@allbluecn/web-app 0.10.2 → 0.11.0

package/src/server/middlewares/security-headers.ts

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+
+const PROD_CSP = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "media-src 'self' blob: https:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+  "upgrade-insecure-requests",
+].join('; ')
+
+const DEV_CSP = [
+  "default-src 'self' 'unsafe-inline' data: blob:",
+  "script-src 'self' 'unsafe-inline' data: blob:",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https: http:",
+  "font-src 'self' data:",
+  "connect-src 'self' ws: wss: http: https:",
+  "media-src 'self' blob: https: http:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+].join('; ')
+
+export function buildSecurityHeaders(prod: boolean): Record<string, string> {
+  const headers: Record<string, string> = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Cross-Origin-Resource-Policy': 'same-origin',
+    'Cross-Origin-Opener-Policy': 'same-origin',
+    'Permissions-Policy':
+      'camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Content-Security-Policy': prod ? PROD_CSP : DEV_CSP,
+  }
+  if (prod) {
+    headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
+  }
+  return headers
+}
+
+function mergeSecurityHeaders(source: Headers, headers: Record<string, string>): Headers {
+  const entries = Object.entries(headers)
+  try {
+    for (const [name, value] of entries) source.set(name, value)
+    return source
+  } catch {
+    // @auth/core 响应（登录回调成功/失败路径）的 headers 为 immutable guard，
+    // 原地 set 抛 TypeError: immutable → 未捕获异常 → 登录 500。
+    const merged = new Headers(source)
+    for (const [name, value] of entries) merged.set(name, value)
+    return merged
+  }
+}
+
+function withSecurityHeaders(result: Response, headers: Record<string, string>): Response {
+  const merged = mergeSecurityHeaders(result.headers, headers)
+  if (merged === result.headers) return result
+  return new Response(result.body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: merged,
+  })
+}
+
+export const securityHeadersMiddleware = createMiddleware().server(async ({ next }: any) => {
+  const headers = buildSecurityHeaders(process.env.NODE_ENV === 'production')
+  const result = await next() as any
+
+  if (result instanceof Response) return withSecurityHeaders(result, headers)
+
+  const carrier: any = result?.response || result
+  const target: Headers | undefined = carrier?.headers
+  if (!target) return result
+
+  const merged = mergeSecurityHeaders(target, headers)
+  if (merged === target) return result
+  return new Response(result?.body ?? null, {
+    status: result?.status ?? 200,
+    statusText: result?.statusText,
+    headers: merged,
+  })
+})

package/src/server/serverFns/__tests__/billing.test.ts

@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// billing 域覆盖补全：7 个 serverFn（plan/subscription/checkout/portal/invoices/currency）。
+// 关键断言：OSS 无 Stripe 凭据时 createCheckoutSessionFn 走 VITE_APP_URL 回退；locked 用户与
+// 未登录态拒绝；plan 查询按 tier 过滤且断言 Prisma where 形状。mock 骨架同域样板。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const M = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  getProService: vi.fn(),
+  getEntitlements: vi.fn(),
+  getResourceSnapshots: vi.fn(),
+  userUpdate: vi.fn(),
+}));
+
+const billingHolder = vi.hoisted(() => ({
+  current: null as null | {
+    getSubscription: ReturnType<typeof vi.fn>;
+    listPublicPlans: ReturnType<typeof vi.fn>;
+    createCheckoutSession: ReturnType<typeof vi.fn>;
+    createCustomerPortalSession: ReturnType<typeof vi.fn>;
+    listInvoices: ReturnType<typeof vi.fn>;
+  },
+}));
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: (p: { data: unknown }) => Promise<unknown>) {
+        const self = this;
+        return async (args: { data?: unknown }) => {
+          let data = args?.data;
+          if (self._validator && data !== undefined) {
+            const v = self._validator as { parse?: (d: unknown) => unknown };
+            data = v.parse ? v.parse(data) : data;
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: { user: { update: M.userUpdate } },
+  Prisma: {},
+}));
+
+vi.mock("@/server/pro-services", () => ({
+  getProService: (key: string) => (key === "billing" ? billingHolder.current : null),
+}));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+
+vi.mock("@/server/entitlements", () => ({ getEntitlements: M.getEntitlements }));
+
+vi.mock("@/server/resources", () => ({ getResourceSnapshots: M.getResourceSnapshots }));
+
+import {
+  getEffectivePlanFn,
+  getSubscriptionFn,
+  listPublicPlansFn,
+  createCheckoutSessionFn,
+  createCustomerPortalSessionFn,
+  listInvoicesFn,
+  updatePreferredCurrencyFn,
+} from "../billing";
+import { BillingUnavailableError } from "@allbluecn/kernel";
+
+const U = "u-1";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  M.userUpdate.mockResolvedValue({ id: U });
+  billingHolder.current = {
+    getSubscription: vi.fn().mockResolvedValue({ plan: "pro" }),
+    listPublicPlans: vi.fn().mockResolvedValue([{ id: "pro", name: "Pro" }]),
+    createCheckoutSession: vi.fn().mockResolvedValue({ url: "https://checkout/x" }),
+    createCustomerPortalSession: vi.fn().mockResolvedValue({ url: "https://portal/x" }),
+    listInvoices: vi.fn().mockResolvedValue([{ id: "in-1" }]),
+  };
+});
+
+describe("getEffectivePlanFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(getEffectivePlanFn()).rejects.toThrow("UNAUTHORIZED");
+    expect(M.getEntitlements).not.toHaveBeenCalled();
+  });
+
+  it("聚合权益与资源快照", async () => {
+    M.getEntitlements.mockResolvedValue({
+      planName: "Pro",
+      enabled: { "billing.checkout": true },
+      unavailable: ["sso"],
+      source: "database",
+    });
+    M.getResourceSnapshots.mockResolvedValue({ seats: 10 });
+
+    await expect(getEffectivePlanFn()).resolves.toEqual({
+      planName: "Pro",
+      features: { "billing.checkout": true },
+      unavailable: ["sso"],
+      source: "database",
+      resources: { seats: 10 },
+    });
+    expect(M.getEntitlements).toHaveBeenCalledWith({});
+    expect(M.getResourceSnapshots).toHaveBeenCalledWith({});
+  });
+});
+
+describe("getSubscriptionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(getSubscriptionFn()).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("计费模块不可用时抛出 BillingUnavailableError", async () => {
+    billingHolder.current = null;
+    await expect(getSubscriptionFn()).rejects.toBeInstanceOf(BillingUnavailableError);
+  });
+
+  it("正常返回当前订阅", async () => {
+    await expect(getSubscriptionFn()).resolves.toEqual({ plan: "pro" });
+    expect(billingHolder.current!.getSubscription).toHaveBeenCalledWith(U);
+  });
+});
+
+describe("listPublicPlansFn", () => {
+  it("币种枚举校验拒绝非法值", async () => {
+    const badCurrency = "eur" as unknown as "usd";
+    await expect(listPublicPlansFn({ data: { currency: badCurrency } })).rejects.toThrow();
+  });
+
+  it("正常按币种列出公开套餐", async () => {
+    await expect(listPublicPlansFn({ data: { currency: "cny" } })).resolves.toEqual([
+      { id: "pro", name: "Pro" },
+    ]);
+    expect(billingHolder.current!.listPublicPlans).toHaveBeenCalledWith("cny");
+  });
+});
+
+describe("createCheckoutSessionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(createCheckoutSessionFn({ data: { planId: "pro", currency: "usd" } })).rejects.toThrow(
+      "UNAUTHORIZED",
+    );
+  });
+
+  it("使用 VITE_APP_URL 拼装回调地址并带 14 天试用", async () => {
+    const prev = process.env.VITE_APP_URL;
+    process.env.VITE_APP_URL = "https://allblue.test";
+    try {
+      await createCheckoutSessionFn({ data: { planId: "pro", currency: "usd" } });
+    } finally {
+      if (prev === undefined) delete process.env.VITE_APP_URL;
+      else process.env.VITE_APP_URL = prev;
+    }
+
+    expect(billingHolder.current!.createCheckoutSession).toHaveBeenCalledWith({
+      userId: U,
+      planId: "pro",
+      currency: "usd",
+      successUrl: "https://allblue.test/settings/billing?checkout=success",
+      cancelUrl: "https://allblue.test/settings/billing?checkout=cancel",
+      trialDays: 14,
+    });
+  });
+
+  it("未配置 VITE_APP_URL 时回退本地地址", async () => {
+    const prev = process.env.VITE_APP_URL;
+    delete process.env.VITE_APP_URL;
+    try {
+      await expect(
+        createCheckoutSessionFn({ data: { planId: "pro", currency: "cny" } }),
+      ).resolves.toEqual({ url: "https://checkout/x" });
+    } finally {
+      if (prev === undefined) delete process.env.VITE_APP_URL;
+      else process.env.VITE_APP_URL = prev;
+    }
+
+    expect(billingHolder.current!.createCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        successUrl: "http://localhost:3000/settings/billing?checkout=success",
+      }),
+    );
+  });
+});
+
+describe("createCustomerPortalSessionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(createCustomerPortalSessionFn({ data: {} })).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("正常创建客户门户会话", async () => {
+    await expect(createCustomerPortalSessionFn({ data: {} })).resolves.toEqual({ url: "https://portal/x" });
+    expect(billingHolder.current!.createCustomerPortalSession).toHaveBeenCalledWith({
+      userId: U,
+      returnUrl: "http://localhost:3000/settings/billing",
+    });
+  });
+});
+
+describe("listInvoicesFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(listInvoicesFn()).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("按默认条数返回账单列表", async () => {
+    await expect(listInvoicesFn()).resolves.toEqual([{ id: "in-1" }]);
+    expect(billingHolder.current!.listInvoices).toHaveBeenCalledWith(U, 20);
+  });
+});
+
+describe("updatePreferredCurrencyFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(updatePreferredCurrencyFn({ data: { currency: "usd" } })).rejects.toThrow("UNAUTHORIZED");
+    expect(M.userUpdate).not.toHaveBeenCalled();
+  });
+
+  it("币种枚举校验拒绝非法值", async () => {
+    const badCurrency = "eur" as unknown as "usd";
+    await expect(updatePreferredCurrencyFn({ data: { currency: badCurrency } })).rejects.toThrow();
+    expect(M.userUpdate).not.toHaveBeenCalled();
+  });
+
+  it("正常更新用户偏好币种", async () => {
+    await expect(updatePreferredCurrencyFn({ data: { currency: "cny" } })).resolves.toBeUndefined();
+    expect(M.userUpdate).toHaveBeenCalledWith({
+      where: { id: U },
+      data: { preferredCurrency: "cny" },
+    });
+  });
+});

package/src/server/serverFns/__tests__/link-preview.test.ts

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// link-preview 域覆盖补全：checkLinkEmbeddableFn 外链嵌入校验。
+// 关键断言：非法/空 URL 与 SSRF 主机拒绝时零 HTTP 请求（fetch 未触达）；
+// 白名单域名放行并解析 title/description。fetch 用 vi.fn 替代真实 HTTP。
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data);
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const M = vi.hoisted(() => ({ requireAuth: vi.fn() }));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+
+import { checkLinkEmbeddableFn } from "../story/link-preview";
+
+const APP_ORIGIN = "https://app.allblue.cn";
+const URL_OK = "https://docs.example.com/page";
+
+type FetchMock = ReturnType<typeof vi.fn>;
+let fetchMock: FetchMock;
+
+/** 构造 fetch 响应 mock（含可取消 body） */
+const jsonResponse = (headers: Record<string, string> = {}) => {
+  const body = { cancel: vi.fn().mockResolvedValue(undefined) };
+  return {
+    headers: { get: (k: string) => headers[k.toLowerCase()] ?? null },
+    body,
+  };
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: "u1" } });
+  fetchMock = vi.fn().mockResolvedValue(jsonResponse());
+  vi.stubGlobal("fetch", fetchMock);
+  // jsdom 环境缺 AbortSignal.timeout（Node 17.3+ 才有），补一个等价实现
+  if (!AbortSignal.timeout) {
+    vi.stubGlobal("AbortSignal", { timeout: (_ms: number) => new AbortController().signal });
+  }
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("checkLinkEmbeddableFn", () => {
+  it("未登录直接拒绝，且不发起任何网络请求", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["非 http/https 协议", "ftp://docs.example.com/page"],
+    ["localhost", "http://localhost:8000/admin"],
+    ["IPv6 回环", "http://[::1]/admin"],
+    ["A 类内网 10.x", "http://10.0.0.8/x"],
+    ["回环 127.x", "http://127.0.0.1/x"],
+    ["链路本地 169.254.x", "http://169.254.10.10/x"],
+    ["C 类内网 192.168.x", "http://192.168.1.1/x"],
+    ["B 类内网 172.16.x", "http://172.20.0.1/x"],
+    ["零网段", "http://0.0.0.0/x"],
+    ["组播 224+", "http://239.1.1.1/x"],
+    ["本地域 .local", "http://host.local/x"],
+    ["内部域 .internal", "http://api.internal/x"],
+  ] as Array<[string, string]>)(
+    "%s 被 SSRF 防护拒绝（不发网络请求）",
+    async (_name, url) => {
+      const res = await checkLinkEmbeddableFn({ data: { url } });
+      expect(res).toEqual({ embeddable: false, reason: "invalid" });
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
+
+  it("合法公网 URL 且响应允许嵌入时返回 embeddable", async () => {
+    const response = jsonResponse({ "content-type": "text/html" });
+    fetchMock.mockResolvedValue(response);
+
+    const res = await checkLinkEmbeddableFn({ data: { url: URL_OK } });
+
+    expect(res).toEqual({ embeddable: true });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [calledUrl, init] = fetchMock.mock.calls[0];
+    expect(calledUrl).toBe(URL_OK);
+    expect(init).toMatchObject({ method: "GET", redirect: "follow" });
+    expect(init.headers["user-agent"]).toContain("AllBlueEmbedCheck");
+    // 预检无需读取正文，读完响应头即释放 body
+    expect(response.body.cancel).toHaveBeenCalled();
+  });
+
+  it("PDF 内容类型也允许嵌入", async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "application/pdf" }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("非 HTML/PDF 内容类型返回 not-html", async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "application/json" }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: false, reason: "not-html" });
+  });
+
+  it.each([
+    ["X-Frame-Options: DENY", { "x-frame-options": "DENY" }],
+    ["X-Frame-Options: SAMEORIGIN", { "x-frame-options": "SAMEORIGIN" }],
+  ])("%s 被拒", async (_name, headers) => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "text/html", ...headers }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP frame-ancestors 'none' 被拒", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "default-src 'self'; frame-ancestors 'none'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP frame-ancestors 为 * 时放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors *",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("CSP frame-ancestors 显式命中应用域名时放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors https://app.allblue.cn https://other.example.com",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("CSP frame-ancestors 未命中应用域名时拒绝", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors https://other.example.com",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP 无 frame-ancestors 指令时视为放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "default-src 'self'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("目标与应用同源时 'self' 视为允许", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors 'self'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({
+        data: { url: "https://app.allblue.cn/embed/page", origin: APP_ORIGIN },
+      }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("预检超时/网络异常时降级为可嵌入（交由 iframe 实际尝试）", async () => {
+    fetchMock.mockRejectedValue(new Error("timeout"));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("validator 拒绝非法 URL（不是合法 URL 格式）", async () => {
+    await expect(checkLinkEmbeddableFn({ data: { url: "not-a-url" } })).rejects.toThrow();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/__tests__/project-kb.test.ts

@@ -84,7 +84,7 @@ describe("setProjectKbsFn 校验", () => {
     mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }]); // 请求 [kb1(team), kb2(general)] 但只查回 kb1
     await expect(
       setProjectKbsFn({ data: { projectId: "p1", kbIds: ["kb1", "kb2"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅允许团队可见") });
+    ).rejects.toThrow("仅允许团队可见");
     expect(mocks.transaction).not.toHaveBeenCalled();
   });
 
@@ -117,14 +117,14 @@ describe("setKbProjectsFn 校验", () => {
     mocks.kbFindFirst.mockResolvedValue({ id: "kbG", visibility: "general" });
     await expect(
       setKbProjectsFn({ data: { kbId: "kbG", projectIds: ["p1"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("通用知识库") });
+    ).rejects.toThrow("通用知识库");
   });
 
   it("private KB 拒绝关联", async () => {
     mocks.kbFindFirst.mockResolvedValue({ id: "kbP", visibility: "private" });
     await expect(
       setKbProjectsFn({ data: { kbId: "kbP", projectIds: ["p1"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("私有知识库") });
+    ).rejects.toThrow("私有知识库");
   });
 });
 

package/src/server/serverFns/__tests__/project-team-assign.test.ts

@@ -65,7 +65,7 @@ describe('addProjectMemberFromTeamFn', () => {
     vi.mocked(prisma.project.findUnique).mockResolvedValue({ id: 'p1', ownerId: 'owner1', workspaceId: 'ws1' } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
     await expect(addProjectMemberFromTeamFn({ data: { projectId: 'p1', userId: 'u9' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('团队') })
+      .rejects.toThrow('团队')
   })
 
   it('guest 强制 viewer 角色', async () => {