@studious-lms/server 1.4.2 → 1.4.4

package/tests/routers/auth.test.ts

@@ -1,12 +1,58 @@
 // @note: some sloppy impl
 
+import { randomUUID } from 'crypto';
+import { SessionType } from '@prisma/client';
 import { test, expect, describe } from 'vitest';
 import { appRouter } from '../../src/routers/_app';
 import { createTRPCContext } from '../../src/trpc';
 import { prisma } from '../../src/lib/prisma';
-import { caller, login1, login2, login3, session1, session2, session3, user1Caller, user2Caller, user3Caller, verification1, verification2, verification3 } from '../setup';
+import {
+  caller,
+  login1,
+  login2,
+  login3,
+  session1,
+  session2,
+  session3,
+  user1Caller,
+  user2Caller,
+  user3Caller,
+  verification1,
+  verification2,
+  verification3,
+} from '../setup';
 import { expectUnauth } from '../helpers';
 
+type TokenHeaderSource = 'x-user' | 'authorization';
+
+const createCallerForToken = async (
+  token: string,
+  source: TokenHeaderSource = 'x-user'
+) => {
+  const headers =
+    source === 'x-user'
+      ? { 'x-user': token }
+      : { authorization: `Bearer ${token}` };
+
+  const ctx = await createTRPCContext({
+    req: {
+      headers,
+    } as any,
+    res: {} as any,
+  });
+
+  return appRouter.createCaller(ctx);
+};
+
+const expectTokenRejected = async (token: string) => {
+  for (const source of ['x-user', 'authorization'] as const) {
+    const protectedCaller = await createCallerForToken(token, source);
+    await expect(protectedCaller.auth.check()).rejects.toThrow(
+      'Invalid or expired session'
+    );
+  }
+};
+
 describe('Auth Router', () => {
   test('check returns user when authenticated', async () => {
     const result = await user1Caller.auth.check();
@@ -15,8 +61,7 @@ describe('Auth Router', () => {
     expect(result.user.username).toBe('testuser1');
   });
 
-  test('check fails when unauthenticated', () =>
-    expectUnauth((c) => c.auth.check()));
+  test('check fails when unauthenticated', () => expectUnauth((c) => c.auth.check()));
 
   test('resendVerificationEmail succeeds for existing user', async () => {
     await caller.auth.register({
@@ -39,16 +84,77 @@ describe('Auth Router', () => {
     expect(result.success).toBe(true);
   });
 
+  test('expired auth sessions are rejected', async () => {
+    const expiredSession = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.AUTH,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() - 60_000),
+      },
+    });
+
+    await expectTokenRejected(expiredSession.id);
+  });
+
+  test('password reset tokens cannot authenticate API calls', async () => {
+    const resetToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.PASSWORD_RESET,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(resetToken.id);
+  });
+
+  test('email verification tokens cannot authenticate API calls', async () => {
+    const verificationToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.EMAIL_VERIFICATION,
+        userId: login1.user.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(verificationToken.id);
+  });
+
+  test('class invite tokens cannot authenticate API calls', async () => {
+    const inviteClass = await prisma.class.create({
+      data: {
+        id: randomUUID(),
+        name: 'Auth Invite Guard',
+        subject: 'Security',
+        section: 'A',
+        teachers: { connect: { id: login1.user.id } },
+      },
+    });
+
+    const inviteToken = await prisma.session.create({
+      data: {
+        id: randomUUID(),
+        type: SessionType.CLASS_INVITE,
+        classId: inviteClass.id,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    await expectTokenRejected(inviteToken.id);
+  });
+
   test('resetPassword works with valid token', async () => {
     await caller.auth.requestPasswordReset({ email: 'test@studious.sh' });
-    // Reset tokens expire within 2hr; login sessions expire in 30 days
     const twoHoursFromNow = new Date(Date.now() + 2 * 60 * 60 * 1000);
     const resetSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
-        createdAt: { gte: new Date(Date.now() - 60_000) }, // created in last minute
+        createdAt: { gte: new Date(Date.now() - 60_000) },
       },
       orderBy: { createdAt: 'desc' },
     });
@@ -71,7 +177,7 @@ describe('Auth Router', () => {
     const restoreSession = await prisma.session.findFirst({
       where: {
         userId: login1.user.id,
-        classId: null,
+        type: SessionType.PASSWORD_RESET,
         expiresAt: { lte: twoHoursFromNow },
         createdAt: { gte: new Date(Date.now() - 60_000) },
       },
@@ -95,6 +201,7 @@ describe('Auth Router', () => {
   test('email verification works', async () => {
     expect(verification1).toBeDefined();
     expect(verification2).toBeDefined();
+    expect(verification3).toBeDefined();
   });
 
   test('login returns valid tokens', async () => {
@@ -141,9 +248,7 @@ describe('Auth Router', () => {
   });
 
   test('verify fails with invalid token', async () => {
-    await expect(
-      caller.auth.verify({ token: 'invalid-token-12345' })
-    ).rejects.toThrow();
+    await expect(caller.auth.verify({ token: 'invalid-token-12345' })).rejects.toThrow();
   });
 
   test('resetPassword fails with invalid token', async () => {
@@ -161,11 +266,9 @@ describe('Auth Router', () => {
     expect(logout).toBeDefined();
     expect(logout.success).toBe(true);
 
-    const ctx = await createTRPCContext({
-      req: { headers: { authorization: `Bearer ${login3.token}`, 'x-user': login3.token } } as any,
-      res: {} as any,
-    });
-    const router = appRouter.createCaller(ctx);
-    await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    for (const source of ['x-user', 'authorization'] as const) {
+      const router = await createCallerForToken(login3.token, source);
+      await expect(router.user.getProfile()).rejects.toThrow('Invalid or expired session');
+    }
   });
-});
+});

package/tests/routers/class.test.ts

@@ -96,6 +96,12 @@ describe('Class Router', () => {
       expect(classData.class.name).toBe('Test Class 1');
     });
 
+    test('should forbid non-members from getting class data', async () => {
+      await expect(
+        user3Caller.class.get({ classId: testClass.id })
+      ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+
     test('should fail to get non-existent class', () =>
       expectRejects(() => user1Caller.class.get({ classId: 'non-existent-id' })));
 
@@ -349,4 +355,4 @@ describe('Class Router', () => {
       ).rejects.toThrow();
     });
   });
-}); 
+}); 

package/tests/routers/message.test.ts

@@ -1,5 +1,36 @@
 import { test, expect, describe, beforeAll } from 'vitest';
 import { user1Caller, user2Caller, user3Caller } from '../setup';
+import { prisma } from '../../src/lib/prisma';
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+const createAttachmentViaUpload = async (
+  caller: typeof user1Caller,
+  conversationId: string,
+  file: {
+    name: string;
+    type: string;
+    size: number;
+  },
+) => {
+  const [uploadTarget] = await caller.message.getUploadUrls({
+    conversationId,
+    files: [file],
+  });
+
+  await prisma.file.update({
+    where: { id: uploadTarget!.id },
+    data: {
+      uploadStatus: 'COMPLETED',
+      uploadedAt: new Date(),
+      uploadProgress: 100,
+    },
+  });
+
+  return uploadTarget!;
+};
 
 describe('Message Router', () => {
   let conversationId: string;
@@ -46,28 +77,222 @@ describe('Message Router', () => {
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.send({
           conversationId,
           content: 'Unauthorized message',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
+    });
+
+    test('should create chat upload targets for conversation members', async () => {
+      const uploadTargets = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'chat-upload.pdf',
+            type: 'application/pdf',
+            size: 2048,
+          },
+        ],
+      });
+
+      expect(uploadTargets).toHaveLength(1);
+      expect(uploadTargets[0]?.id).toBeTruthy();
+      expect(uploadTargets[0]?.uploadSessionId).toBeTruthy();
+      expect(uploadTargets[0]?.uploadExpiresAt).toBeInstanceOf(Date);
+      expect(uploadTargets[0]!.uploadExpiresAt.getTime()).toBeGreaterThan(Date.now());
+      expect(uploadTargets[0]?.uploadUrl).toContain('/api/upload/');
+      expect(uploadTargets[0]?.uploadUrl).toContain('uploadSessionId=');
+    });
+
+    test('should reject upload targets for non-members', async () => {
+      await expectTRPCError(
+        user3Caller.message.getUploadUrls({
+          conversationId,
+          files: [
+            {
+              name: 'unauthorized-chat-upload.pdf',
+              type: 'application/pdf',
+              size: 2048,
+            },
+          ],
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should send a message with uploaded attachments', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'lesson-notes.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: 'Please review the attached file',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.attachments).toHaveLength(1);
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject reusing an already attached file', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'single-use-attachment.pdf',
+        type: 'application/pdf',
+        size: 1024,
+      });
+
+      await user1Caller.message.send({
+        conversationId,
+        content: 'First use of attachment',
+        fileIds: [attachment.id],
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Second use of attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+
+    test('should allow attachment-only messages', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'blank-message-upload.png',
+        type: 'image/png',
+        size: 512,
+      });
+
+      const result = await user1Caller.message.send({
+        conversationId,
+        content: '',
+        fileIds: [attachment.id],
+      });
+
+      expect(result.content).toBe('');
+      expect(result.attachments[0]?.id).toBe(attachment.id);
+    });
+
+    test('should reject files uploaded by another user', async () => {
+      const attachment = await createAttachmentViaUpload(user2Caller, conversationId, {
+        name: 'other-user.docx',
+        type: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        size: 1500,
+      });
+
+      await expectTRPCError(
+        user1Caller.message.send({
+          conversationId,
+          content: 'Trying to steal an attachment',
+          fileIds: [attachment.id],
+        }),
+        'BAD_REQUEST',
+      );
+    });
+  });
+
+  describe('confirmUpload', () => {
+    test('should reject upload confirmation for non-members', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-non-member.pdf',
+            type: 'application/pdf',
+            size: 512,
+          },
+        ],
+      });
+
+      await expectTRPCError(
+        user3Caller.message.confirmUpload({
+          conversationId,
+          fileId: uploadTarget!.id,
+          uploadSuccess: false,
+          errorMessage: 'Unauthorized confirmation attempt',
+        }),
+        'FORBIDDEN',
+      );
+    });
+
+    test('should mark uploads as failed when confirmation reports failure', async () => {
+      const [uploadTarget] = await user1Caller.message.getUploadUrls({
+        conversationId,
+        files: [
+          {
+            name: 'confirm-upload-failure.pdf',
+            type: 'application/pdf',
+            size: 1024,
+          },
+        ],
+      });
+
+      const result = await user1Caller.message.confirmUpload({
+        conversationId,
+        fileId: uploadTarget!.id,
+        uploadSuccess: false,
+        errorMessage: 'Simulated upload failure',
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.message).toBe('Upload failed');
+
+      const fileRecord = await prisma.file.findUnique({
+        where: { id: uploadTarget!.id },
+        select: {
+          uploadStatus: true,
+          uploadError: true,
+          uploadProgress: true,
+          uploadedAt: true,
+        },
+      });
+
+      expect(fileRecord?.uploadStatus).toBe('FAILED');
+      expect(fileRecord?.uploadError).toBe('Simulated upload failure');
+      expect(fileRecord?.uploadProgress).toBe(0);
+      expect(fileRecord?.uploadedAt).toBeNull();
     });
   });
 
   describe('list', () => {
     test('should list messages in conversation', async () => {
+      const attachment = await createAttachmentViaUpload(user1Caller, conversationId, {
+        name: 'list-message-attachment.pdf',
+        type: 'application/pdf',
+        size: 768,
+      });
+
+      const seededMessage = await user1Caller.message.send({
+        conversationId,
+        content: 'Seeded list message',
+        fileIds: [attachment.id],
+      });
+
       const result = await user1Caller.message.list({ conversationId });
+      const listedMessage = result.messages.find(
+        (message) => message.id === seededMessage.id,
+      );
 
       expect(result.messages).toBeDefined();
       expect(Array.isArray(result.messages)).toBe(true);
-      expect(result.messages.length).toBeGreaterThanOrEqual(2);
+      expect(listedMessage).toBeDefined();
+      expect(listedMessage?.content).toBe('Seeded list message');
+      expect(listedMessage?.attachments).toHaveLength(1);
+      expect(listedMessage?.attachments[0]?.id).toBe(attachment.id);
     });
 
     test('should fail for non-member', async () => {
-      await expect(
+      await expectTRPCError(
         user3Caller.message.list({ conversationId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -82,12 +307,13 @@ describe('Message Router', () => {
     });
 
     test('should fail to update another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.update({
           messageId,
           content: 'Unauthorized edit',
         }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
   });
 
@@ -110,9 +336,10 @@ describe('Message Router', () => {
 
   describe('delete', () => {
     test('should fail to delete another user\'s message', async () => {
-      await expect(
+      await expectTRPCError(
         user2Caller.message.delete({ messageId }),
-      ).rejects.toThrow();
+        'FORBIDDEN',
+      );
     });
 
     test('should delete own message', async () => {

package/tests/routers/newtonChat.test.ts

@@ -0,0 +1,81 @@
+import { beforeAll, describe, expect, test } from 'vitest';
+import { prisma } from '../../src/lib/prisma';
+import { user1Caller, user2Caller } from '../setup';
+
+describe('Newton Chat Router', () => {
+  let testClass: any;
+  let assignment: any;
+  let submission: any;
+  let newtonChatId: string;
+  let conversationId: string;
+  let user2Id: string;
+
+  beforeAll(async () => {
+    testClass = await user1Caller.class.create({
+      name: 'Newton Chat Test Class',
+      subject: 'Physics',
+      section: '10th Grade',
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    user2Id = user2Profile.id;
+
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Id,
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: 'Newton Chat Assignment',
+      instructions: 'Ask Newton for help with this assignment.',
+      dueDate: dueDate.toISOString(),
+      type: 'HOMEWORK',
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    const tutorConversation = await user2Caller.newtonChat.getTutorConversation({
+      assignmentId: assignment.id,
+      classId: testClass.id,
+    });
+
+    newtonChatId = tutorConversation.newtonChatId;
+    conversationId = tutorConversation.conversationId;
+  });
+
+  test('rejects attachment-only Newton chat posts', async () => {
+    const [uploadTarget] = await user2Caller.message.getUploadUrls({
+      conversationId,
+      files: [
+        {
+          name: 'newton-attachment-only.pdf',
+          type: 'application/pdf',
+          size: 1024,
+        },
+      ],
+    });
+
+    await prisma.file.update({
+      where: { id: uploadTarget!.id },
+      data: {
+        uploadStatus: 'COMPLETED',
+        uploadedAt: new Date(),
+      },
+    });
+
+    await expect(
+      user2Caller.newtonChat.postToNewtonChat({
+        newtonChatId,
+        content: '   ',
+        fileIds: [uploadTarget!.id],
+      }),
+    ).rejects.toThrow();
+  });
+});

package/tests/routers/notification.test.ts

@@ -40,6 +40,18 @@ describe('Notification Router', () => {
     expect(notification!.title).toBe('Test Notification');
   });
 
+  test('should not get another user\'s notification', async () => {
+    await expect(
+      user1Caller.notification.get({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
+  test('should not mark another user\'s notification as read', async () => {
+    await expect(
+      user1Caller.notification.markAsRead({ id: notificationId })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
   test('should mark notification as read', async () => {
     const notification = await user2Caller.notification.markAsRead({ id: notificationId });