fix(mcp): fix tool bugs and add missing CRUD operations

- Add tenant_id to lms_create_lesson and lms_create_exercise inserts
- Fix lms_create_exam: exam_date was NOT NULL in DB but optional in tool — add migration to make it nullable
- Fix lms_get_exam: order questions by question_id for deterministic output
- Fix lms_upsert_lesson_ai_task: validate at least one field provided
- Fix lms_get_lesson_ai_task: use maybeSingle() to distinguish DB errors from missing row
- Fix lms_delete_exam_question: correct idempotentHint to false
- Fix lms_add_exam_question and lms_create_exam: validate multiple_choice/true_false questions have options
- Fix lms_list_templates: scope to system templates + own templates (was returning all tenants' data)
- Add lms_delete_lesson, lms_delete_exam, lms_delete_exercise tools
- Add lms_get_lesson_ai_task tool
- Fix changed_by NOT NULL violation when MCP service role updates lessons/exams

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: guillermoscript

mcp-server/src/tools/exams.ts

@@ -153,6 +153,7 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
             )`
           )
           .eq("exam_id", exam_id)
+          .order("question_id", { referencedTable: "exam_questions" })
           .single();
 
         if (error || !data) return errorResult(`Exam ${exam_id} not found.`);
@@ -294,6 +295,11 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
 
         for (let i = 0; i < questions.length; i++) {
           const q = questions[i];
+          if ((q.question_type === "multiple_choice" || q.question_type === "true_false") && (!q.options || q.options.length === 0)) {
+            errors.push(`Q${i + 1}: type '${q.question_type}' requires at least one option`);
+            continue;
+          }
+
           const { data: question, error: qError } = await supabase
             .from("exam_questions")
             .insert({
@@ -446,6 +452,10 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
     },
     async ({ exam_id, question_text, question_type, options, ai_grading_criteria, expected_keywords }) => {
       try {
+        if ((question_type === "multiple_choice" || question_type === "true_false") && (!options || options.length === 0)) {
+          return errorResult(`Questions of type '${question_type}' require at least one option.`);
+        }
+
         await auth.verifyExamOwnership(exam_id);
         const supabase = auth.getClient();
 
@@ -564,6 +574,44 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
     }
   );
 
+  server.registerTool(
+    "lms_delete_exam",
+    {
+      title: "Delete Exam",
+      description:
+        "Permanently delete an exam and all its questions, options, and submissions. This action is irreversible. Only use on draft exams or when sure there are no important submissions.",
+      inputSchema: z.object({ exam_id: z.number().describe("The exam ID to delete") }).strict(),
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true,
+      },
+    },
+    async ({ exam_id }) => {
+      try {
+        await auth.verifyExamOwnership(exam_id);
+        const supabase = auth.getClient();
+
+        const { data: exam } = await supabase
+          .from("exams")
+          .select("title")
+          .eq("exam_id", exam_id)
+          .single();
+
+        const { error } = await supabase.from("exams").delete().eq("exam_id", exam_id);
+        if (error) return errorResult(`Deleting exam: ${error.message}`);
+
+        return {
+          content: [{ type: "text", text: `Exam "${exam?.title ?? exam_id}" (ID: ${exam_id}) and all its questions have been deleted.` }],
+          structuredContent: { success: true, deleted_exam_id: exam_id },
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
   server.registerTool(
     "lms_delete_exam_question",
     {
@@ -573,7 +621,7 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
       annotations: {
         readOnlyHint: false,
         destructiveHint: true,
-        idempotentHint: true,
+        idempotentHint: false,
         openWorldHint: true,
       },
     },

mcp-server/src/tools/exercises.ts

@@ -212,7 +212,10 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
     async ({ category }) => {
       try {
         const supabase = auth.getClient();
-        let query = supabase.from("prompt_templates").select("id, name, category, description, variables");
+        let query = supabase
+          .from("prompt_templates")
+          .select("id, name, category, description, variables")
+          .or(`is_system.eq.true,created_by.eq.${auth.getUserId()}`);
         if (category) query = query.eq("category", category);
 
         const { data, error } = await query;
@@ -324,6 +327,7 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
             system_prompt: finalSystemPrompt,
             time_limit: time_limit ?? null,
             created_by: auth.getUserId(),
+            tenant_id: auth.getTenantId(),
             template_id: template_id ?? null,
             template_variables: template_variables ?? null,
           })
@@ -352,6 +356,43 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
     }
   );
 
+  server.registerTool(
+    "lms_delete_exercise",
+    {
+      title: "Delete Exercise",
+      description: "Permanently delete a practice exercise. This action is irreversible.",
+      inputSchema: z.object({ exercise_id: z.number().describe("The exercise ID to delete") }).strict(),
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true,
+      },
+    },
+    async ({ exercise_id }) => {
+      try {
+        await auth.verifyExerciseOwnership(exercise_id);
+        const supabase = auth.getClient();
+
+        const { data: exercise } = await supabase
+          .from("exercises")
+          .select("title")
+          .eq("id", exercise_id)
+          .single();
+
+        const { error } = await supabase.from("exercises").delete().eq("id", exercise_id);
+        if (error) return errorResult(`Deleting exercise: ${error.message}`);
+
+        return {
+          content: [{ type: "text", text: `Exercise "${exercise?.title ?? exercise_id}" (ID: ${exercise_id}) has been deleted.` }],
+          structuredContent: { success: true, deleted_exercise_id: exercise_id },
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
   server.registerTool(
     "lms_update_exercise",
     {

mcp-server/src/tools/lessons.ts

@@ -210,6 +210,7 @@ export function registerLessonTools(server: McpServer, auth: AuthManager) {
             description: description ?? null,
             video_url: video_url || null,
             status: "draft",
+            tenant_id: auth.getTenantId(),
           })
           .select("id, title, sequence, status")
           .single();
@@ -350,6 +351,92 @@ export function registerLessonTools(server: McpServer, auth: AuthManager) {
     }
   );
 
+  server.registerTool(
+    "lms_delete_lesson",
+    {
+      title: "Delete Lesson",
+      description:
+        "Permanently delete a lesson and its associated AI task. This is irreversible. Student completion records for this lesson will also be removed.",
+      inputSchema: z.object({ lesson_id: z.number().describe("The lesson ID to delete") }).strict(),
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true,
+      },
+    },
+    async ({ lesson_id }) => {
+      try {
+        await auth.verifyLessonOwnership(lesson_id);
+        const supabase = auth.getClient();
+
+        const { data: lesson } = await supabase
+          .from("lessons")
+          .select("title")
+          .eq("id", lesson_id)
+          .single();
+
+        const { error } = await supabase.from("lessons").delete().eq("id", lesson_id);
+        if (error) return errorResult(`Deleting lesson: ${error.message}`);
+
+        return {
+          content: [{ type: "text", text: `Lesson "${lesson?.title ?? lesson_id}" (ID: ${lesson_id}) has been deleted.` }],
+          structuredContent: { success: true, deleted_lesson_id: lesson_id },
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
+  server.registerTool(
+    "lms_get_lesson_ai_task",
+    {
+      title: "Get Lesson AI Task",
+      description: "Get the AI task (instructions and system prompt) configured for a lesson.",
+      inputSchema: z
+        .object({
+          lesson_id: z.number().describe("The lesson ID"),
+        })
+        .strict(),
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true,
+      },
+    },
+    async ({ lesson_id }) => {
+      try {
+        await auth.verifyLessonOwnership(lesson_id);
+        const supabase = auth.getClient();
+
+        const { data, error } = await supabase
+          .from("lessons_ai_tasks")
+          .select("id, lesson_id, task_instructions, system_prompt, created_at, updated_at")
+          .eq("lesson_id", lesson_id)
+          .maybeSingle();
+
+        if (error) return errorResult(`Getting AI task: ${error.message}`);
+        if (!data) {
+          return { content: [{ type: "text", text: `No AI task configured for lesson ${lesson_id}.` }] };
+        }
+
+        return {
+          content: [
+            {
+              type: "text",
+              text: `# AI Task for Lesson ${lesson_id}\n\n**Task Instructions:**\n${data.task_instructions ?? "(not set)"}\n\n**System Prompt:**\n${data.system_prompt ?? "(not set)"}`,
+            },
+          ],
+          structuredContent: data,
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
   // Tool to create or update the AI task attached to a lesson
   server.registerTool(
     "lms_upsert_lesson_ai_task",
@@ -372,6 +459,10 @@ export function registerLessonTools(server: McpServer, auth: AuthManager) {
     },
     async ({ lesson_id, task_instructions, system_prompt }) => {
       try {
+        if (!task_instructions && !system_prompt) {
+          return errorResult("At least one of task_instructions or system_prompt must be provided.");
+        }
+
         // Verify teacher owns the lesson (or is admin)
         await auth.verifyLessonOwnership(lesson_id);
         const supabase = auth.getClient();