@allbluecn/admin-app 0.3.2 → 0.3.3

package/src/server/serverFns/knowledge-public/compliance/create.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { complianceCanonicalId } from '@/server/knowledge-public/canonical-id'
 
@@ -37,6 +37,7 @@ const createSchema = z.object({
 export const adminCreateComplianceFn = createServerFn({ method: 'POST' })
   .validator(createSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     const session = await requireAdmin()
     return prisma.industryCompliance.create({
       data: {

package/src/server/serverFns/knowledge-public/compliance/delete.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminDeleteComplianceFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const existing = await prisma.industryCompliance.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')

package/src/server/serverFns/knowledge-public/compliance/detail.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminGetComplianceDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const item = await prisma.industryCompliance.findFirst({
       where: { id: data.id, visibility: 'public', isDeleted: false },

package/src/server/serverFns/knowledge-public/compliance/list.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 const listSchema = z.object({
@@ -31,6 +31,7 @@ const listSchema = z.object({
 export const adminListComplianceFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: any = { visibility: 'public', isDeleted: false }
     if (data.search) {

package/src/server/serverFns/knowledge-public/compliance/update.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { complianceCanonicalId } from '@/server/knowledge-public/canonical-id'
 
@@ -38,6 +38,7 @@ const updateSchema = z.object({
 export const adminUpdateComplianceFn = createServerFn({ method: 'POST' })
   .validator(updateSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const { id, code, ...rest } = data
     const existing = await prisma.industryCompliance.findUnique({ where: { id } })

package/src/server/serverFns/knowledge-public/legal/create.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { legalCanonicalId } from '@/server/knowledge-public/canonical-id'
 
@@ -39,6 +39,7 @@ const createSchema = z.object({
 export const adminCreateLegalFn = createServerFn({ method: 'POST' })
   .validator(createSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     const session = await requireAdmin()
     return prisma.legalRegulation.create({
       data: {

package/src/server/serverFns/knowledge-public/legal/delete.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminDeleteLegalFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const existing = await prisma.legalRegulation.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')

package/src/server/serverFns/knowledge-public/legal/detail.ts

@@ -17,12 +17,13 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const adminGetLegalDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const item = await prisma.legalRegulation.findFirst({
       where: { id: data.id, visibility: 'public', isDeleted: false },

package/src/server/serverFns/knowledge-public/legal/list.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 const listSchema = z.object({
@@ -31,6 +31,7 @@ const listSchema = z.object({
 export const adminListLegalFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: any = { visibility: 'public', isDeleted: false }
     if (data.search) {

package/src/server/serverFns/knowledge-public/legal/update.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { legalCanonicalId } from '@/server/knowledge-public/canonical-id'
 
@@ -40,6 +40,7 @@ const updateSchema = z.object({
 export const adminUpdateLegalFn = createServerFn({ method: 'POST' })
   .validator(updateSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const { id, code, ...rest } = data
     const existing = await prisma.legalRegulation.findUnique({ where: { id } })

package/src/server/serverFns/licenses.ts

@@ -17,7 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { issueLicense } from '@/server/license-issue'
 
@@ -30,6 +30,7 @@ const listSchema = z.object({
 export const listLicensesFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const where: any = data.search
       ? {
@@ -57,6 +58,7 @@ export const listLicensesFn = createServerFn({ method: 'GET' })
 export const getLicenseDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ licenseId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const license = await prisma.licenseKey.findUnique({
       where: { id: data.licenseId },
@@ -69,6 +71,7 @@ export const getLicenseDetailFn = createServerFn({ method: 'GET' })
 export const revokeLicenseFn = createServerFn({ method: 'POST' })
   .validator(z.object({ licenseId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await prisma.licenseKey.update({
       where: { id: data.licenseId },
@@ -89,4 +92,7 @@ export const issueLicenseFn = createServerFn({ method: 'POST' })
       expiresAt: z.string().datetime().nullable(),
     }),
   )
-  .handler(async ({ data }) => issueLicense(data))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    return issueLicense(data)
+  })

package/src/server/serverFns/monitoring/get-errors.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export const getErrors = createServerFn({ method: 'GET' })
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const errors = await prisma.monitoringErrorReport.findMany({

package/src/server/serverFns/monitoring/get-health.ts

@@ -16,12 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { performHealthCheck } from '@/server/observability'
 
 export const getHealthStatus = createServerFn({ method: 'GET' })
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const current = await performHealthCheck()

package/src/server/serverFns/monitoring/get-metrics.ts

@@ -18,10 +18,11 @@
 import { createServerFn } from '@tanstack/react-start'
 import { requireAdmin } from '@/server/auth-helpers'
 import { metrics } from '@/server/observability'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 
 export const getMetrics = createServerFn({ method: 'GET' })
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const memory = process.memoryUsage()

package/src/server/serverFns/monitoring/get-request-logs.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 type GetRequestLogsInput = {
@@ -37,6 +37,7 @@ const MONITORING_PREFIXES = [
 export const getRequestLogs = createServerFn({ method: 'GET' })
   .validator((data: GetRequestLogsInput) => data)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const where: any = {}

package/src/server/serverFns/monitoring/report-error.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 type ReportErrorInput = {
@@ -30,6 +30,7 @@ type ReportErrorInput = {
 export const reportClientError = createServerFn({ method: 'POST' })
   .validator((data: ReportErrorInput) => data)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const key = `${data.errorName}:${data.errorMessage}`

package/src/server/serverFns/monitoring/reset.ts

@@ -18,7 +18,7 @@
 import { createServerFn } from '@tanstack/react-start'
 import { requireAdmin } from '@/server/auth-helpers'
 import { metrics, resetErrors } from '@/server/observability'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 
 type ResetInput = {
   type: 'errors' | 'metrics' | 'request-logs' | 'health' | 'all'
@@ -28,6 +28,7 @@ type ResetInput = {
 export const resetMonitoring = createServerFn({ method: 'POST' })
   .validator((data: ResetInput) => data)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const cutoff = data.days ? new Date(Date.now() - data.days * 86400000) : null

package/src/server/serverFns/oauth-providers.ts

@@ -5,7 +5,7 @@
 // oauth-config 60s 缓存最长延迟 60s 生效（TTL 自然过期，符合 plan2 spec），无跨进程失效通道。
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { decryptSecret, encryptSecret } from '@allbluecn/kernel/crypto'
 
@@ -30,6 +30,7 @@ function hasGoogleEnvFallback(): boolean {
 export const listOAuthProvidersFn = createServerFn({ method: 'GET' })
   .validator(z.object({}))
   .handler(async (): Promise<{ providers: OAuthProviderView[] }> => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const row = await prisma.oAuthProviderConfig.findUnique({
       where: { provider: PROVIDER_KEY },
@@ -69,6 +70,7 @@ export const saveOAuthProviderFn = createServerFn({ method: 'POST' })
     }),
   )
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     const hasSecret = Boolean(data.clientSecret && data.clientSecret.length > 0)
     if (!hasSecret) {
@@ -148,6 +150,7 @@ export const testOAuthProviderFn = createServerFn({ method: 'POST' })
 export const deleteOAuthProviderFn = createServerFn({ method: 'POST' })
   .validator(z.object({ provider: z.literal('google') }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     try {
       await prisma.oAuthProviderConfig.delete({ where: { provider: data.provider } })

package/src/server/serverFns/permissions.ts

@@ -1,6 +1,6 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { requireFeature } from '@/server/entitlements'
 import { getProService } from '@/server/pro-services'
@@ -98,6 +98,7 @@ function buildSystemRolePresets(): SystemRolePreset[] {
 export const listRolesFn = createServerFn({ method: 'GET' })
   .validator(z.object({ workspaceId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
 
@@ -106,16 +107,16 @@ export const listRolesFn = createServerFn({ method: 'GET' })
     })
     if (systemCount === 0 && getProService('permissions')) {
       const presets = buildSystemRolePresets()
-      for (const preset of presets) {
-        await prisma.customRole.create({
-          data: {
-            workspaceId: data.workspaceId,
-            name: preset.name,
-            permissions: preset.permissions as never,
-            isSystem: true,
-          },
-        })
-      }
+      // DB-01/DB-06：系统角色种子从逐 preset create（N 次查询）改为 1 次 createMany
+      // （创建行不被消费，ownerRole 仍按 name 回查，行为等价）。查询次数 before: N + 2 → after: 3
+      await prisma.customRole.createMany({
+        data: presets.map((preset) => ({
+          workspaceId: data.workspaceId,
+          name: preset.name,
+          permissions: preset.permissions as never,
+          isSystem: true,
+        })),
+      })
       const admins = await prisma.user.findMany({
         where: { role: 'ADMIN' },
         select: { id: true },
@@ -151,6 +152,7 @@ export const createRoleFn = createServerFn({ method: 'POST' })
     }),
   )
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     return prisma.customRole.create({
@@ -166,6 +168,7 @@ export const createRoleFn = createServerFn({ method: 'POST' })
 export const deleteRoleFn = createServerFn({ method: 'POST' })
   .validator(z.object({ roleId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     await prisma.customRole.delete({ where: { id: data.roleId } })
@@ -175,6 +178,7 @@ export const deleteRoleFn = createServerFn({ method: 'POST' })
 export const assignRoleFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string(), roleId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     await prisma.roleAssignment.create({ data: { userId: data.userId, roleId: data.roleId } })
@@ -184,6 +188,7 @@ export const assignRoleFn = createServerFn({ method: 'POST' })
 export const unassignRoleFn = createServerFn({ method: 'POST' })
   .validator(z.object({ assignmentId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     await prisma.roleAssignment.delete({ where: { id: data.assignmentId } })
@@ -193,6 +198,7 @@ export const unassignRoleFn = createServerFn({ method: 'POST' })
 export const listRoleAssignmentsFn = createServerFn({ method: 'GET' })
   .validator(z.object({ roleId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     return prisma.roleAssignment.findMany({
@@ -205,6 +211,7 @@ export const listRoleAssignmentsFn = createServerFn({ method: 'GET' })
 export const listWorkspacesFn = createServerFn({ method: 'GET' })
   .validator(z.object({}))
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'advancedPermissions')
     return prisma.workspace.findMany({

package/src/server/serverFns/sentry/config.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 
 export type SentryConfig = {
@@ -28,6 +28,7 @@ export type SentryConfig = {
 
 export const getSentryConfig = createServerFn({ method: 'GET' })
   .handler(async () => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const settings = await prisma.systemSetting.findMany({
@@ -47,6 +48,7 @@ export const getSentryConfig = createServerFn({ method: 'GET' })
 export const saveSentryConfig = createServerFn({ method: 'POST' })
   .validator((data: SentryConfig) => data)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
 
     const entries: { key: string; value: string; category: string; desc: string }[] = [
@@ -56,13 +58,14 @@ export const saveSentryConfig = createServerFn({ method: 'POST' })
       { key: 'auth_token', value: data.authToken, category: 'sentry', desc: 'Sentry Auth Token（源码映射上传用）' },
     ]
 
-    for (const entry of entries) {
-      await prisma.systemSetting.upsert({
-        where: { key: entry.key },
-        create: entry,
-        update: { value: entry.value },
-      })
-    }
+    // DB-01/DB-06：4 个配置项从逐条 upsert（4 次串行查询）改为事务内 deleteMany + createMany
+    // （2 次查询、原子提交）。key 全局唯一且仅 sentry 配置使用这 4 个裸键（其他配置均带命名空间前缀），
+    // 读取方均按 key→value 消费，重建行（新 id/createdAt）无行为影响。
+    // 查询次数 before: 4 → after: 2（事务内）
+    await prisma.$transaction([
+      prisma.systemSetting.deleteMany({ where: { key: { in: entries.map((entry) => entry.key) } } }),
+      prisma.systemSetting.createMany({ data: entries }),
+    ])
 
     return { ok: true }
   })

package/src/server/serverFns/sso-config.ts

@@ -17,21 +17,33 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { requireAdmin } from '@/server/auth-helpers'
 import { requireFeature } from '@/server/entitlements'
 
 export const listSsoProvidersFn = createServerFn({ method: 'GET' })
   .validator(z.object({ workspaceId: z.string().optional() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'sso')
     const where: any = data.workspaceId ? { workspaceId: data.workspaceId } : {}
     const [items, total] = await Promise.all([
       prisma.ssoProvider.findMany({
         where,
-        include: { _count: { select: { mappings: true } } },
         orderBy: { createdAt: 'desc' },
+        // DB-05：config Json 含 IdP client secret 等凭据，列表页不消费，白名单排除
+        select: {
+          id: true,
+          workspaceId: true,
+          type: true,
+          name: true,
+          domain: true,
+          enabled: true,
+          createdAt: true,
+          updatedAt: true,
+          _count: { select: { mappings: true } },
+        },
       }),
       prisma.ssoProvider.count({ where }),
     ])
@@ -49,6 +61,7 @@ export const createSsoProviderFn = createServerFn({ method: 'POST' })
     }),
   )
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'sso')
     return prisma.ssoProvider.create({
@@ -65,6 +78,7 @@ export const createSsoProviderFn = createServerFn({ method: 'POST' })
 export const deleteSsoProviderFn = createServerFn({ method: 'POST' })
   .validator(z.object({ providerId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'sso')
     await prisma.ssoProvider.delete({ where: { id: data.providerId } })
@@ -74,6 +88,7 @@ export const deleteSsoProviderFn = createServerFn({ method: 'POST' })
 export const toggleSsoProviderFn = createServerFn({ method: 'POST' })
   .validator(z.object({ providerId: z.string(), enabled: z.boolean() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
     await requireAdmin()
     await requireFeature(undefined, 'sso')
     return prisma.ssoProvider.update({

package/src/server/serverFns/user/create.ts

@@ -17,8 +17,9 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import bcrypt from 'bcryptjs'
+import { requireAdmin } from '@/server/auth-helpers'
 
 const createInput = z.object({
   email: z.string().email(),
@@ -31,10 +32,14 @@ const createInput = z.object({
 export const createUserFn = createServerFn({ method: 'POST' })
   .validator(createInput)
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const exists = await prisma.user.findUnique({ where: { email: data.email } })
     if (exists) throw new Error('Email already exists')
     const hashedPassword = await bcrypt.hash(data.password, 12)
     return prisma.user.create({
       data: { ...data, password: hashedPassword, username: data.name },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
     })
   })

package/src/server/serverFns/user/delete.ts

@@ -17,13 +17,18 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const deleteUserFn = createServerFn({ method: 'POST' })
   .validator(z.object({ userId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     return prisma.user.update({
       where: { id: data.userId },
       data: { status: 'INACTIVE' },
+      // 不回显 password 哈希
+      select: { id: true, email: true, username: true, role: true, status: true },
     })
   })

package/src/server/serverFns/user/detail.ts

@@ -17,11 +17,14 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { requireAdmin } from '@/server/auth-helpers'
 
 export const getUserDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ userId: z.string() }))
   .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    await requireAdmin()
     const user = await prisma.user.findUnique({
       where: { id: data.userId },
       select: {
@@ -36,7 +39,7 @@ export const getUserDetailFn = createServerFn({ method: 'GET' })
         createdAt: true,
         updatedAt: true,
         lastLoginAt: true,
-        _count: { select: { prds: true, anyhubMarketApps: true, anyhubApps: true, reviews: true } },
+        _count: { select: { designs: true, anyhubMarketApps: true, anyhubApps: true, reviews: true } },
         loginLogs: { orderBy: { createdAt: 'desc' }, take: 20 },
       },
     })