@allbluecn/admin-app 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allbluecn/admin-app",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "private": false,
   "license": "AGPL-3.0-or-later",
   "type": "module",
@@ -30,7 +30,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.4.0",
-    "lucide-react": "^1.27.0",
+    "lucide-react": "^1.43.0",
     "motion": "^12.42.2",
     "next-themes": "^0.4.6",
     "radix-ui": "^1.4.3",
@@ -42,9 +42,9 @@
     "start-authjs": "^1.0.2",
     "tailwind-merge": "^3.5.0",
     "zod": "^4.4.3",
-    "@allbluecn/database": "0.5.0",
-    "@allbluecn/kernel": "0.6.0",
-    "@allbluecn/web-app": "0.10.3"
+    "@allbluecn/database": "0.6.0",
+    "@allbluecn/kernel": "0.6.1",
+    "@allbluecn/web-app": "0.11.0"
   },
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.40.1",
@@ -54,19 +54,22 @@
     "@tailwindcss/vite": "^4.3.2",
     "@tanstack/react-query-devtools": "5.102.8",
     "@tanstack/react-router-devtools": "1.167.1",
+    "@testing-library/jest-dom": "7.0.1",
+    "@testing-library/react": "^16.3.2",
     "@types/bcryptjs": "^2.4.6",
     "@types/node": "^24.13.3",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "5.0.0",
     "eslint": "^9",
+    "jsdom": "^29.1.1",
     "nitro": "3.0.260903-beta",
     "shadcn": "^4.15.0",
     "tailwindcss": "^4",
     "typescript": "^7",
     "vite": "^8.1.5",
-    "vitest": "^4.1.10",
+    "vitest": "5.0.0",
     "wrangler": "^4.99.0"
   },
   "files": [
@@ -81,6 +84,8 @@
     "build": "node scripts/i18n/compile.mjs && vite build && if [ -d .output/server ]; then cp instrument.server.mjs .output/server; fi",
     "start": "node --import ./.output/server/instrument.server.mjs .output/server/index.mjs",
     "lint": "eslint",
-    "typecheck": "node scripts/i18n/compile.mjs && tsc --noEmit"
+    "typecheck": "node scripts/i18n/compile.mjs && tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run"
   }
 }

package/src/__tests__/components/provider-icon.test.tsx

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi } from 'vitest'
+import { render } from '@testing-library/react'
+
+// @lobehub/icons 是数百个品牌图标的聚合包，dynamic import 会拖慢 vitest 且
+// 测试目标是 fallback 渲染路径；mock 为空对象使 mod[lobeName] 为 undefined，
+// ProviderLogo 走 InitialFallback 分支（与"平台下架的 provider"真实行为一致）。
+vi.mock('@lobehub/icons', () => ({}))
+
+import { ProviderIcon } from '../../components/ai-provider/provider-icon'
+
+describe('ProviderIcon', () => {
+  it('按 size 设置容器内联宽高', () => {
+    const { container } = render(
+      <ProviderIcon
+        provider={{ providerId: 'deprecated-vendor', brandName: 'Deprecated Vendor' }}
+        size={56}
+      />
+    )
+    const box = container.querySelector('div')
+    expect(box).not.toBeNull()
+    expect(box).toHaveStyle({ width: '56px', height: '56px' })
+  })
+
+  it('未知 providerId 时回落到品牌名首字母', () => {
+    const { container } = render(
+      <ProviderIcon
+        provider={{ providerId: 'deprecated-vendor', brandName: 'Deprecated Vendor' }}
+      />
+    )
+    expect(container.textContent).toContain('D')
+  })
+
+  it('透传 className 到容器', () => {
+    const { container } = render(
+      <ProviderIcon
+        provider={{ providerId: 'deprecated-vendor', brandName: 'Deprecated Vendor' }}
+        className="mt-4"
+      />
+    )
+    expect(container.querySelector('div')).toHaveClass('mt-4')
+  })
+})

package/src/__tests__/setup.ts

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/// <reference types="vitest/globals" />
+import '@testing-library/jest-dom/vitest'
+
+import { overwriteGetLocale } from '@/paraglide/runtime.js'
+
+// jsdom 无 ResizeObserver（@tanstack/charts、虚拟滚动等库模块加载时引用）
+if (typeof globalThis.ResizeObserver === 'undefined') {
+  globalThis.ResizeObserver = class ResizeObserver {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  } as unknown as typeof globalThis.ResizeObserver
+}
+
+beforeAll(() => {
+  // jsdom 的 navigator.language 为 en-US，会导致中文文案断言失败
+  overwriteGetLocale(() => 'zh')
+})

package/src/server/__tests__/admin-billing.test.ts

@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({}),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    subscription: {
+      findMany: vi.fn(),
+      count: vi.fn(),
+      findUnique: vi.fn(),
+    },
+    invoice: {
+      findMany: vi.fn(),
+      count: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAdmin: vi.fn().mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } }),
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import {
+  listAllSubscriptionsFn,
+  getSubscriptionDetailFn,
+  listAllInvoicesFn,
+} from '../serverFns/admin-billing'
+
+const subscription = prisma.subscription as unknown as {
+  findMany: ReturnType<typeof vi.fn>
+  count: ReturnType<typeof vi.fn>
+  findUnique: ReturnType<typeof vi.fn>
+}
+const invoice = prisma.invoice as unknown as {
+  findMany: ReturnType<typeof vi.fn>
+  count: ReturnType<typeof vi.fn>
+}
+const requireAdminMock = requireAdmin as unknown as ReturnType<typeof vi.fn>
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  requireAdminMock.mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } })
+  subscription.findMany.mockResolvedValue([])
+  subscription.count.mockResolvedValue(0)
+  invoice.findMany.mockResolvedValue([])
+  invoice.count.mockResolvedValue(0)
+})
+
+describe('listAllSubscriptionsFn', () => {
+  it('非管理员拒绝：requireAdmin 抛错时零 prisma 调用', async () => {
+    requireAdminMock.mockRejectedValue(new Error('not admin'))
+
+    await expect(listAllSubscriptionsFn({ data: {} })).rejects.toThrow('not admin')
+    expect(subscription.findMany).not.toHaveBeenCalled()
+    expect(subscription.count).not.toHaveBeenCalled()
+  })
+
+  it('默认分页：page=1 pageSize=20 时 skip=0 take=20', async () => {
+    await listAllSubscriptionsFn({ data: {} })
+
+    expect(subscription.findMany).toHaveBeenCalledWith({
+      where: {},
+      include: { plan: true, workspace: true },
+      orderBy: { createdAt: 'desc' },
+      skip: 0,
+      take: 20,
+    })
+  })
+
+  it('search 按工作空间名模糊匹配（管理员全局检索入口）', async () => {
+    await listAllSubscriptionsFn({ data: { search: 'acme' } })
+
+    const arg = subscription.findMany.mock.calls[0][0]
+    expect(arg.where.OR).toEqual([{ workspace: { name: { contains: 'acme' } } }])
+    expect(subscription.count).toHaveBeenCalledWith({
+      where: { OR: [{ workspace: { name: { contains: 'acme' } } }] },
+    })
+  })
+
+  it('plan 与 status 组合过滤同时生效', async () => {
+    await listAllSubscriptionsFn({ data: { plan: 'pro', status: 'active' } })
+
+    expect(subscription.findMany.mock.calls[0][0].where).toEqual({
+      planId: 'pro',
+      status: 'active',
+    })
+  })
+
+  it('分页偏移正确计算（page=3 pageSize=10 → skip=20）', async () => {
+    await listAllSubscriptionsFn({ data: { page: 3, pageSize: 10 } })
+
+    const arg = subscription.findMany.mock.calls[0][0]
+    expect(arg.skip).toBe(20)
+    expect(arg.take).toBe(10)
+  })
+})
+
+describe('getSubscriptionDetailFn', () => {
+  it('按 subscriptionId 查详情并附带发票列表', async () => {
+    subscription.findUnique.mockResolvedValue({ id: 'sub-1' })
+
+    const res = await getSubscriptionDetailFn({ data: { subscriptionId: 'sub-1' } })
+
+    expect(subscription.findUnique).toHaveBeenCalledWith({
+      where: { id: 'sub-1' },
+      include: {
+        plan: true,
+        workspace: true,
+        invoices: { orderBy: { createdAt: 'desc' } },
+      },
+    })
+    expect(res).toEqual({ id: 'sub-1' })
+  })
+
+  it('非管理员拒绝：不触达 subscription 查询', async () => {
+    requireAdminMock.mockRejectedValue(new Error('not admin'))
+
+    await expect(
+      getSubscriptionDetailFn({ data: { subscriptionId: 'sub-1' } }),
+    ).rejects.toThrow('not admin')
+    expect(subscription.findUnique).not.toHaveBeenCalled()
+  })
+})
+
+describe('listAllInvoicesFn', () => {
+  it('按 createdAt 降序分页并附带订阅归属信息', async () => {
+    await listAllInvoicesFn({ data: { page: 2, pageSize: 5 } })
+
+    expect(invoice.findMany).toHaveBeenCalledWith({
+      orderBy: { createdAt: 'desc' },
+      include: { subscription: { include: { workspace: true, plan: true } } },
+      skip: 5,
+      take: 5,
+    })
+    // 发票总数不受分页影响
+    expect(invoice.count).toHaveBeenCalledWith()
+  })
+})

package/src/server/__tests__/compliance.test.ts

@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({}),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    complianceExport: {
+      findMany: vi.fn(),
+      count: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAdmin: vi.fn().mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } }),
+}))
+
+vi.mock('@/server/entitlements', () => ({
+  requireFeature: vi.fn().mockResolvedValue(undefined),
+}))
+
+const services = vi.hoisted(() => new Map<string, unknown>())
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => services.get(key) ?? null,
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { requireFeature } from '@/server/entitlements'
+import { listComplianceExportsFn } from '../serverFns/compliance'
+
+const complianceExport = prisma.complianceExport as unknown as {
+  findMany: ReturnType<typeof vi.fn>
+  count: ReturnType<typeof vi.fn>
+}
+
+describe('listComplianceExportsFn（admin 合规导出任务列表）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    services.clear()
+  })
+
+  it('Pro 服务注册时委派给 Pro 实现', async () => {
+    const listJobs = vi.fn().mockResolvedValue({ items: ['pro-job'], total: 1 })
+    services.set('compliance', { listJobs })
+
+    const result = await listComplianceExportsFn({ data: { page: 1, pageSize: 20 } })
+
+    expect(listJobs).toHaveBeenCalledWith({ page: 1, pageSize: 20 })
+    expect(result).toEqual({ items: ['pro-job'], total: 1 })
+    // Pro 路径不应触达 prisma
+    expect(complianceExport.findMany).not.toHaveBeenCalled()
+  })
+
+  it('Pro 服务缺省时走 prisma 分页查询，skip/take 按页计算', async () => {
+    const items = [{ id: 'e-1' }]
+    complianceExport.findMany.mockResolvedValue(items)
+    complianceExport.count.mockResolvedValue(42)
+
+    const result = await listComplianceExportsFn({ data: { page: 3, pageSize: 10 } })
+
+    expect(complianceExport.findMany).toHaveBeenCalledWith({
+      orderBy: { createdAt: 'desc' },
+      skip: 20,
+      take: 10,
+    })
+    expect(complianceExport.count).toHaveBeenCalledWith()
+    expect(result).toEqual({ items, total: 42 })
+  })
+
+  it('未传分页参数时使用默认值（page=1, pageSize=20）', async () => {
+    complianceExport.findMany.mockResolvedValue([])
+    complianceExport.count.mockResolvedValue(0)
+
+    await listComplianceExportsFn({ data: {} })
+
+    expect(complianceExport.findMany).toHaveBeenCalledWith({
+      orderBy: { createdAt: 'desc' },
+      skip: 0,
+      take: 20,
+    })
+  })
+
+  it('查询前强制管理员身份与合规功能授权', async () => {
+    complianceExport.findMany.mockResolvedValue([])
+    complianceExport.count.mockResolvedValue(0)
+
+    await listComplianceExportsFn({ data: { page: 1, pageSize: 20 } })
+
+    expect(requireAdmin).toHaveBeenCalledTimes(1)
+    expect(requireFeature).toHaveBeenCalledWith({}, 'compliance')
+  })
+})

package/src/server/__tests__/permissions.test.ts

@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({}),
+}))
+
+// prisma mock 必须覆盖被测模块触达的全部 model 键——缺一个会在用例内
+// 报 "Cannot read properties of undefined"（见 memrec vitest-mock 陷阱）
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    customRole: {
+      count: vi.fn(),
+      create: vi.fn(),
+      findMany: vi.fn(),
+      findFirst: vi.fn(),
+      delete: vi.fn(),
+    },
+    user: {
+      findMany: vi.fn(),
+    },
+    roleAssignment: {
+      count: vi.fn(),
+      create: vi.fn(),
+      createMany: vi.fn(),
+      delete: vi.fn(),
+      findMany: vi.fn(),
+    },
+    workspace: {
+      findMany: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAdmin: vi.fn().mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } }),
+}))
+
+vi.mock('@/server/entitlements', () => ({
+  requireFeature: vi.fn().mockResolvedValue(undefined),
+}))
+
+const services = vi.hoisted(() => new Map<string, unknown>())
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => services.get(key) ?? null,
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { requireFeature } from '@/server/entitlements'
+import {
+  listRolesFn,
+  createRoleFn,
+  deleteRoleFn,
+  assignRoleFn,
+  unassignRoleFn,
+  listRoleAssignmentsFn,
+  listWorkspacesFn,
+} from '../serverFns/permissions'
+
+const customRole = prisma.customRole as unknown as {
+  count: ReturnType<typeof vi.fn>
+  create: ReturnType<typeof vi.fn>
+  findMany: ReturnType<typeof vi.fn>
+  findFirst: ReturnType<typeof vi.fn>
+  delete: ReturnType<typeof vi.fn>
+}
+const userMock = prisma.user as unknown as { findMany: ReturnType<typeof vi.fn> }
+const roleAssignment = prisma.roleAssignment as unknown as {
+  count: ReturnType<typeof vi.fn>
+  create:ReturnType<typeof vi.fn>
+  createMany: ReturnType<typeof vi.fn>
+  delete: ReturnType<typeof vi.fn>
+  findMany: ReturnType<typeof vi.fn>
+}
+const workspaceMock = prisma.workspace as unknown as { findMany: ReturnType<typeof vi.fn> }
+const requireAdminMock = requireAdmin as unknown as ReturnType<typeof vi.fn>
+const requireFeatureMock = requireFeature as unknown as ReturnType<typeof vi.fn>
+
+const WS = 'ws-1'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  services.clear()
+  requireAdminMock.mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } })
+  requireFeatureMock.mockResolvedValue(undefined)
+  customRole.count.mockResolvedValue(0)
+  customRole.findMany.mockResolvedValue([])
+  customRole.findFirst.mockResolvedValue(null)
+  userMock.findMany.mockResolvedValue([])
+})
+
+describe('listRolesFn', () => {
+  it('非管理员拒绝：requireAdmin 抛错时零 prisma 调用', async () => {
+    requireAdminMock.mockRejectedValue(new Error('not admin'))
+
+    await expect(listRolesFn({ data: { workspaceId: WS } })).rejects.toThrow('not admin')
+    expect(customRole.count).not.toHaveBeenCalled()
+    expect(customRole.findMany).not.toHaveBeenCalled()
+  })
+
+  it('feature 未开通拒绝：requireFeature 抛错时零 prisma 调用', async () => {
+    requireFeatureMock.mockRejectedValue(new Error('locked'))
+
+    await expect(listRolesFn({ data: { workspaceId: WS } })).rejects.toThrow('locked')
+    expect(customRole.count).not.toHaveBeenCalled()
+  })
+
+  it('只查指定 workspaceId（跨租户隔离，不泄露其他 workspace 角色）', async () => {
+    customRole.count.mockResolvedValue(3)
+    customRole.findMany.mockResolvedValue([{ id: 'role-1', name: 'owner' }])
+
+    const res = await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.findMany).toHaveBeenCalledWith({
+      where: { workspaceId: WS },
+      include: { _count: { select: { assignments: true } } },
+      orderBy: { createdAt: 'desc' },
+    })
+    expect(customRole.count).toHaveBeenCalledWith({ where: { workspaceId: WS } })
+    expect(res).toEqual({ items: [{ id: 'role-1', name: 'owner' }], total: 3, seeded: 'done' })
+  })
+
+  it('已有系统角色时跳过种子化（不重复创建预设）', async () => {
+    customRole.count.mockResolvedValue(5)
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.create).not.toHaveBeenCalled()
+    expect(roleAssignment.createMany).not.toHaveBeenCalled()
+  })
+
+  it('首次种子化创建 5 个系统角色预设', async () => {
+    customRole.count.mockResolvedValue(0)
+    services.set('permissions', { kind: 'pro' })
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    const names = customRole.create.mock.calls.map((c: any[]) => c[0].data.name)
+    expect(names).toEqual(['owner', 'admin', 'member', 'editor', 'viewer'])
+    // 系统角色必须标记 isSystem，用户不可伪造/删除
+    expect(customRole.create.mock.calls.every((c: any[]) => c[0].data.isSystem === true)).toBe(true)
+    expect(customRole.create.mock.calls.every((c: any[]) => c[0].data.workspaceId === WS)).toBe(true)
+  })
+
+  it('种子化时给 ADMIN 用户赋 owner 角色', async () => {
+    customRole.count.mockResolvedValue(0)
+    services.set('permissions', { kind: 'pro' })
+    userMock.findMany.mockResolvedValue([{ id: 'u-1' }, { id: 'u-2' }])
+    customRole.findFirst.mockResolvedValue({ id: 'role-owner', name: 'owner' })
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(userMock.findMany).toHaveBeenCalledWith({
+      where: { role: 'ADMIN' },
+      select: { id: true },
+    })
+    expect(roleAssignment.createMany).toHaveBeenCalledWith({
+      data: [{ userId: 'u-1', roleId: 'role-owner' }, { userId: 'u-2', roleId: 'role-owner' }],
+      skipDuplicates: true,
+    })
+  })
+
+  it('pro service 缺失时不种子化（OSS 部署无高级权限）', async () => {
+    customRole.count.mockResolvedValue(0)
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.create).not.toHaveBeenCalled()
+  })
+})
+
+describe('createRoleFn', () => {
+  it('强制 isSystem=false（不可伪造系统角色）', async () => {
+    customRole.create.mockResolvedValue({ id: 'role-new' })
+
+    await createRoleFn({ data: { workspaceId: WS, name: 'custom-1', permissions: { 'story:read': 'read' } } })
+
+    expect(customRole.create).toHaveBeenCalledWith({
+      data: {
+        workspaceId: WS,
+        name: 'custom-1',
+        permissions: { 'story:read': 'read' },
+        isSystem: false,
+      },
+    })
+  })
+
+  it('permissions 缺省为空对象', async () => {
+    customRole.create.mockResolvedValue({ id: 'role-new' })
+
+    await createRoleFn({ data: { workspaceId: WS, name: 'custom-2' } })
+
+    expect(customRole.create.mock.calls[0][0].data.permissions).toEqual({})
+  })
+})
+
+describe('assignRoleFn', () => {
+  it('写入 userId 与 roleId 并返回 ok', async () => {
+    roleAssignment.create.mockResolvedValue({ id: 'assign-1' })
+
+    const res = await assignRoleFn({ data: { userId: 'u-1', roleId: 'role-1' } })
+
+    expect(roleAssignment.create).toHaveBeenCalledWith({ data: { userId: 'u-1', roleId: 'role-1' } })
+    expect(res).toEqual({ ok: true })
+  })
+})
+
+describe('unassignRoleFn', () => {
+  it('按 assignmentId 删除', async () => {
+    roleAssignment.delete.mockResolvedValue({ id: 'assign-1' })
+
+    const res = await unassignRoleFn({ data: { assignmentId: 'assign-1' } })
+
+    expect(roleAssignment.delete).toHaveBeenCalledWith({ where: { id: 'assign-1' } })
+    expect(res).toEqual({ ok: true })
+  })
+})
+
+describe('deleteRoleFn', () => {
+  it('按 roleId 删除并返回 success', async () => {
+    customRole.delete.mockResolvedValue({ id: 'role-1' })
+
+    const res = await deleteRoleFn({ data: { roleId: 'role-1' } })
+
+    expect(customRole.delete).toHaveBeenCalledWith({ where: { id: 'role-1' } })
+    expect(res).toEqual({ success: true })
+  })
+})
+
+describe('listRoleAssignmentsFn', () => {
+  it('按 roleId 过滤并附带用户信息选择集', async () => {
+    roleAssignment.findMany.mockResolvedValue([{ id: 'assign-1', user: { id: 'u-1', username: 'alice' } }])
+
+    const res = await listRoleAssignmentsFn({ data: { roleId: 'role-1' } })
+
+    expect(roleAssignment.findMany).toHaveBeenCalledWith({
+      where: { roleId: 'role-1' },
+      include: { user: { select: { id: true, username: true, email: true } } },
+      orderBy: { createdAt: 'desc' },
+    })
+    expect(res).toHaveLength(1)
+  })
+})
+
+describe('listWorkspacesFn', () => {
+  it('按 name 升序返回工作空间', async () => {
+    workspaceMock.findMany.mockResolvedValue([
+      { id: 'ws-a', name: 'alpha' },
+      { id: 'ws-b', name: 'beta' },
+    ])
+
+    const res = await listWorkspacesFn({ data: {} })
+
+    expect(workspaceMock.findMany).toHaveBeenCalledWith({
+      select: { id: true, name: true },
+      orderBy: { name: 'asc' },
+    })
+    expect(res).toHaveLength(2)
+  })
+})

package/src/server/middlewares/security-headers.ts

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+
+const PROD_CSP = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "media-src 'self' blob: https:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+  "upgrade-insecure-requests",
+].join('; ')
+
+const DEV_CSP = [
+  "default-src 'self' 'unsafe-inline' data: blob:",
+  "script-src 'self' 'unsafe-inline' data: blob:",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https: http:",
+  "font-src 'self' data:",
+  "connect-src 'self' ws: wss: http: https:",
+  "media-src 'self' blob: https: http:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+].join('; ')
+
+export function buildSecurityHeaders(prod: boolean): Record<string, string> {
+  const headers: Record<string, string> = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Cross-Origin-Resource-Policy': 'same-origin',
+    'Cross-Origin-Opener-Policy': 'same-origin',
+    'Permissions-Policy':
+      'camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Content-Security-Policy': prod ? PROD_CSP : DEV_CSP,
+  }
+  if (prod) {
+    headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
+  }
+  return headers
+}
+
+function mergeSecurityHeaders(source: Headers, headers: Record<string, string>): Headers {
+  const entries = Object.entries(headers)
+  try {
+    for (const [name, value] of entries) source.set(name, value)
+    return source
+  } catch {
+    // @auth/core 响应（登录回调成功/失败路径）的 headers 为 immutable guard，
+    // 原地 set 抛 TypeError: immutable → 未捕获异常 → 登录 500。
+    const merged = new Headers(source)
+    for (const [name, value] of entries) merged.set(name, value)
+    return merged
+  }
+}
+
+function withSecurityHeaders(result: Response, headers: Record<string, string>): Response {
+  const merged = mergeSecurityHeaders(result.headers, headers)
+  if (merged === result.headers) return result
+  return new Response(result.body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: merged,
+  })
+}
+
+export const securityHeadersMiddleware = createMiddleware().server(async ({ next }: any) => {
+  const headers = buildSecurityHeaders(process.env.NODE_ENV === 'production')
+  const result = await next() as any
+
+  if (result instanceof Response) return withSecurityHeaders(result, headers)
+
+  const carrier: any = result?.response || result
+  const target: Headers | undefined = carrier?.headers
+  if (!target) return result
+
+  const merged = mergeSecurityHeaders(target, headers)
+  if (merged === target) return result
+  return new Response(result?.body ?? null, {
+    status: result?.status ?? 200,
+    statusText: result?.statusText,
+    headers: merged,
+  })
+})

package/src/server/serverFns/components/import.ts

@@ -18,7 +18,7 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { writeFileSync, mkdirSync, existsSync, readFileSync } from 'node:fs'
 import { resolve, join } from 'node:path'
 
@@ -89,7 +89,7 @@ export const importComponentFn = createServerFn({ method: 'POST' })
       if (!packageName) throw new Error('npm 包名不能为空')
       const prototypeDir = join(monorepoRoot, 'packages/prototype')
       try {
-        execSync(`pnpm add ${packageName}`, {
+        execFileSync('pnpm', ['add', packageName], {
           cwd: prototypeDir,
           stdio: 'pipe',
           timeout: 60000,
@@ -114,7 +114,7 @@ export const importComponentFn = createServerFn({ method: 'POST' })
       } else {
         const compName = importPath.split('/').pop() ?? importPath
         try {
-          execSync(`pnpm dlx shadcn@latest add ${importPath} --yes`, {
+          execFileSync('pnpm', ['dlx', 'shadcn@latest', 'add', importPath, '--yes'], {
             cwd: webDir,
             stdio: 'pipe',
             timeout: 120000,

package/src/start.ts

@@ -20,6 +20,7 @@ import {
   sentryGlobalRequestMiddleware,
 } from '@sentry/tanstackstart-react'
 import { createStart, createMiddleware, createCsrfMiddleware } from '@tanstack/react-start'
+import { securityHeadersMiddleware } from '@/server/middlewares/security-headers'
 import { requestContextMiddleware } from '@/server/middlewares/request'
 import {
   observabilityMiddleware,
@@ -80,6 +81,6 @@ if (typeof process !== 'undefined' && process.versions?.node && process.env.NODE
 }
 
 export const startInstance = createStart(() => ({
-  requestMiddleware: [sentryGlobalRequestMiddleware, requestContextMiddleware, observabilityMiddleware, debugMiddleware, apiCorsMiddleware, csrfMiddleware],
+  requestMiddleware: [securityHeadersMiddleware, sentryGlobalRequestMiddleware, requestContextMiddleware, observabilityMiddleware, debugMiddleware, apiCorsMiddleware, csrfMiddleware],
   functionMiddleware: [sentryGlobalFunctionMiddleware],
 }))

package/src/types/jest-dom-vitest.d.ts

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// Vitest 5 类型兼容层（与 apps/web 同名文件保持一致）：Vitest 5 的 `Assertion`
+// 接口使用双类型参数 `Assertion<R, T>`，而 @testing-library/jest-dom 官方
+// types/vitest.d.ts 声明单参数 `Assertion<T = any>`，泛型参数个数不一致导致
+// 声明合并报 TS2428。这里以正确的双参数签名重写增强，使 `toBeInTheDocument`
+// 等 jest-dom matcher 类型可用。运行时 matcher 注册在 src/__tests__/setup.ts
+// 的 `import '@testing-library/jest-dom/vitest'`。
+import type { TestingLibraryMatchers } from '@testing-library/jest-dom/matchers'
+
+declare module 'vitest' {
+  interface Assertion<R extends void | Promise<void> = void, T = unknown>
+    extends TestingLibraryMatchers<R, T> {}
+  interface AsymmetricMatchersContaining
+    extends TestingLibraryMatchers<any, any> {}
+}