@studious-lms/server 1.4.9 → 1.6.0

package/tests/integration/routers/worksheet.test.ts

@@ -0,0 +1,448 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { user1Caller, user2Caller, user3Caller } from "../setup";
+
+const expectTRPCError = async (promise: Promise<unknown>, code: string) => {
+  await expect(promise).rejects.toMatchObject({ code });
+};
+
+describe("Worksheet Router", () => {
+  let crudClass: any;
+  const createdWorksheetIds = new Set<string>();
+
+  beforeAll(async () => {
+    crudClass = await user1Caller.class.create({
+      name: "Worksheet Test Class",
+      subject: "Physics",
+      section: "12th Grade",
+    });
+  });
+
+  afterEach(async () => {
+    for (const worksheetId of Array.from(createdWorksheetIds)) {
+      await user1Caller.worksheet.deleteWorksheet({ worksheetId }).catch(() => undefined);
+      createdWorksheetIds.delete(worksheetId);
+    }
+  });
+
+  afterAll(async () => {
+    if (!crudClass?.id) return;
+
+    await user1Caller.class.delete({
+      classId: crudClass.id,
+      id: crudClass.id,
+    }).catch(() => undefined);
+  });
+
+  const createCrudWorksheet = async (name = "Chapter 1 Quiz") => {
+    const worksheet = await user1Caller.worksheet.create({
+      classId: crudClass.id,
+      name,
+    });
+    createdWorksheetIds.add(worksheet.id);
+    return worksheet;
+  };
+
+  const addShortAnswerQuestion = (worksheetId: string) =>
+    user1Caller.worksheet.addQuestion({
+      worksheetId,
+      question: "What is Newton's second law?",
+      answer: "F = ma",
+      points: 5,
+      type: "SHORT_ANSWER",
+    });
+
+  const addMultipleChoiceQuestion = (worksheetId: string) =>
+    user1Caller.worksheet.addQuestion({
+      worksheetId,
+      question: "What is the SI unit of force?",
+      answer: "Newton",
+      points: 3,
+      type: "MULTIPLE_CHOICE",
+      options: [
+        { id: "a", text: "Joule", isCorrect: false },
+        { id: "b", text: "Newton", isCorrect: true },
+        { id: "c", text: "Watt", isCorrect: false },
+        { id: "d", text: "Pascal", isCorrect: false },
+      ],
+    });
+
+  describe("create", () => {
+    test("should create a worksheet", async () => {
+      const worksheet = await createCrudWorksheet();
+
+      expect(worksheet).toBeDefined();
+      expect(worksheet.name).toBe("Chapter 1 Quiz");
+      expect(worksheet.classId).toBe(crudClass.id);
+    });
+  });
+
+  describe("listWorksheets", () => {
+    test("should list worksheets for a class", async () => {
+      const worksheet = await createCrudWorksheet();
+
+      const worksheets = await user1Caller.worksheet.listWorksheets({
+        classId: crudClass.id,
+      });
+
+      expect(Array.isArray(worksheets)).toBe(true);
+      expect(worksheets.length).toBeGreaterThanOrEqual(1);
+      expect(worksheets.some((w) => w.id === worksheet.id)).toBe(true);
+    });
+  });
+
+  describe("getWorksheet", () => {
+    test("should get a worksheet by ID", async () => {
+      const created = await createCrudWorksheet();
+
+      const worksheet = await user1Caller.worksheet.getWorksheet({
+        worksheetId: created.id,
+      });
+
+      expect(worksheet).toBeDefined();
+      expect(worksheet.id).toBe(created.id);
+      expect(worksheet.name).toBe("Chapter 1 Quiz");
+    });
+
+    test("should fail for non-existent worksheet", async () => {
+      await expect(
+        user1Caller.worksheet.getWorksheet({ worksheetId: "nonexistent" }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe("updateWorksheet", () => {
+    test("should update worksheet name", async () => {
+      const worksheet = await createCrudWorksheet();
+
+      const updated = await user1Caller.worksheet.updateWorksheet({
+        worksheetId: worksheet.id,
+        name: "Chapter 1 Test",
+      });
+
+      expect(updated.name).toBe("Chapter 1 Test");
+    });
+  });
+
+  describe("addQuestion", () => {
+    test("should add a short answer question", async () => {
+      const worksheet = await createCrudWorksheet();
+      const question = await addShortAnswerQuestion(worksheet.id);
+
+      expect(question).toBeDefined();
+      expect(question.question).toBe("What is Newton's second law?");
+      expect(question.answer).toBe("F = ma");
+      expect(question.points).toBe(5);
+    });
+
+    test("should add a multiple choice question", async () => {
+      const worksheet = await createCrudWorksheet();
+      const question = await addMultipleChoiceQuestion(worksheet.id);
+
+      expect(question).toBeDefined();
+      expect(question.type).toBe("MULTIPLE_CHOICE");
+    });
+
+    test("should fail for non-existent worksheet", async () => {
+      await expect(
+        user1Caller.worksheet.addQuestion({
+          worksheetId: "nonexistent",
+          question: "Test",
+          answer: "Test",
+          type: "SHORT_ANSWER",
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe("updateQuestion", () => {
+    test("should update a question", async () => {
+      const worksheet = await createCrudWorksheet();
+      const question = await addShortAnswerQuestion(worksheet.id);
+
+      const updated = await user1Caller.worksheet.updateQuestion({
+        worksheetId: worksheet.id,
+        questionId: question.id,
+        question: "State Newton's second law of motion.",
+        points: 10,
+      });
+
+      expect(updated.question).toBe("State Newton's second law of motion.");
+      expect(updated.points).toBe(10);
+    });
+  });
+
+  describe("reorderQuestions", () => {
+    test("should reorder questions", async () => {
+      const worksheet = await createCrudWorksheet();
+      const question = await addShortAnswerQuestion(worksheet.id);
+      const secondQuestion = await addMultipleChoiceQuestion(worksheet.id);
+
+      const result = await user1Caller.worksheet.reorderQuestions({
+        worksheetId: worksheet.id,
+        movedId: secondQuestion.id,
+        position: "before",
+        targetId: question.id,
+      });
+
+      expect(Array.isArray(result)).toBe(true);
+      expect(result.length).toBe(2);
+      expect(result.map((r) => r.id)).toEqual([
+        secondQuestion.id,
+        question.id,
+      ]);
+    });
+
+    test("should reject moving a question relative to itself", async () => {
+      const worksheet = await createCrudWorksheet();
+      const question = await addShortAnswerQuestion(worksheet.id);
+
+      await expectTRPCError(
+        user1Caller.worksheet.reorderQuestions({
+          worksheetId: worksheet.id,
+          movedId: question.id,
+          position: "before",
+          targetId: question.id,
+        }),
+        "BAD_REQUEST",
+      );
+    });
+  });
+
+  describe("deleteQuestion", () => {
+    test("should delete a question", async () => {
+      const worksheet = await createCrudWorksheet();
+      await addShortAnswerQuestion(worksheet.id);
+      const secondQuestion = await addMultipleChoiceQuestion(worksheet.id);
+
+      const result = await user1Caller.worksheet.deleteQuestion({
+        worksheetId: worksheet.id,
+        questionId: secondQuestion.id,
+      });
+
+      expect(result.id).toBe(secondQuestion.id);
+
+      const updatedWorksheet = await user1Caller.worksheet.getWorksheet({
+        worksheetId: worksheet.id,
+      });
+      expect(updatedWorksheet.questions.length).toBe(1);
+    });
+  });
+
+  describe("deleteWorksheet", () => {
+    test("should delete a worksheet", async () => {
+      const toDelete = await createCrudWorksheet("Temporary Worksheet");
+
+      const result = await user1Caller.worksheet.deleteWorksheet({
+        worksheetId: toDelete.id,
+      });
+      createdWorksheetIds.delete(toDelete.id);
+
+      expect(result.id).toBe(toDelete.id);
+    });
+  });
+});
+
+describe("Worksheet Router Security", () => {
+  let testClass: any;
+  let worksheet: any;
+  let question: any;
+  let multipleChoiceQuestion: any;
+  let submission: any;
+  let worksheetResponse: any;
+  let progressId: string;
+
+  beforeEach(async () => {
+    testClass = await user1Caller.class.create({
+      name: `Worksheet Security ${Date.now()}`,
+      subject: "Physics",
+      section: "12th Grade",
+    });
+
+    const user2Profile = await user2Caller.user.getProfile();
+    await user1Caller.class.addStudent({
+      classId: testClass.id,
+      studentId: user2Profile.id,
+    });
+
+    worksheet = await user1Caller.worksheet.create({
+      classId: testClass.id,
+      name: "Security Worksheet",
+    });
+
+    question = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is force?",
+      answer: "Mass times acceleration",
+      points: 5,
+      type: "SHORT_ANSWER",
+    });
+
+    multipleChoiceQuestion = await user1Caller.worksheet.addQuestion({
+      worksheetId: worksheet.id,
+      question: "What is the SI unit of force?",
+      answer: "newton",
+      points: 1,
+      type: "MULTIPLE_CHOICE",
+      options: [
+        { id: "a", text: "Joule", isCorrect: false },
+        { id: "b", text: "Newton", isCorrect: true },
+      ],
+    });
+
+    const dueDate = new Date();
+    dueDate.setDate(dueDate.getDate() + 7);
+
+    const assignment = await user1Caller.assignment.create({
+      classId: testClass.id,
+      title: "Worksheet Assignment",
+      instructions: "Complete the worksheet.",
+      dueDate: dueDate.toISOString(),
+      acceptWorksheet: true,
+      gradeWithAI: true,
+      worksheetIds: [worksheet.id],
+      type: "HOMEWORK",
+    });
+
+    submission = await user2Caller.assignment.getSubmission({
+      classId: testClass.id,
+      assignmentId: assignment.id,
+    });
+
+    worksheetResponse = await user2Caller.worksheet.getWorksheetSubmission({
+      worksheetId: worksheet.id,
+      submissionId: submission.id,
+    });
+
+    const answered = await user2Caller.worksheet.answerQuestion({
+      worksheetResponseId: worksheetResponse.id,
+      questionId: question.id,
+      response: "Mass times acceleration",
+    });
+
+    progressId = answered.responses[0].id;
+  });
+
+  afterEach(async () => {
+    if (!testClass?.id) return;
+
+    await user1Caller.class.delete({
+      classId: testClass.id,
+      id: testClass.id,
+    });
+
+    testClass = undefined;
+    worksheet = undefined;
+    question = undefined;
+    multipleChoiceQuestion = undefined;
+    submission = undefined;
+    worksheetResponse = undefined;
+    progressId = "";
+  });
+
+  test("redacts worksheet answers and correctness metadata for students", async () => {
+    const studentWorksheet = await user2Caller.worksheet.getWorksheet({
+      worksheetId: worksheet.id,
+    });
+
+    const shortAnswerQuestion = studentWorksheet.questions.find(
+      (item: any) => item.id === question.id,
+    );
+    expect(shortAnswerQuestion.answer).toBe("");
+    expect(shortAnswerQuestion.markScheme).toBeNull();
+
+    const studentMcq = studentWorksheet.questions.find(
+      (item: any) => item.id === multipleChoiceQuestion.id,
+    );
+    expect(studentMcq.answer).toBe("");
+    expect(studentMcq.options).toEqual([
+      { id: "a", text: "Joule" },
+      { id: "b", text: "Newton" },
+    ]);
+  });
+
+  test("blocks cross-class worksheet reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheet({ worksheetId: worksheet.id }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet submission reads by id", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.getWorksheetSubmission({
+        worksheetId: worksheet.id,
+        submissionId: submission.id,
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks cross-class worksheet answer mutations", async () => {
+    await expectTRPCError(
+      user3Caller.worksheet.answerQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        questionId: question.id,
+        response: "Unauthorized answer",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from teacher worksheet mutations", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.updateWorksheet({
+        worksheetId: worksheet.id,
+        name: "Student update",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addQuestion({
+        worksheetId: worksheet.id,
+        question: "Student-created question",
+        answer: "Nope",
+        type: "SHORT_ANSWER",
+      }),
+      "FORBIDDEN",
+    );
+  });
+
+  test("blocks students from grading and feedback actions", async () => {
+    await expectTRPCError(
+      user2Caller.worksheet.gradeAnswer({
+        questionId: question.id,
+        responseId: progressId,
+        studentWorksheetResponseId: worksheetResponse.id,
+        isCorrect: true,
+        feedback: "Nice work",
+        points: 5,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.addComment({
+        responseId: progressId,
+        comment: "Teacher feedback",
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.cancelGrading({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+
+    await expectTRPCError(
+      user2Caller.worksheet.regradeQuestion({
+        worksheetResponseId: worksheetResponse.id,
+        progressId,
+      }),
+      "FORBIDDEN",
+    );
+  });
+});

package/tests/{setup.ts → integration/setup.ts}

@@ -1,11 +1,11 @@
 import { execSync } from 'child_process';
 import { config } from 'dotenv';
 import { resolve } from 'path';
-import { prisma } from '../src/lib/prisma';
+import { prisma } from '../../src/lib/prisma';
 import { beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
-import { logger } from '../src/utils/logger';
-import { appRouter } from '../src/routers/_app';
-import { createTRPCContext } from '../src/trpc';
+import { logger } from '../../src/utils/logger';
+import { appRouter } from '../../src/routers/_app';
+import { createTRPCContext } from '../../src/trpc';
 import { Session, SessionType } from '@prisma/client';
 
 // Load test environment variables

package/tests/{lib → unit/lib}/cors.test.ts

@@ -4,7 +4,7 @@ import {
   isValidCorsOriginPatternList,
   parseCorsOriginPatterns,
   parseCorsOrigins,
-} from '../../src/lib/config/cors.js';
+} from '../../../src/lib/config/cors.js';
 
 describe('CORS configuration', () => {
   test('parses comma-separated origins while trimming empty entries', () => {

package/tests/{middleware → unit/middleware}/security.test.ts

@@ -6,7 +6,7 @@ import {
   authLimiter,
   uploadLimiter,
   helmetConfig,
-} from '../../src/middleware/security.js';
+} from '../../../src/middleware/security.js';
 
 describe('security middleware', () => {
   test('exports all middleware', () => {

package/tests/{pipelines → unit/pipelines}/aiLabChat.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "vitest";
 
-import { sliceMessagesThroughAnchor } from "../../src/pipelines/aiLabChat.js";
+import { sliceMessagesThroughAnchor } from "../../../src/pipelines/aiLabChat.js";
 
 describe("sliceMessagesThroughAnchor", () => {
   const messages = [

package/tests/{lib → unit/pipelines}/aiLabChatContract.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "vitest";
-import { labChatArrayFieldInstructions, labChatResponseFormat, labChatResponseSchema } from "../../src/pipelines/aiLabChatContract.js";
+import { labChatArrayFieldInstructions, labChatResponseFormat, labChatResponseSchema } from "../../../src/pipelines/aiLabChatContract.js";
 
 describe("aiLabChat contract", () => {
   test("defaults worksheet and section collections to empty arrays", () => {

package/tests/{utils/aiLabChatPrompt.test.ts → unit/pipelines/labChatPrompt.test.ts}

@@ -3,8 +3,8 @@ import { describe, expect, test } from "vitest";
 import {
   buildLabChatResponseMessages,
   buildLabChatSystemPrompt,
-} from "../../src/pipelines/labChatPrompt";
-import { labChatArrayFieldInstructions, labChatResponseFormat } from "../../src/pipelines/aiLabChatContract";
+} from "../../../src/pipelines/labChatPrompt";
+import { labChatArrayFieldInstructions, labChatResponseFormat } from "../../../src/pipelines/aiLabChatContract";
 
 describe("buildLabChatSystemPrompt", () => {
   test("requires arrays for worksheet and section structured output fields", () => {

package/tests/{utils → unit/services}/studentProgress.test.ts

@@ -11,19 +11,19 @@ const { prismaMocks, isTeacherInClass, inference, logger } = vi.hoisted(() => ({
   logger: { error: vi.fn() },
 }));
 
-vi.mock("../../src/lib/prisma.js", () => ({
+vi.mock("../../../src/lib/prisma.js", () => ({
   prisma: prismaMocks,
 }));
 
-vi.mock("../../src/models/class.js", () => ({
+vi.mock("../../../src/models/class.js", () => ({
   isTeacherInClass,
 }));
 
-vi.mock("../../src/utils/inference.js", () => ({
+vi.mock("../../../src/utils/inference.js", () => ({
   inference,
 }));
 
-vi.mock("../../src/utils/logger.js", () => ({
+vi.mock("../../../src/utils/logger.js", () => ({
   logger,
 }));
 
@@ -32,7 +32,7 @@ import {
   dismissStudentRecommendation,
   getClassProgressRecommendations,
   getStudentProgressRecommendations,
-} from "../../src/services/studentProgress.js";
+} from "../../../src/services/studentProgress.js";
 
 function createSubmission(overrides: Partial<any> = {}) {
   return {

package/tests/{utils → unit/utils}/aiUser.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from 'vitest';
-import { getAIUserId, isAIUser } from '../../src/utils/aiUser.js';
+import { getAIUserId, isAIUser } from '../../../src/utils/aiUser.js';
 
 describe('aiUser utils', () => {
   describe('getAIUserId', () => {

package/tests/{utils → unit/utils}/generateInviteCode.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from 'vitest';
-import { generateInviteCode } from '../../src/utils/generateInviteCode.js';
+import { generateInviteCode } from '../../../src/utils/generateInviteCode.js';
 
 describe('generateInviteCode', () => {
   test('returns a string of length 5', () => {

package/tests/{utils → unit/utils}/inference.test.ts

@@ -47,27 +47,27 @@ vi.mock('openai/helpers/zod', () => ({
   zodTextFormat: vi.fn((schema, name) => ({ schema, name })),
 }));
 
-vi.mock('../../src/lib/prisma.js', () => ({
+vi.mock('../../../src/lib/prisma.js', () => ({
   prisma: prismaMocks,
 }));
 
-vi.mock('../../src/utils/logger.js', () => ({
+vi.mock('../../../src/utils/logger.js', () => ({
   logger,
 }));
 
-vi.mock('../../src/lib/pusher.js', () => ({
+vi.mock('../../../src/lib/pusher.js', () => ({
   chatChannel: vi.fn(),
   pusher: {
     trigger: vi.fn(),
   },
 }));
 
-vi.mock('../../src/utils/aiUser.js', () => ({
+vi.mock('../../../src/utils/aiUser.js', () => ({
   ensureAIUserExists: vi.fn(),
   getAIUserId: vi.fn(() => 'AI_ASSISTANT'),
 }));
 
-vi.mock('../../src/lib/config/env.js', () => ({
+vi.mock('../../../src/lib/config/env.js', () => ({
   env: {
     INFERENCE_API_KEY: 'test-key',
     INFERENCE_API_BASE_URL: 'http://localhost:11434/v1',
@@ -75,7 +75,7 @@ vi.mock('../../src/lib/config/env.js', () => ({
   },
 }));
 
-import { estimateTokenCount, inference } from '../../src/utils/inference.js';
+import { estimateTokenCount, inference } from '../../../src/utils/inference.js';
 
 describe('inference', () => {
   beforeEach(() => {

package/tests/{utils → unit/utils}/logger.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect, vi, beforeEach, afterEach } from 'vitest';
-import { logger } from '../../src/utils/logger.js';
+import { logger } from '../../../src/utils/logger.js';
 
 describe('Logger', () => {
   let consoleSpy: { log: ReturnType<typeof vi.spyOn>; warn: ReturnType<typeof vi.spyOn>; error: ReturnType<typeof vi.spyOn>; debug: ReturnType<typeof vi.spyOn> };

package/tests/{utils → unit/utils}/prismaErrorHandler.test.ts

@@ -2,7 +2,7 @@ import { describe, test, expect } from 'vitest';
 import {
   handlePrismaError,
   getFieldDisplayName,
-} from '../../src/utils/prismaErrorHandler.js';
+} from '../../../src/utils/prismaErrorHandler.js';
 import {
   PrismaClientKnownRequestError,
   PrismaClientValidationError,

package/tests/{utils → unit/utils}/prismaWrapper.test.ts

@@ -2,7 +2,7 @@ import { describe, test, expect, vi } from 'vitest';
 import {
   withPrismaErrorHandling,
   prismaWrapper,
-} from '../../src/utils/prismaWrapper.js';
+} from '../../../src/utils/prismaWrapper.js';
 import { TRPCError } from '@trpc/server';
 import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
 

package/vitest.config.ts

@@ -5,15 +5,23 @@ import { resolve } from 'path';
 // Load test environment variables before anything else
 config({ path: resolve(process.cwd(), '.env.test'), override: true });
 
+/**
+ * Integration test config — real Postgres via globalSetup, shared tRPC callers
+ * via setupFiles. Tests that mock external services (e.g. OpenAI) at the module
+ * boundary are still integration tests if they import setup.ts; they live here.
+ *
+ * Use: npm test (default) or npm run test:run.
+ * For pure unit tests, use: npm run test:unit.
+ */
 export default defineConfig({
   test: {
     globals: true,
     environment: 'node',
     hookTimeout: 60000, // 60 seconds
     testTimeout: 30000, // 30 seconds per test
-    include: ['tests/**/*.test.ts'],
-    globalSetup: ['./tests/globalSetup.ts'],
-    setupFiles: ['./tests/setup.ts'],
+    include: ['tests/integration/**/*.test.ts'],
+    globalSetup: ['./tests/integration/globalSetup.ts'],
+    setupFiles: ['./tests/integration/setup.ts'],
     sequence: {
       concurrent: false,
     },