plan updates

Author: rschlaefli

apps/chat/src/app/api/chatbots/[chatbotId]/credits/route.ts

@@ -3,6 +3,7 @@ import {
   getChatModelRegistry,
 } from '@/src/lib/server/chatModelRegistry'
 import { CreditsService } from '@/src/services/credits'
+import { prisma } from '@klicker-uzh/prisma'
 import { JWTPayload, jwtVerify } from 'jose'
 import { NextRequest, NextResponse } from 'next/server'
 
@@ -49,6 +50,37 @@ export async function GET(
     )
   }
 
+  // check participation
+  try {
+    const participation = await prisma.participation.findUnique({
+      where: {
+        courseId_participantId: {
+          courseId:
+            (
+              await prisma.chatbot.findUnique({
+                where: { id: chatbotId },
+                select: { courseId: true },
+              })
+            )?.courseId ?? '',
+          participantId: participantId,
+        },
+      },
+    })
+
+    if (!participation) {
+      return NextResponse.json(
+        { error: 'No valid participation found for this chatbot' },
+        { status: 403 }
+      )
+    }
+  } catch (error) {
+    console.error('Error checking participation:', error)
+    return NextResponse.json(
+      { error: 'Error checking participation' },
+      { status: 500 }
+    )
+  }
+
   try {
     const credits = await CreditsService.getUserCredits(
       participantId as string,

apps/chat/src/app/api/chatbots/[chatbotId]/disclaimer/route.ts

@@ -1,4 +1,5 @@
 import { DisclaimersService } from '@/src/services/disclaimers'
+import { prisma } from '@klicker-uzh/prisma'
 import { jwtVerify, type JWTPayload } from 'jose'
 import { NextRequest, NextResponse } from 'next/server'
 
@@ -47,6 +48,37 @@ export async function GET(
     )
   }
 
+  // check participation
+  try {
+    const participation = await prisma.participation.findUnique({
+      where: {
+        courseId_participantId: {
+          courseId:
+            (
+              await prisma.chatbot.findUnique({
+                where: { id: chatbotId },
+                select: { courseId: true },
+              })
+            )?.courseId ?? '',
+          participantId: participantId,
+        },
+      },
+    })
+
+    if (!participation) {
+      return NextResponse.json(
+        { error: 'No valid participation found for this chatbot' },
+        { status: 403 }
+      )
+    }
+  } catch (error) {
+    console.error('Error checking participation:', error)
+    return NextResponse.json(
+      { error: 'Error checking participation' },
+      { status: 500 }
+    )
+  }
+
   try {
     // Get disclaimer for chatbot
     const disclaimer =
@@ -114,6 +146,37 @@ export async function POST(
     )
   }
 
+  // check participation
+  try {
+    const participation = await prisma.participation.findUnique({
+      where: {
+        courseId_participantId: {
+          courseId:
+            (
+              await prisma.chatbot.findUnique({
+                where: { id: chatbotId },
+                select: { courseId: true },
+              })
+            )?.courseId ?? '',
+          participantId: participantId,
+        },
+      },
+    })
+
+    if (!participation) {
+      return NextResponse.json(
+        { error: 'No valid participation found for this chatbot' },
+        { status: 403 }
+      )
+    }
+  } catch (error) {
+    console.error('Error checking participation:', error)
+    return NextResponse.json(
+      { error: 'Error checking participation' },
+      { status: 500 }
+    )
+  }
+
   try {
     const body = await req.json()
     const { action, disclaimerId } = body

apps/frontend-control/next.config.mjs

@@ -42,6 +42,10 @@ let nextConfig = {
   },
 }
 
+nextConfig.transpilePackages = Array.from(
+  new Set([...(nextConfig.transpilePackages ?? []), 'formik'])
+)
+
 if (process.env.NODE_ENV !== 'test') {
   const withPWA = withPWAInit(
     getNextPWAConfig({ NODE_ENV: process.env.NODE_ENV })

apps/frontend-manage/next.config.mjs

@@ -22,6 +22,10 @@ let nextConfig = {
   },
 }
 
+nextConfig.transpilePackages = Array.from(
+  new Set([...(nextConfig.transpilePackages ?? []), 'formik'])
+)
+
 if (process.env.NODE_ENV !== 'test') {
   const withPWA = withPWAInit(
     getNextPWAConfig({ NODE_ENV: process.env.NODE_ENV })

apps/frontend-pwa/next.config.mjs

@@ -12,6 +12,10 @@ let nextConfig = {
   }),
 }
 
+nextConfig.transpilePackages = Array.from(
+  new Set([...(nextConfig.transpilePackages ?? []), 'formik'])
+)
+
 if (process.env.NODE_ENV !== 'test') {
   const withPWA = withPWAInit(
     getNextPWAConfig({ NODE_ENV: process.env.NODE_ENV })

packages/graphql/src/services/courses.ts

@@ -157,28 +157,24 @@ export async function ensureParticipation(
   try {
     const course = await ctx.prisma.course.findUnique({
       where: { id: courseId },
-      select: { id: true, isAssessmentEnabled: true },
+      select: { id: true },
     })
 
-    if (!course || course.isAssessmentEnabled) {
+    if (!course) {
       return false
     }
 
-    await ctx.prisma.participation.upsert({
+    const participation = await ctx.prisma.participation.findUnique({
       where: {
         courseId_participantId: {
           courseId,
           participantId: ctx.user.sub,
         },
       },
-      create: {
-        course: { connect: { id: courseId } },
-        participant: { connect: { id: ctx.user.sub } },
-      },
-      update: {},
+      select: { id: true },
     })
 
-    return true
+    return participation !== null
   } catch (error) {
     console.error('ensureParticipation failed', {
       courseId,

project/plans_archive/PLAN-chat-credits.md

@@ -7,6 +7,7 @@
 **Done on this branch**
 - Persisted and displayed per-message `creditsUsed` (computed from token usage), enabling cost auditing per assistant response.
 - Credits initialization/reset exists server-side via scalar chatbot fields + fixed-period logic (this differs from the JSON sketch in this doc).
+- Credits endpoint now enforces course membership (403 for non-members).
 
 **Remaining**
 - Reconcile this plan with the current implementation so it matches reality.

project/plans_archive/PLAN-chatbot-disclaimer.md

@@ -9,6 +9,7 @@ This plan outlines the implementation of a comprehensive disclaimer system for K
 **Done on this branch**
 - Implemented disclaimer read + accept/decline endpoints (`/api/chatbots/[chatbotId]/disclaimer`) with acceptance tracked in `ChatUsageCredits`.
 - Enforced disclaimer acceptance in the main chat send endpoint (blocks usage when required + not accepted).
+- Disclaimer GET/POST now enforce course membership.
 
 **Remaining**
 - Enforce disclaimer guard consistently across other endpoints (threads/messages/credits) and return `428 Precondition Required` with remediation info as per this plan.