@studious-lms/server 1.4.2 → 1.4.4

package/tests/routers/worksheet.test.ts

@@ -0,0 +1,194 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { user1Caller, user2Caller, user3Caller } from "../setup";
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+describe("Worksheet Router Security", () => {
+  let testClass: any;
+  let worksheet: any;
+  let question: any;
+  let multipleChoiceQuestion: any;
+  let submission: any;
+  let worksheetResponse: any;
+  let progressId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: `Worksheet Security ${Date.now()}`,
+      subject: "Physics",
+      section: "12th Grade",
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Profile.id,
+    });
+
+    worksheet = await user1Caller.worksheet.create({
+      classId: testClass.id,
+      name: "Security Worksheet",
+    });
+
+    question = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is force?",
+      answer: "Mass times acceleration",
+      points: 5,
+      type: "SHORT_ANSWER",
+    });
+
+    multipleChoiceQuestion = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is the SI unit of force?",
+      answer: "newton",
+      points: 1,
+      type: "MULTIPLE_CHOICE",
+      options: [
+        { id: "a", text: "Joule", isCorrect: false },
+        { id: "b", text: "Newton", isCorrect: true },
+      ],
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    const assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: "Worksheet Assignment",
+      instructions: "Complete the worksheet.",
+      dueDate: dueDate.toISOString(),
+      acceptWorksheet: true,
+      gradeWithAI: true,
+      worksheetIds: [worksheet.id],
+      type: "HOMEWORK",
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    worksheetResponse = await user2Caller.worksheet.getWorksheetSubmission({
+      worksheetId: worksheet.id,
+      submissionId: submission.id,
+    });
+
+    const answered = await user2Caller.worksheet.answerQuestion({
+      worksheetResponseId: worksheetResponse.id,
+      questionId: question.id,
+      response: "Mass times acceleration",
+    });
+
+    progressId = answered.responses[0].id;
+  });
+
+  test("redacts worksheet answers and correctness metadata for students", async () => {
+    const studentWorksheet = await user2Caller.worksheet.getWorksheet({
+      worksheetId: worksheet.id,
+    });
+
+    const shortAnswerQuestion = studentWorksheet.questions.find(
+      (item: any) => item.id === question.id,
+    );
+    expect(shortAnswerQuestion.answer).toBe("");
+    expect(shortAnswerQuestion.markScheme).toBeNull();
+
+    const studentMcq = studentWorksheet.questions.find(
+      (item: any) => item.id === multipleChoiceQuestion.id,
+    );
+    expect(studentMcq.answer).toBe("");
+    expect(studentMcq.options).toEqual([
+      { id: "a", text: "Joule" },
+      { id: "b", text: "Newton" },
+    ]);
+  });
+
+  test("blocks cross-class worksheet reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheet({ worksheetId: worksheet.id }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet submission reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheetSubmission({
+        worksheetId: worksheet.id,
+        submissionId: submission.id,
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet answer mutations", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.answerQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        questionId: question.id,
+        response: "Unauthorized answer",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from teacher worksheet mutations", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.updateWorksheet({
+        worksheetId: worksheet.id,
+        name: "Student update",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addQuestion({
+        worksheetId: worksheet.id,
+        question: "Student-created question",
+        answer: "Nope",
+        type: "SHORT_ANSWER",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from grading and feedback actions", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.gradeAnswer({
+        questionId: question.id,
+        responseId: progressId,
+        studentWorksheetResponseId: worksheetResponse.id,
+        isCorrect: true,
+        feedback: "Nice work",
+        points: 5,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addComment({
+        responseId: progressId,
+        comment: "Teacher feedback",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.cancelGrading({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.regradeQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+  });
+});

package/tests/setup.ts

@@ -6,7 +6,7 @@ import { beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
 import { logger } from '../src/utils/logger';
 import { appRouter } from '../src/routers/_app';
 import { createTRPCContext } from '../src/trpc';
-import { Session } from '@prisma/client';
+import { Session, SessionType } from '@prisma/client';
 
 // Load test environment variables
 config({ path: resolve(process.cwd(), '.env.test') });
@@ -35,9 +35,26 @@ beforeAll(async () => {
     throw new Error('Failed to get login tokens — ensure globalSetup ran');
   }
 
-  session1 = await prisma.session.findFirst({ where: { userId: login1.user.id } }) as Session;
-  session2 = await prisma.session.findFirst({ where: { userId: login2.user.id } }) as Session;
-  session3 = await prisma.session.findFirst({ where: { userId: login3.user.id } }) as Session;
+  const authSession1 = await prisma.session.findFirst({
+    where: { userId: login1.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession2 = await prisma.session.findFirst({
+    where: { userId: login2.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+  const authSession3 = await prisma.session.findFirst({
+    where: { userId: login3.user.id, type: SessionType.AUTH },
+    orderBy: { createdAt: 'desc' },
+  });
+
+  if (!authSession1 || !authSession2 || !authSession3) {
+    throw new Error('Failed to retrieve AUTH sessions for test users');
+  }
+
+  session1 = authSession1;
+  session2 = authSession2;
+  session3 = authSession3;
 
   verification1 = { verified: true };
   verification2 = { verified: true };
@@ -69,4 +86,4 @@ export let verification2: any;
 export let verification3: any;
 export let login1: any;
 export let login2: any;
-export let login3: any;
+export let login3: any;

package/tests/utils/inference.test.ts

@@ -0,0 +1,255 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+import { z } from 'zod';
+
+const {
+  chatCreateMock,
+  responseParseMock,
+  modelsListMock,
+  prismaMocks,
+  logger,
+} = vi.hoisted(() => ({
+  chatCreateMock: vi.fn(),
+  responseParseMock: vi.fn(),
+  modelsListMock: vi.fn(),
+  prismaMocks: {
+    aiUsageLog: {
+      create: vi.fn(),
+    },
+    message: {
+      create: vi.fn(),
+    },
+  },
+  logger: {
+    info: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+vi.mock('openai', () => ({
+  default: class OpenAI {
+    chat = {
+      completions: {
+        create: chatCreateMock,
+      },
+    };
+
+    responses = {
+      parse: responseParseMock,
+    };
+
+    models = {
+      list: modelsListMock,
+    };
+  },
+}));
+
+vi.mock('openai/helpers/zod', () => ({
+  zodTextFormat: vi.fn((schema, name) => ({ schema, name })),
+}));
+
+vi.mock('../../src/lib/prisma.js', () => ({
+  prisma: prismaMocks,
+}));
+
+vi.mock('../../src/utils/logger.js', () => ({
+  logger,
+}));
+
+vi.mock('../../src/lib/pusher.js', () => ({
+  chatChannel: vi.fn(),
+  pusher: {
+    trigger: vi.fn(),
+  },
+}));
+
+vi.mock('../../src/utils/aiUser.js', () => ({
+  ensureAIUserExists: vi.fn(),
+  getAIUserId: vi.fn(() => 'AI_ASSISTANT'),
+}));
+
+vi.mock('../../src/lib/config/env.js', () => ({
+  env: {
+    INFERENCE_API_KEY: 'test-key',
+    INFERENCE_API_BASE_URL: 'http://localhost:11434/v1',
+    OPENAI_API_KEY: 'test-openai-key',
+  },
+}));
+
+import { estimateTokenCount, inference } from '../../src/utils/inference.js';
+
+describe('inference', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    prismaMocks.aiUsageLog.create.mockResolvedValue({ id: 'log-1' });
+  });
+
+  test('logs chat completion usage with the provided reason', async () => {
+    chatCreateMock.mockResolvedValue({
+      choices: [{ message: { content: 'Hello back' } }],
+      usage: {
+        prompt_tokens: 12,
+        completion_tokens: 8,
+        total_tokens: 20,
+      },
+    });
+
+    const result = await inference<string>('Hello there', undefined, {
+      reason: 'student_progress_chat',
+      metadata: { classId: 'class-1', studentId: 'student-1' },
+    });
+
+    expect(result).toBe('Hello back');
+    expect(prismaMocks.aiUsageLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        reason: 'student_progress_chat',
+        operation: 'chat.completions',
+        success: true,
+        promptTokens: 12,
+        completionTokens: 8,
+        totalTokens: 20,
+        estimatedInputTokens: estimateTokenCount('Hello there'),
+        metadata: { classId: 'class-1', studentId: 'student-1' },
+      }),
+    });
+    expect(logger.info).toHaveBeenCalledWith(
+      'AI usage logged',
+      expect.objectContaining({
+        reason: 'student_progress_chat',
+        totalTokens: 20,
+      }),
+    );
+    expect(chatCreateMock).toHaveBeenCalledWith({
+      model: 'gpt-5-nano',
+      messages: [{ role: 'user', content: 'Hello there' }],
+    });
+  });
+
+  test('passes optional chat completion settings through the helper', async () => {
+    chatCreateMock.mockResolvedValue({
+      choices: [{ message: { content: 'Configured response' } }],
+      usage: {
+        prompt_tokens: 10,
+        completion_tokens: 5,
+        total_tokens: 15,
+      },
+    });
+
+    const result = await inference<string>('Introduce yourself', undefined, {
+      reason: 'newton_chat_introduction',
+      metadata: { conversationId: 'conversation-1' },
+      model: 'command-a-03-2025',
+      maxTokens: 300,
+      temperature: 0.8,
+    });
+
+    expect(result).toBe('Configured response');
+    expect(chatCreateMock).toHaveBeenCalledWith({
+      model: 'command-a-03-2025',
+      messages: [{ role: 'user', content: 'Introduce yourself' }],
+      max_tokens: 300,
+      temperature: 0.8,
+    });
+    expect(prismaMocks.aiUsageLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        reason: 'newton_chat_introduction',
+        model: 'command-a-03-2025',
+        metadata: { conversationId: 'conversation-1' },
+      }),
+    });
+  });
+
+  test('logs structured response usage for parsed responses', async () => {
+    responseParseMock.mockResolvedValue({
+      output_parsed: { score: 4 },
+      usage: {
+        input_tokens: 30,
+        output_tokens: 10,
+        total_tokens: 40,
+      },
+    });
+
+    const schema = z.object({ score: z.number() });
+    const result = await inference<{ score: number }>('Grade this', schema, {
+      reason: 'worksheet_autograde',
+      metadata: { worksheetResponseId: 'response-1' },
+    });
+
+    expect(result).toEqual({ score: 4 });
+    expect(prismaMocks.aiUsageLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        reason: 'worksheet_autograde',
+        operation: 'responses.parse',
+        success: true,
+        promptTokens: 30,
+        completionTokens: 10,
+        totalTokens: 40,
+        metadata: { worksheetResponseId: 'response-1' },
+      }),
+    });
+    expect(responseParseMock).toHaveBeenCalledWith({
+      model: 'gpt-5-nano',
+      input: [{
+        role: 'user',
+        content: [{ type: 'input_text', text: 'Grade this' }],
+      }],
+      text: {
+        format: expect.any(Object),
+      },
+    });
+  });
+
+  test('rejects ResponseInput content with input parts when format is missing', async () => {
+    await expect(
+      inference<string>([
+        {
+          role: 'user',
+          content: [
+            { type: 'input_text', text: 'Read this PDF' },
+            { type: 'input_file', file_url: 'https://storage.googleapis.com/bucket/file.pdf' },
+          ],
+        },
+      ] as any, undefined, {
+        reason: 'pdf_without_format',
+      }),
+    ).rejects.toThrow(
+      'normalizeInferenceInput cannot handle ResponseInput content with input_* parts when format is undefined; pass a format to use responses.parse.',
+    );
+
+    expect(chatCreateMock).not.toHaveBeenCalled();
+    expect(prismaMocks.aiUsageLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        reason: 'pdf_without_format',
+        operation: 'chat.completions',
+        success: false,
+      }),
+    });
+  });
+
+  test('logs failed attempts before rethrowing', async () => {
+    chatCreateMock.mockRejectedValue(new Error('OpenAI unavailable'));
+
+    await expect(
+      inference<string>('Hello there', undefined, {
+        reason: 'newton_chat_response',
+        metadata: { conversationId: 'conversation-1' },
+      }),
+    ).rejects.toThrow('OpenAI unavailable');
+
+    expect(prismaMocks.aiUsageLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        reason: 'newton_chat_response',
+        operation: 'chat.completions',
+        success: false,
+        estimatedInputTokens: estimateTokenCount('Hello there'),
+        error: 'OpenAI unavailable',
+        metadata: { conversationId: 'conversation-1' },
+      }),
+    });
+    expect(logger.error).toHaveBeenCalledWith(
+      'Failed to generate inference response',
+      expect.objectContaining({
+        reason: 'newton_chat_response',
+      }),
+    );
+  });
+});