@allbluecn/admin-app 0.3.2 → 0.3.3

package/src/server/serverFns/components/import.ts

@@ -17,21 +17,52 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { execFileSync } from 'node:child_process'
 import { writeFileSync, mkdirSync, existsSync, readFileSync } from 'node:fs'
 import { resolve, join } from 'node:path'
-
-const PACKAGE_NAME_RE = /^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i
+import { requireAdmin } from '@/server/auth-helpers'
+
+// ── 供应链风险决策（SEC-01 联动）──────────────────────────────────────────
+// `pnpm add <包名>` 会执行该包的 postinstall 等生命周期脚本，等同在服务器上
+// 任意代码执行；`pnpm dlx shadcn add <path>` 也会按 registry 路径拉取并写入
+// 任意来源的组件文件。除 requireAdmin 鉴权外，追加以下防线：
+//   ① 包名白名单格式：仅小写字母/数字开头的扁平包名（允许 . _ -），拒绝
+//      @scope、`/`（GitHub shorthand 与路径分隔符，防 a/../../evil 绕过
+//      registry 固定）、URL、绝对路径等一切非常规形态；
+//   ② registry 显式固定为 npm 官方源，防止 .npmrc / 环境变量被劫持改指向
+//      恶意镜像（typosquatting 面收窄到官方 registry 的审计能力内）；
+//   ③ --ignore-scripts：跳过被安装包的全部生命周期脚本，组件类纯 JS 包
+//      无需 install 脚本，个别依赖构建脚本的包会装出不可用组件——宁可
+//      导入失败人工介入，不在服务端静默执行第三方脚本；
+//   ④ shadcn 路径（dlx 分支）校验为合法 registry item 形态（组件名或
+//      @scope/name），拒绝任意 URL / 绝对路径；@/ 本地路径同样做段字符
+//      白名单（拒引号/`${`/空白等模板注入字符）且 resolve 后强制约束在
+//      apps/web/src 之内，堵死路径穿越式任意文件读；
+//   ⑤ 所有插值进生成的 .tsx wrapper 的字符串（displayName、exportName、
+//      importSource、componentKey）一律先过字符白名单/标识符校验——
+//      wrapper 是会被 Vite 编译执行的代码，插值即模板注入面。
+// ─────────────────────────────────────────────────────────────────────────
+const NPM_PACKAGE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/
+const SHADCN_REGISTRY_PATH_RE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/
+// @/ 本地路径：段字符白名单 [a-z0-9._-]，段必须以字母/数字开头（. 与 ..
+// 段天然被拒），拒引号、反斜杠、空白、`${}` 等一切模板注入字符
+const LOCAL_IMPORT_PATH_RE = /^@\/[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/
+// displayName 会插值进 wrapper 的 `name: "${displayName}"`：仅允许中文、
+// 字母、数字、空格与 . _ -，拒引号/反引号/反斜杠/`${}`/尖括号等
+const DISPLAY_NAME_RE = /^[\p{Script=Han}a-zA-Z0-9][\p{Script=Han}a-zA-Z0-9 ._-]*$/u
+// exportName 会插值进 `import { x as Comp } from ...`：必须为合法 JS 标识符
+const EXPORT_NAME_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+const PINNED_REGISTRY = 'https://registry.npmjs.org/'
 const COMPONENT_KEY_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
 
 const importInput = z.object({
   source: z.enum(['npm', 'local']).default('npm'),
-  packageName: z.string().regex(PACKAGE_NAME_RE, '无效的 npm 包名').optional(),
+  packageName: z.string().regex(NPM_PACKAGE_NAME_RE, '无效的 npm 包名（仅允许小写字母、数字与 . _ -，拒绝 @scope 与斜杠）').optional(),
   importPath: z.string().min(1, '不能为空').optional(),
-  exportName: z.string().default('default'),
+  exportName: z.string().regex(EXPORT_NAME_RE, '导出名必须为合法标识符').default('default'),
   componentKey: z.string().regex(COMPONENT_KEY_RE, '标识只能含小写字母、数字、连字符'),
-  displayName: z.string().min(1, '请输入显示名称'),
+  displayName: z.string().regex(DISPLAY_NAME_RE, '显示名称只能含中文、字母、数字、空格与 . _ -'),
   category: z.enum(['基础组件', '内容区块', '页面模版']),
   type: z.enum(['component', 'block', 'template']).default('component'),
   defaultWidth: z.number().int().positive().default(200),
@@ -64,6 +95,8 @@ function detectExportName(filePath: string, fallback: string): string {
 export const importComponentFn = createServerFn({ method: 'POST' })
   .validator(importInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const {
       source,
       packageName,
@@ -87,13 +120,20 @@ export const importComponentFn = createServerFn({ method: 'POST' })
 
     if (source === 'npm') {
       if (!packageName) throw new Error('npm 包名不能为空')
+      if (!NPM_PACKAGE_NAME_RE.test(packageName)) {
+        throw new Error(`拒绝安装非常规包名 "${packageName}"：仅允许小写字母/数字开头的非 scope 包（供应链防护）`)
+      }
       const prototypeDir = join(monorepoRoot, 'packages/prototype')
       try {
-        execFileSync('pnpm', ['add', packageName], {
-          cwd: prototypeDir,
-          stdio: 'pipe',
-          timeout: 60000,
-        })
+        execFileSync(
+          'pnpm',
+          ['add', packageName, `--registry=${PINNED_REGISTRY}`, '--ignore-scripts'],
+          {
+            cwd: prototypeDir,
+            stdio: 'pipe',
+            timeout: 60000,
+          },
+        )
       } catch {
         throw new Error(`安装包 "${packageName}" 失败，请检查包名或网络`)
       }
@@ -107,11 +147,25 @@ export const importComponentFn = createServerFn({ method: 'POST' })
       let componentFilePath: string | null = null
 
       if (importPath.startsWith('@/')) {
+        // 段字符白名单：拒引号/`${`/空白等模板注入字符与 . .. 段（与 resolve
+        // 前缀检查构成双防线——前者护 wrapper 代码生成，后者护文件读取）
+        if (!LOCAL_IMPORT_PATH_RE.test(importPath)) {
+          throw new Error(`拒绝非法本地路径 "${importPath}"：仅允许 @/ 开头的小写路径段（供应链防护）`)
+        }
+        const resolvedPath = resolve(webSrc, `${importPath.slice(2)}.tsx`)
+        // 路径穿越防护：@/ 别名只允许解析到 apps/web/src 内部的 .tsx
+        if (!resolvedPath.startsWith(webSrc + '/')) {
+          throw new Error('非法路径：importPath 越界')
+        }
         importSource = importPath
-        const relPath = importPath.slice(2)
-        const tryPath = join(webSrc, `${relPath}.tsx`)
-        if (existsSync(tryPath)) componentFilePath = tryPath
+        if (existsSync(resolvedPath)) componentFilePath = resolvedPath
       } else {
+        // registry 路径（如 @magicui/safari 或 button）：拒绝 URL / 绝对路径 / ..
+        // shadcn CLI 无 --registry 旗标，registry 来源由项目 components.json 的
+        // 受信 registries 配置决定；此处以路径格式校验挡住任意 URL / 路径注入。
+        if (!SHADCN_REGISTRY_PATH_RE.test(importPath)) {
+          throw new Error(`拒绝非 registry 路径 "${importPath}"：仅允许组件名或 @scope/name（供应链防护）`)
+        }
         const compName = importPath.split('/').pop() ?? importPath
         try {
           execFileSync('pnpm', ['dlx', 'shadcn@latest', 'add', importPath, '--yes'], {
@@ -158,6 +212,7 @@ import React from "react";
 ${importStmt}
 
 export function Imported${pascalName}({ props, style }: { props?: Record<string, any>; style?: Record<string, any> }) {
+  const prisma = await getPrisma()
   return <Comp {...props} style={style} />;
 }
 

package/src/server/serverFns/components/list.ts

@@ -17,7 +17,8 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 const listInput = z.object({
   page: z.number().default(1),
@@ -29,6 +30,8 @@ const listInput = z.object({
 export const listComponentsFn = createServerFn({ method: 'GET' })
   .validator(listInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const { page, pageSize, search, category } = data
     const where: any = { isDeleted: false }
     if (search) {

package/src/server/serverFns/components/mutations.ts

@@ -17,7 +17,9 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma, Prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import type { Prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
 
 const createInput = z.object({
   name: z.string().min(1),
@@ -29,6 +31,8 @@ const createInput = z.object({
 export const createComponentFn = createServerFn({ method: 'POST' })
   .validator(createInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     return prisma.component.create({
       data: {
         name: data.name,
@@ -61,6 +65,8 @@ const updateInput = z.object({
 export const updateComponentFn = createServerFn({ method: 'POST' })
   .validator(updateInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const { id, defaultProps, defaultStyle, ...rest } = data
     return prisma.component.update({
       where: { id },
@@ -77,6 +83,8 @@ const deleteInput = z.object({ id: z.string() })
 export const deleteComponentFn = createServerFn({ method: 'POST' })
   .validator(deleteInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     return prisma.component.update({
       where: { id: data.id },
       data: { isDeleted: true },

package/src/server/serverFns/dependency/list.ts

@@ -18,8 +18,9 @@
 // apps/admin/src/server/serverFns/dependency/list.ts
 import { createServerFn } from "@tanstack/react-start"
 import { z } from "zod"
-import { prisma } from "@allbluecn/database"
+import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { ThirdPartyDependencyRow } from "@allbluecn/kernel"
+import { requireAdmin } from "@/server/auth-helpers"
 import {
   aggregateUsages,
   compareVersions,
@@ -27,12 +28,13 @@ import {
   npmUrlOf,
   pickCurrentVersion,
   readMonorepoPackages,
-} from "./helpers"
+} from "@/server/dependency/helpers"
 
 const listInput = z.object({
   /** 仅返回关注列表 */
   watchedOnly: z.boolean().optional(),
-  category: z.string().optional(),
+  // 与 DB enum DependencyCategory（kernel DependencyCategory 联合类型）对齐，同 update.ts
+  category: z.enum(["framework", "ui", "editor", "ai", "state", "auth", "tool", "other"]).optional(),
   search: z.string().optional(),
 })
 
@@ -46,6 +48,8 @@ const listInput = z.object({
 export const listDependenciesFn = createServerFn({ method: "GET" })
   .validator(listInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     await ensureSeedData()
 
     // 一次读取所有 package.json，供聚合复用
@@ -60,10 +64,29 @@ export const listDependenciesFn = createServerFn({ method: "GET" })
     }
 
     // 读 DB 所有记录
-    const where: { isWatched?: boolean; category?: string } = {}
+    const where: { isWatched?: boolean; category?: "framework" | "ui" | "editor" | "ai" | "state" | "auth" | "tool" | "other" } = {}
     if (data.watchedOnly) where.isWatched = true
     if (data.category) where.category = data.category
-    const dbRows = await prisma.thirdPartyDependency.findMany({ where })
+    // DB-05：白名单 select（createdAt 不进聚合结果，整行排除）
+    const dbRows = await prisma.thirdPartyDependency.findMany({
+      where,
+      select: {
+        id: true,
+        name: true,
+        displayName: true,
+        description: true,
+        homepage: true,
+        category: true,
+        isWatched: true,
+        priority: true,
+        latestVersion: true,
+        latestChangelog: true,
+        lastSyncAt: true,
+        notes: true,
+        sortOrder: true,
+        updatedAt: true,
+      },
+    })
     const dbMap = new Map(dbRows.map((r) => [r.name, r]))
 
     // 构造结果集：DB 中所有记录 + package.json 中存在但 DB 未跟踪的包

package/src/server/serverFns/dependency/sync.ts

@@ -18,9 +18,10 @@
 // apps/admin/src/server/serverFns/dependency/sync.ts
 import { createServerFn } from "@tanstack/react-start"
 import { z } from "zod"
-import { prisma } from "@allbluecn/database"
+import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { SyncDependencyResult } from "@allbluecn/kernel"
-import { queryNpmRegistry } from "./helpers"
+import { requireAdmin } from "@/server/auth-helpers"
+import { queryNpmRegistry } from "@/server/dependency/helpers"
 
 const syncInput = z.object({
   /** npm 包名；不存在于 DB 时会 upsert 创建 */
@@ -34,6 +35,8 @@ const syncInput = z.object({
 export const syncDependencyFn = createServerFn({ method: "POST" })
   .validator(syncInput)
   .handler(async ({ data }): Promise<SyncDependencyResult> => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     try {
       const { latestVersion, homepage, changelog } = await queryNpmRegistry(data.name)
       await prisma.thirdPartyDependency.upsert({
@@ -85,6 +88,8 @@ const syncAllInput = z.object({
 export const syncAllDependenciesFn = createServerFn({ method: "POST" })
   .validator(syncAllInput)
   .handler(async ({ data }): Promise<SyncDependencyResult[]> => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const results: SyncDependencyResult[] = []
     // 顺序执行（npm registry 建议不并发轰炸）
     for (const name of data.names) {

package/src/server/serverFns/dependency/update.ts

@@ -18,8 +18,9 @@
 // apps/admin/src/server/serverFns/dependency/update.ts
 import { createServerFn } from "@tanstack/react-start"
 import { z } from "zod"
-import { prisma } from "@allbluecn/database"
+import { getPrisma } from "@allbluecn/database/get-prisma"
 import type { UpdateDependencyInput } from "@allbluecn/kernel"
+import { requireAdmin } from "@/server/auth-helpers"
 
 const updateInput = z.object({
   id: z.string().min(1),
@@ -37,6 +38,8 @@ const updateInput = z.object({
 export const updateDependencyFn = createServerFn({ method: "POST" })
   .validator(updateInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const { id, ...patch } = data
     // 过滤 undefined 字段，避免覆盖为 null
     const cleanPatch: Record<string, unknown> = {}

package/src/server/serverFns/developer-log-auto-generate.ts

@@ -1,6 +1,6 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { execFileSync } from 'node:child_process'
 import path from 'node:path'
 import { requireAdmin } from '@/server/auth-helpers'
@@ -86,6 +86,7 @@ export const autoGenerateLogsFn = createServerFn({ method: 'POST' })
     daysBack: z.number().default(60),
   }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const repoRoot = path.resolve(process.cwd(), '../..')
@@ -97,8 +98,20 @@ export const autoGenerateLogsFn = createServerFn({ method: 'POST' })
       )
 
       const commitBlocks = stdout.split('\n\n').filter((block) => block.trim())
-      let created = 0
-
+      // DB-01：查重从逐 commit findFirst（N 次查询）改为一次 findMany in 预取 sha 集合 + 批内存重去重；
+      // 写入用 createManyAndReturn 以精确统计实际插入行数（等价原 created 计数）。
+      // DB-07 核实（任务 3.4）：写入已是单步批量 createManyAndReturn（Prisma 单语句自带
+      // 原子性），无多步半批残留风险，按任务 3.3 先例不再包 $transaction。
+      // 查询次数 before: 2N → after: 2
+      interface PendingLog {
+        date: string
+        year: string
+        title: string
+        desc: string
+        tags: string[]
+        commitSha: string
+      }
+      const pending = new Map<string, PendingLog>()
       for (const block of commitBlocks) {
         const lines = block.trim().split('\n')
         if (lines.length < 2) continue
@@ -117,24 +130,34 @@ export const autoGenerateLogsFn = createServerFn({ method: 'POST' })
 
         const { date, year } = formatCommitDate(dateStr)
 
-        const existing = await prisma.developerLog.findFirst({
-          where: { commitSha: sha, isDeleted: false },
+        // 批内重复 sha：首个入 Map，后续跳过（与原「已存在则 continue」语义一致）
+        if (pending.has(sha)) continue
+        pending.set(sha, {
+          date,
+          year,
+          title: parsed.title,
+          desc: generateMarkdownDetail(parsed.title, parsed.body, sha, dateStr),
+          tags: parsed.tags,
+          commitSha: sha,
         })
-        if (existing) continue
-
-        const descMarkdown = generateMarkdownDetail(parsed.title, parsed.body, sha, dateStr)
-
-        await prisma.developerLog.create({
-          data: {
-            date,
-            year,
-            title: parsed.title,
-            desc: descMarkdown,
-            tags: parsed.tags,
-            commitSha: sha,
-          },
-        })
-        created++
+      }
+
+      let created = 0
+      if (pending.size > 0) {
+        const shas = [...pending.keys()]
+        const existingShas = new Set(
+          (
+            await prisma.developerLog.findMany({
+              where: { commitSha: { in: shas }, isDeleted: false },
+              select: { commitSha: true },
+            })
+          ).map((row) => row.commitSha),
+        )
+        const toCreate = [...pending.values()].filter((row) => !existingShas.has(row.commitSha))
+        if (toCreate.length > 0) {
+          const inserted = await prisma.developerLog.createManyAndReturn({ data: toCreate })
+          created = inserted.length
+        }
       }
 
       return { success: true, count: created }
@@ -145,6 +168,7 @@ export const autoGenerateLogsFn = createServerFn({ method: 'POST' })
 
 export const backfillLogDetailsFn = createServerFn({ method: 'POST' })
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const entries = await prisma.developerLog.findMany({
@@ -157,19 +181,26 @@ export const backfillLogDetailsFn = createServerFn({ method: 'POST' })
       },
     })
 
-    let updated = 0
-
-    for (const entry of entries) {
-      const hasMarkdown = entry.desc.includes('## ') || entry.desc.includes('```') || entry.desc.includes('---')
-      if (hasMarkdown) continue
+    // DB-01：待回填行（无 markdown）先内存过滤，更新并行提交。每行 desc 不同，
+    // 无法合并为单条 updateMany；原逐条串行 await 改 Promise.all 消除串行放大。
+    // 查询次数 before: N(串行) → after: N(并行)
+    const stale = entries.filter(
+      (entry) => !(entry.desc.includes('## ') || entry.desc.includes('```') || entry.desc.includes('---')),
+    )
 
-      const descMarkdown = generateMarkdownDetailFromLog(entry.title, entry.desc, entry.commitSha || '')
-
-      await prisma.developerLog.update({
-        where: { id: entry.id },
-        data: { desc: descMarkdown },
-      })
-      updated++
+    let updated = 0
+    if (stale.length > 0) {
+      const results = await Promise.all(
+        stale.map(async (entry) => {
+          const descMarkdown = generateMarkdownDetailFromLog(entry.title, entry.desc, entry.commitSha || '')
+          await prisma.developerLog.update({
+            where: { id: entry.id },
+            data: { desc: descMarkdown },
+          })
+          return true
+        }),
+      )
+      updated = results.length
     }
 
     return { success: true, count: updated }

package/src/server/serverFns/developer-logs.ts

@@ -1,6 +1,6 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import type { DeveloperLogEntry } from '@allbluecn/kernel'
 import { requireAdmin } from '@/server/auth-helpers'
 
@@ -24,6 +24,7 @@ export const listDeveloperLogsFn = createServerFn({ method: 'GET' })
     tag: z.string().optional(),
   }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: Record<string, unknown> = { isDeleted: false }
     if (data.search) {
@@ -67,6 +68,7 @@ export const createDeveloperLogFn = createServerFn({ method: 'POST' })
     commitSha: z.string().optional(),
   }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const log = await prisma.developerLog.create({
       data: {
@@ -98,6 +100,7 @@ export const updateDeveloperLogFn = createServerFn({ method: 'POST' })
     commitSha: z.string().nullable().optional(),
   }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const updateData: Record<string, unknown> = {}
     if (data.date !== undefined) updateData.date = data.date
@@ -123,6 +126,7 @@ export const updateDeveloperLogFn = createServerFn({ method: 'POST' })
 export const deleteDeveloperLogFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await prisma.developerLog.update({
       where: { id: data.id },

package/src/server/serverFns/invitations.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 function randomInvitationCode(): string {
@@ -35,6 +35,7 @@ const pageSchema = z.object({
 export const listInvitationCodesFn = createServerFn({ method: 'GET' })
   .validator(pageSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const skip = (data.page - 1) * data.pageSize
     const [codes, total] = await Promise.all([
@@ -94,6 +95,7 @@ const createCodeSchema = z.object({
 export const createInvitationCodeFn = createServerFn({ method: 'POST' })
   .validator(createCodeSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     const session = await requireAdmin()
     const code = data.code ? data.code.trim().toUpperCase() : randomInvitationCode()
     const row = await prisma.invitationCode.create({
@@ -112,6 +114,7 @@ const idSchema = z.object({ id: z.string().min(1) })
 export const toggleInvitationCodeFn = createServerFn({ method: 'POST' })
   .validator(idSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const row = await prisma.invitationCode.findUnique({ where: { id: data.id } })
     if (!row) throw new Error('邀请码不存在')
@@ -126,6 +129,7 @@ export const toggleInvitationCodeFn = createServerFn({ method: 'POST' })
 export const deleteInvitationCodeFn = createServerFn({ method: 'POST' })
   .validator(idSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const row = await prisma.invitationCode.findUnique({
       where: { id: data.id },
@@ -140,6 +144,7 @@ export const deleteInvitationCodeFn = createServerFn({ method: 'POST' })
 export const getRegistrationModeFn = createServerFn({ method: 'GET' })
   .validator(z.object({}))
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const setting = await prisma.systemSetting.findUnique({
       where: { key: 'auth.registrationMode' },
@@ -150,6 +155,7 @@ export const getRegistrationModeFn = createServerFn({ method: 'GET' })
 export const setRegistrationModeFn = createServerFn({ method: 'POST' })
   .validator(z.object({ mode: z.enum(['invite', 'open']) }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await prisma.systemSetting.upsert({
       where: { key: 'auth.registrationMode' },

package/src/server/serverFns/knowledge-public/bookmarks/create.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge-public/canonical-id'
 
@@ -32,6 +32,7 @@ const createSchema = z.object({
 export const adminCreateBookmarkFn = createServerFn({ method: 'POST' })
   .validator(createSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     const session = await requireAdmin()
     const gh = parseGithubUrl(data.url)
     return prisma.websiteBookmark.create({

package/src/server/serverFns/knowledge-public/bookmarks/delete.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminDeleteBookmarkFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const existing = await prisma.websiteBookmark.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')

package/src/server/serverFns/knowledge-public/bookmarks/detail.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminGetBookmarkDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const item = await prisma.websiteBookmark.findFirst({
       where: { id: data.id, visibility: 'public', isDeleted: false },

package/src/server/serverFns/knowledge-public/bookmarks/list.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 const listSchema = z.object({
@@ -31,6 +31,7 @@ const listSchema = z.object({
 export const adminListBookmarksFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: any = { visibility: 'public', isDeleted: false }
     if (data.search) {

package/src/server/serverFns/knowledge-public/bookmarks/sync-all-github.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { syncBookmarkGithub } from '@/server/knowledge-public/github-sync'
 
@@ -28,6 +28,7 @@ const syncSchema = z.object({
 export const adminSyncAllGithubFn = createServerFn({ method: 'POST' })
   .validator(syncSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: any = { isGithub: true, isDeleted: false }
     if (!data.force) {

package/src/server/serverFns/knowledge-public/bookmarks/update.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge-public/canonical-id'
 
@@ -33,6 +33,7 @@ const updateSchema = z.object({
 export const adminUpdateBookmarkFn = createServerFn({ method: 'POST' })
   .validator(updateSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const { id, ...rest } = data
     const existing = await prisma.websiteBookmark.findUnique({ where: { id } })