {
+    const [uploadTarget] = await user2Caller.message.getUploadUrls({
+      conversationId,
+      files: [
+        {
+          name: 'newton-attachment-only.pdf',
+          type: 'application/pdf',
+          size: 1024,
+        },
+      ],
+    });
+
+    await prisma.file.update({
+      where: { id: uploadTarget!.id },
+      data: {
+        uploadStatus: 'COMPLETED',
+        uploadedAt: new Date(),
+      },
+    });
+
+    await expect(
+      user2Caller.newtonChat.postToNewtonChat({
+        newtonChatId,
+        content: '   ',
+        fileIds: [uploadTarget!.id],
+      }),
+    ).rejects.toThrow();
+  });
+});

package/tests/routers/notification.test.ts

@@ -40,6 +40,18 @@ describe('Notification Router', () => {
     expect(notification!.title).toBe('Test Notification');
   });
 
+  test('should not get another user\'s notification', async () => {
+    await expect(
+      user1Caller.notification.get({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
+  test('should not mark another user\'s notification as read', async () => {
+    await expect(
+      user1Caller.notification.markAsRead({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
   test('should mark notification as read', async () => {
     const notification = await user2Caller.notification.markAsRead({ id: notificationId });
 

package/tests/routers/worksheet.test.ts

@@ -0,0 +1,194 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { user1Caller, user2Caller, user3Caller } from "../setup";
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+describe("Worksheet Router Security", () => {
+  let testClass: any;
+  let worksheet: any;
+  let question: any;
+  let multipleChoiceQuestion: any;
+  let submission: any;
+  let worksheetResponse: any;
+  let progressId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: `Worksheet Security ${Date.now()}`,
+      subject: "Physics",
+      section: "12th Grade",
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Profile.id,
+    });
+
+    worksheet = await user1Caller.worksheet.create({
+      classId: testClass.id,
+      name: "Security Worksheet",
+    });
+
+    question = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is force?",
+      answer: "Mass times acceleration",
+      points: 5,
+      type: "SHORT_ANSWER",
+    });
+
+    multipleChoiceQuestion = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is the SI unit of force?",
+      answer: "newton",
+      points: 1,
+      type: "MULTIPLE_CHOICE",
+      options: [
+        { id: "a", text: "Joule", isCorrect: false },
+        { id: "b", text: "Newton", isCorrect: true },
+      ],
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    const assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: "Worksheet Assignment",
+      instructions: "Complete the worksheet.",
+      dueDate: dueDate.toISOString(),
+      acceptWorksheet: true,
+      gradeWithAI: true,
+      worksheetIds: [worksheet.id],
+      type: "HOMEWORK",
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    worksheetResponse = await user2Caller.worksheet.getWorksheetSubmission({
+      worksheetId: worksheet.id,
+      submissionId: submission.id,
+    });
+
+    const answered = await user2Caller.worksheet.answerQuestion({
+      worksheetResponseId: worksheetResponse.id,
+      questionId: question.id,
+      response: "Mass times acceleration",
+    });
+
+    progressId = answered.responses[0].id;
+  });
+
+  test("redacts worksheet answers and correctness metadata for students", async () => {
+    const studentWorksheet = await user2Caller.worksheet.getWorksheet({
+      worksheetId: worksheet.id,
+    });
+
+    const shortAnswerQuestion = studentWorksheet.questions.find(
+      (item: any) => item.id === question.id,
+    );
+    expect(shortAnswerQuestion.answer).toBe("");
+    expect(shortAnswerQuestion.markScheme).toBeNull();
+
+    const studentMcq = studentWorksheet.questions.find(
+      (item: any) => item.id === multipleChoiceQuestion.id,
+    );
+    expect(studentMcq.answer).toBe("");
+    expect(studentMcq.options).toEqual([
+      { id: "a", text: "Joule" },
+      { id: "b", text: "Newton" },
+    ]);
+  });
+
+  test("blocks cross-class worksheet reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheet({ worksheetId: worksheet.id }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet submission reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheetSubmission({
+        worksheetId: worksheet.id,
+        submissionId: submission.id,
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet answer mutations", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.answerQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        questionId: question.id,
+        response: "Unauthorized answer",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from teacher worksheet mutations", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.updateWorksheet({
+        worksheetId: worksheet.id,
+        name: "Student update",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addQuestion({
+        worksheetId: worksheet.id,
+        question: "Student-created question",
+        answer: "Nope",
+        type: "SHORT_ANSWER",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from grading and feedback actions", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.gradeAnswer({
+        questionId: question.id,
+        responseId: progressId,
+        studentWorksheetResponseId: worksheetResponse.id,
+        isCorrect: true,
+        feedback: "Nice work",
+        points: 5,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addComment({
+        responseId: progressId,
+        comment: "Teacher feedback",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.cancelGrading({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.regradeQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+  });
+});

package/tests/setup.ts

@@ -6,7 +6,7 @@ import { beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
 import { logger } from '../src/utils/logger';
 import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
-import { Session } from '@prisma/client';
+import { Session, SessionType } from '@prisma/client';
 
 // Load test environment variables
 config({ path: resolve(process.cwd(), '.env.test') });
@@ -35,9 +35,26 @@ beforeAll(async () => {
     throw new Error('Failed to get login tokens — ensure globalSetup ran');
   }
 
-  session1 = await prisma.session.findFirst({ where: { userId: login1.user.id } }) as Session;
-  session2 = await prisma.session.findFirst({ where: { userId: login2.user.id } }) as Session;
-  session3 = await prisma.session.findFirst({ where: { userId: login3.user.id } }) as Session;
+  const authSession1 = await prisma.session.findFirst({
+    where: { userId: login1.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession2 = await prisma.session.findFirst({
+    where: { userId: login2.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession3 = await prisma.session.findFirst({
+    where: { userId: login3.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+
+  if (!authSession1 || !authSession2 || !authSession3) {
+    throw new Error('Failed to retrieve AUTH sessions for test users');
+  }
+
+  session1 = authSession1;
+  session2 = authSession2;
+  session3 = authSession3;
 
   verification1 = { verified: true };
   verification2 = { verified: true };
@@ -69,4 +86,4 @@ export let verification2: any;
 export let verification3: any;
 export let login1: any;
 export let login2: any;
-export let login3: any;
+export let login3: any;