@allbluecn/web-app 0.10.2 → 0.11.0

package/src/server/serverFns/__tests__/story-types.test.ts

@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// story 类型工具纯函数覆盖补全：castStoryUsers / castStoryUsersLight / castUserBrief /
+// toActivityItem / aggregateReactions / toValidDate / toDateOnly / buildStoryTree /
+// checkDescendant。纯函数无 serverFn，仅 mock Prisma。关键断言：null 安全、空数组
+// 短路、树构建深度与后代判定边界。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const M = vi.hoisted(() => ({
+  storyCount: vi.fn(),
+  storyFindUnique: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: { story: { count: M.storyCount, findUnique: M.storyFindUnique } },
+  Prisma: {},
+}));
+
+import {
+  type StoryListRowLight,
+  ACTIVITY_SELECT,
+  USER_BRIEF_SELECT,
+  aggregateReactions,
+  buildStoryTree,
+  castStoryUsers,
+  castStoryUsersLight,
+  castUserBrief,
+  checkDescendant,
+  toDateOnly,
+  toActivityItem,
+  toValidDate,
+} from "../story/types";
+
+const T_CREATED = new Date("2026-01-01T12:00:00Z");
+const T_UPDATED = new Date("2026-01-02T12:00:00Z");
+const T_START = new Date("2026-03-05T12:00:00Z");
+
+const userBrief = (over: Record<string, unknown> = {}) => ({
+  id: "u-creator",
+  username: "alice",
+  email: "alice@example.com",
+  avatarConfig: null,
+  bgShape: null,
+  bgColor: null,
+  ...over,
+});
+/** STORY_LIST_SELECT 完整形状（含 parent/assignee/updatedBy/labels） */
+const storyFull = (over: Record<string, unknown> = {}) => ({
+  id: "st-1",
+  identifier: "STORY-1",
+  sequenceId: 3,
+  name: "需求A",
+  description: "{\"html\":\"<p>x</p>\"}",
+  state: "todo",
+  priority: "high",
+  archived: false,
+  startDate: T_START,
+  targetDate: null,
+  boardOrder: 1,
+  projectId: "pr-1",
+  parentId: "st-0",
+  parent: { id: "st-0", name: "父需求", state: "done", identifier: "STORY-0" },
+  assignee: userBrief({ id: "u-assignee", username: "bob" }),
+  createdBy: userBrief(),
+  updatedBy: userBrief({ id: "u-updater", username: "carol" }),
+  labels: [{ label: { id: "lb-1", name: "P0", color: "#ff0000" } }],
+  createdAt: T_CREATED,
+  updatedAt: T_UPDATED,
+  ...over,
+});
+
+beforeEach(() => vi.clearAllMocks());
+
+describe("castStoryUsers", () => {
+  it("序列化日期、映射 labels 并把 parent 转成 UI 形状", () => {
+    const res = castStoryUsers(storyFull());
+    expect(res).toMatchObject({
+      id: "st-1",
+      identifier: "STORY-1",
+      sequenceId: 3,
+      state: "todo",
+      priority: "high",
+      archived: false,
+      startDate: T_START.toISOString(),
+      targetDate: null,
+      createdAt: T_CREATED.toISOString(),
+      updatedAt: T_UPDATED.toISOString(),
+      parent: { id: "st-0", title: "父需求", status: "done", identifier: "STORY-0" },
+      labels: [{ id: "lb-1", name: "P0", color: "#ff0000" }],
+    });
+    expect(res.assignee).toMatchObject({ id: "u-assignee", username: "bob", avatarConfig: null });
+    expect(res.createdBy).toMatchObject({ id: "u-creator", username: "alice", avatarConfig: null });
+    expect(res.updatedBy).toMatchObject({ id: "u-updater", username: "carol", avatarConfig: null });
+  });
+
+  it("无父需求/负责人/更新人时对应字段为 null", () => {
+    const res = castStoryUsers(
+      storyFull({ parent: null, assignee: null, updatedBy: null, labels: [], startDate: null }),
+    );
+    expect(res.parent).toBeNull();
+    expect(res.assignee).toBeNull();
+    expect(res.updatedBy).toBeNull();
+    expect(res.labels).toEqual([]);
+    expect(res.startDate).toBeNull();
+  });
+
+  it("头像配置保留非空 JSON", () => {
+    const cfg = { bgShape: "blob", bgColor: "#0000ff", parts: [] };
+    const res = castStoryUsers(storyFull({ assignee: userBrief({ avatarConfig: cfg }) }));
+    expect(res.assignee.avatarConfig).toEqual(cfg);
+  });
+});
+
+describe("castStoryUsersLight", () => {
+  it("强制置空 description 并做同样的用户序列化", () => {
+    const res = castStoryUsersLight(storyFull() as unknown as StoryListRowLight);
+    expect(res.description).toBeNull();
+    expect(res.startDate).toBe(T_START.toISOString());
+    expect(res.createdAt).toBe(T_CREATED.toISOString());
+    expect(res.parent).toEqual({ id: "st-0", title: "父需求", status: "done", identifier: "STORY-0" });
+    expect(res.labels).toEqual([{ id: "lb-1", name: "P0", color: "#ff0000" }]);
+  });
+
+  it("无父需求/负责人时为 null", () => {
+    const res = castStoryUsersLight(storyFull({ parent: null, assignee: null }) as unknown as StoryListRowLight);
+    expect(res.parent).toBeNull();
+    expect(res.assignee).toBeNull();
+    expect(res.description).toBeNull();
+  });
+});
+
+describe("castUserBrief", () => {
+  it("透传字段并把空头像配置归一为 null", () => {
+    const res = castUserBrief(userBrief());
+    expect(res).toEqual(userBrief());
+    expect(castUserBrief(userBrief({ avatarConfig: undefined })).avatarConfig).toBeNull();
+  });
+});
+
+describe("toActivityItem", () => {
+  it("序列化 createdAt 并转换 user brief", () => {
+    const res = toActivityItem({
+      id: "act-1",
+      action: "created",
+      field: "state",
+      oldValue: "backlog",
+      newValue: "todo",
+      isAI: true,
+      createdAt: T_UPDATED,
+      user: userBrief(),
+    });
+    expect(res).toEqual({
+      id: "act-1",
+      action: "created",
+      field: "state",
+      oldValue: "backlog",
+      newValue: "todo",
+      isAI: true,
+      createdAt: T_UPDATED.toISOString(),
+      user: userBrief(),
+    });
+  });
+});
+
+describe("aggregateReactions", () => {
+  it("按 emoji 分组并标记当前用户是否已反应", () => {
+    const res = aggregateReactions(
+      [
+        { emoji: "👍", userId: "u1" },
+        { emoji: "👍", userId: "u2" },
+        { emoji: "🎉", userId: "u2" },
+      ],
+      "u1",
+    );
+    expect(res).toEqual([
+      { emoji: "👍", count: 2, userIds: ["u1", "u2"], reacted: true },
+      { emoji: "🎉", count: 1, userIds: ["u2"], reacted: false },
+    ]);
+  });
+
+  it("无反应时返回空数组", () => {
+    expect(aggregateReactions([], "u1")).toEqual([]);
+  });
+});
+
+describe("toValidDate / toDateOnly", () => {
+  it("合法字符串解析为 Date，非法返回 null", () => {
+    expect(toValidDate("2026-03-05")).toBeInstanceOf(Date);
+    expect(toValidDate("not-a-date")).toBeNull();
+  });
+
+  it("日期格式化为 YYYY-MM-DD（月日补零，跨时区不变）", () => {
+    expect(toDateOnly(new Date("2026-03-05T12:00:00Z"))).toBe("2026-03-05");
+    expect(toDateOnly(new Date("2026-01-09T12:00:00Z"))).toBe("2026-01-09");
+    expect(toDateOnly(new Date("2026-12-31T12:00:00Z"))).toBe("2026-12-31");
+  });
+});
+
+describe("buildStoryTree", () => {
+  it("递归构建节点并逐级 depth+1，count 查询按 parentId 下钻", async () => {
+    M.storyCount.mockImplementation(({ where }: { where: { parentId: string } }) => {
+      const counts: Record<string, number> = { "st-1": 2, "st-2": 1 };
+      return Promise.resolve(counts[where.parentId] ?? 0);
+    });
+
+    const res = await buildStoryTree({
+      id: "st-1",
+      name: "根",
+      state: "todo",
+      parentId: null,
+      children: [
+        { id: "st-2", name: "子1", state: "backlog", parentId: "st-1", children: [
+          { id: "st-4", name: "孙1", state: "backlog", parentId: "st-2", children: [] },
+        ] },
+        { id: "st-3", name: "子2", state: "backlog", parentId: "st-1", children: [] },
+      ],
+    });
+
+    expect(res).toMatchObject({ id: "st-1", title: "根", status: "todo", depth: 0, childrenCount: 2, hasChildren: true });
+    expect(res.children).toBeDefined();
+    const children = res.children ?? [];
+    expect(children).toHaveLength(2);
+    expect(children[0]).toMatchObject({ id: "st-2", depth: 1, childrenCount: 1, hasChildren: true });
+    expect(children[0]?.children).toHaveLength(1);
+    expect(children[0]?.children?.[0]).toMatchObject({ id: "st-4", depth: 2, childrenCount: 0, hasChildren: false });
+    expect(children[1]).toMatchObject({ id: "st-3", depth: 1, childrenCount: 0, hasChildren: false });
+    expect(M.storyCount).toHaveBeenCalledWith({ where: { parentId: "st-1" } });
+  });
+
+  it("无 children 字段时不返回 children 键", async () => {
+    M.storyCount.mockResolvedValue(0);
+    const res = await buildStoryTree({ id: "st-9", name: "叶子", state: "done", parentId: null });
+    expect(res).toEqual({
+      id: "st-9", title: "叶子", status: "done", parentId: null,
+      depth: 0, hasChildren: false, childrenCount: 0,
+    });
+    // children 字段存在但值为 undefined（三元表达式显式赋值）
+    expect(res.children).toBeUndefined();
+  });
+});
+
+describe("checkDescendant", () => {
+  it("沿 parentId 链向上回溯，命中祖先返回 true（覆盖多级链）", async () => {
+    const chain: Record<string, string> = { "st-3": "st-2", "st-2": "st-1" };
+    M.storyFindUnique.mockImplementation(({ where }: { where: { id: string } }) =>
+      Promise.resolve(chain[where.id] ? { parentId: chain[where.id] } : null),
+    );
+
+    await expect(checkDescendant("st-1", "st-3")).resolves.toBe(true);
+    expect(M.storyFindUnique).toHaveBeenCalledWith({ where: { id: "st-3" }, select: { parentId: true } });
+    expect(M.storyFindUnique).toHaveBeenCalledWith({ where: { id: "st-2" }, select: { parentId: true } });
+  });
+
+  it("回溯到根仍未命中时返回 false", async () => {
+    const chain: Record<string, string> = { "st-3": "st-2", "st-2": "st-1" };
+    M.storyFindUnique.mockImplementation(({ where }: { where: { id: string } }) =>
+      Promise.resolve(chain[where.id] ? { parentId: chain[where.id] } : null),
+    );
+    await expect(checkDescendant("st-9", "st-3")).resolves.toBe(false);
+  });
+
+  it("目标为顶层（无父）时直接返回 false", async () => {
+    M.storyFindUnique.mockResolvedValue({ parentId: null });
+    await expect(checkDescendant("st-1", "st-top")).resolves.toBe(false);
+  });
+});
+
+describe("select 常量契约", () => {
+  it("USER_BRIEF_SELECT 与 ACTIVITY_SELECT 字段稳定（防止字段漂移）", () => {
+    expect(USER_BRIEF_SELECT).toEqual({
+      id: true, username: true, email: true, avatarConfig: true, bgShape: true, bgColor: true,
+    });
+    expect(ACTIVITY_SELECT).toEqual({
+      id: true, action: true, field: true, oldValue: true, newValue: true, isAI: true,
+      createdAt: true, user: { select: USER_BRIEF_SELECT },
+    });
+  });
+});

package/src/server/serverFns/__tests__/team-accept.test.ts

@@ -62,7 +62,7 @@ describe('acceptTeamInvitationFn', () => {
       email: 'b@x.com', expiresAt: new Date(Date.now() - 1000), ownerId: 'owner1',
     } as never)
     await expect(acceptTeamInvitationFn({ data: { token: 't1' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
+      .rejects.toThrow('过期')
   })
 
   it('已在团队 → 拒绝', async () => {
@@ -72,7 +72,7 @@ describe('acceptTeamInvitationFn', () => {
     } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'm1' } as never)
     await expect(acceptTeamInvitationFn({ data: { token: 't1' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('已加入') })
+      .rejects.toThrow('已加入')
   })
 
   it('link 邀请任意登录用户申请 → 创建 TeamJoinRequest，不占用邀请行', async () => {
@@ -101,7 +101,7 @@ describe('acceptTeamInvitationFn', () => {
     } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'm1', ownerId: 'u2' } as never)
     await expect(acceptTeamInvitationFn({ data: { token: 't1', userId: null } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('已加入团队') })
+      .rejects.toThrow('已加入团队')
   })
 
   it('email 邀请邮箱不匹配 → 拒绝', async () => {
@@ -111,7 +111,7 @@ describe('acceptTeamInvitationFn', () => {
     } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
     await expect(acceptTeamInvitationFn({ data: { token: 't1' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('邮箱') })
+      .rejects.toThrow('邮箱')
   })
 
   it('getTeamInvitationByTokenFn 正常返回', async () => {
@@ -153,7 +153,7 @@ describe('approveTeamInvitationFn', () => {
       expiresAt: new Date(Date.now() + 60000), createdAt: new Date(),
     } as never)
     await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('approveTeamJoinRequestFn') })
+      .rejects.toThrow('approveTeamJoinRequestFn')
   })
 
   it('acceptedBy 为 null 时用 applicantEmail 回填申请人', async () => {
@@ -186,6 +186,6 @@ describe('approveTeamInvitationFn', () => {
       expiresAt: new Date(Date.now() - 1000), createdAt: new Date(),
     } as never)
     await expect(approveTeamInvitationFn({ data: { invitationId: 'inv1', seatType: 'member' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
+      .rejects.toThrow('过期')
   })
 })

package/src/server/serverFns/__tests__/team-invitation.test.ts

@@ -237,7 +237,7 @@ describe('deleteTeamInvitationFn', () => {
 
     await expect(
       deleteTeamInvitationFn({ data: { invitationId: 'inv2' } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('不可删除') })
+    ).rejects.toThrow('不可删除')
     expect(prisma.teamInvitation.delete).not.toHaveBeenCalled()
   })
 
@@ -248,7 +248,7 @@ describe('deleteTeamInvitationFn', () => {
 
     await expect(
       deleteTeamInvitationFn({ data: { invitationId: 'inv3' } }),
-    ).rejects.toMatchObject({ message: '邀请不存在' })
+    ).rejects.toThrow(new Error('邀请不存在'))
     expect(prisma.teamInvitation.delete).not.toHaveBeenCalled()
   })
 })
@@ -273,7 +273,7 @@ describe('deleteTeamJoinRequestFn', () => {
 
     await expect(
       deleteTeamJoinRequestFn({ data: { requestId: 'jrX' } }),
-    ).rejects.toMatchObject({ message: '申请不存在' })
+    ).rejects.toThrow(new Error('申请不存在'))
     expect(prisma.teamJoinRequest.delete).not.toHaveBeenCalled()
   })
 })

package/src/server/serverFns/__tests__/team-join-request.test.ts

@@ -66,19 +66,19 @@ describe('applyTeamInvitationFn（link 渠道）', () => {
   it('链接不存在 → 拒绝', async () => {
     vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue(null as never)
     await expect(applyTeamInvitationFn({ data: { token: 'tX', email: 'a@x.com' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('不存在') })
+      .rejects.toThrow('不存在')
   })
 
   it('链接过期 → 拒绝', async () => {
     vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({ ...LINK_INV, expiresAt: new Date(Date.now() - 1000) } as never)
     await expect(applyTeamInvitationFn({ data: { token: 't1', email: 'a@x.com' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
+      .rejects.toThrow('过期')
   })
 
   it('邮箱是 owner 自己 → 拒绝（不能加入自己的团队）', async () => {
     vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue(LINK_INV as never)
     await expect(applyTeamInvitationFn({ data: { token: 't1', email: 'owner@x.com' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('自己的团队') })
+      .rejects.toThrow('自己的团队')
   })
 
   it('邮箱已注册且该账号已加入团队 → 拒绝', async () => {
@@ -86,7 +86,7 @@ describe('applyTeamInvitationFn（link 渠道）', () => {
     vi.mocked(prisma.user.findUnique).mockResolvedValue({ id: 'u9' } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'm1' } as never)
     await expect(applyTeamInvitationFn({ data: { token: 't1', email: 'taken@x.com' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('已加入团队') })
+      .rejects.toThrow('已加入团队')
   })
 
   it('新邮箱 → 创建 TeamJoinRequest，且不改 TeamInvitation 状态', async () => {
@@ -128,14 +128,14 @@ describe('approveTeamJoinRequestFn', () => {
   it('申请不存在或非本人 → 拒绝', async () => {
     vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue(null as never)
     await expect(approveTeamJoinRequestFn({ data: { requestId: 'jrX', seatType: 'member' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('申请不存在') })
+      .rejects.toThrow('申请不存在')
   })
 
   it('申请人已加入其他团队 → 友好拒绝', async () => {
     vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue(PENDING_REQ as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue({ id: 'mX' } as never)
     await expect(approveTeamJoinRequestFn({ data: { requestId: 'jr1', seatType: 'member' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('已加入团队') })
+      .rejects.toThrow('已加入团队')
   })
 
   it('链接已过期 → 拒绝并同步失效申请', async () => {
@@ -144,7 +144,7 @@ describe('approveTeamJoinRequestFn', () => {
     } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null as never)
     await expect(approveTeamJoinRequestFn({ data: { requestId: 'jr1', seatType: 'member' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('过期') })
+      .rejects.toThrow('过期')
     expect(prisma.teamJoinRequest.update).toHaveBeenCalledWith(expect.objectContaining({
       data: expect.objectContaining({ status: 'invalidated' }),
     }))
@@ -202,7 +202,7 @@ describe('rejectTeamJoinRequestFn', () => {
   it('非 pending 状态 → 拒绝操作', async () => {
     vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue({ ...PENDING_REQ, status: 'approved' } as never)
     await expect(rejectTeamJoinRequestFn({ data: { requestId: 'jr1' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('待审批') })
+      .rejects.toThrow('待审批')
   })
 })
 

package/src/server/serverFns/__tests__/update-seats.test.ts

@@ -102,7 +102,7 @@ describe('updateSeatsFn', () => {
     mockedSubFindUnique.mockResolvedValue(null)
     await expect(
       updateSeatsFn({ data: { addonSeats: 3 } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('升级') })
+    ).rejects.toThrow('升级')
     expect(fakeBilling.updateSeats).not.toHaveBeenCalled()
   })
 
@@ -120,7 +120,7 @@ describe('updateSeatsFn', () => {
     )
     await expect(
       updateSeatsFn({ data: { addonSeats: 3 } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('不限量') })
+    ).rejects.toThrow('不限量')
   })
 
   it('降购低于工作空间数被 floor 拦截', async () => {
@@ -128,7 +128,7 @@ describe('updateSeatsFn', () => {
     mockedWorkspaceCount.mockResolvedValue(7)
     await expect(
       updateSeatsFn({ data: { addonSeats: 1 } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('工作空间数') })
+    ).rejects.toThrow('工作空间数')
   })
 
   it('合法加购：透传 billing.updateSeats 并返回其结果', async () => {
@@ -166,6 +166,6 @@ describe('updateSeatsFn', () => {
     )
     await expect(
       updateSeatsFn({ data: { addonSeats: 3 } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining('未开通席位加购') })
+    ).rejects.toThrow('未开通席位加购')
   })
 })

package/src/server/serverFns/__tests__/workspace-kb-idor.test.ts

@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// IDOR 越权矩阵（workspace-kb 域样板）：锁定 requireWorkspaceMember 归属校验行为。
+// 放行态：owner 本人 / active 成员。拒绝态：非成员 / 仅 pending / workspace 不存在 / 未登录。
+// 关键断言：越权失败时必须零资源查询（不触达 workspaceKnowledgeBase、knowledgeBase）。
+// mock 骨架与 workspace-kb.test.ts 一致，可被其它 serverFn 域直接复制。
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const mocks = vi.hoisted(() => ({
+  currentSession: vi.fn(),
+  wsFindUnique: vi.fn(),
+  wkbFindMany: vi.fn(),
+  kbFindMany: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
+    workspace: { findUnique: mocks.wsFindUnique },
+    workspaceKnowledgeBase: { findMany: mocks.wkbFindMany },
+    knowledgeBase: { findMany: mocks.kbFindMany },
+  };
+  return { prisma, Prisma: {} };
+});
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.currentSession }));
+
+import { listWorkspaceAvailableKbsFn } from "../workspace-kb";
+
+const OWNER = "user-owner-1";
+const OTHER_USER = "user-attacker-2";
+const WS_ID = "ws-target-1";
+
+// 构造 workspace 归属查询结果（与 requireWorkspaceMember 的 select 形状一致）。
+// activeMemberIds 是 status="active" 过滤后的成员 id 列表；pending 成员不出现在其中。
+const wsOf = (ownerId: string, activeMemberIds: string[]) => ({
+  ownerId,
+  members: activeMemberIds.map((userId) => ({ id: `m-${userId}` })),
+});
+
+// 资源查询：归属校验通过后才会触达的下游查询
+const resourceQueries = [mocks.wkbFindMany, mocks.kbFindMany];
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue({ user: { id: OWNER } });
+  mocks.wkbFindMany.mockResolvedValue([]);
+  mocks.kbFindMany.mockResolvedValue([]);
+});
+
+describe("IDOR 越权矩阵：listWorkspaceAvailableKbsFn", () => {
+  it("owner 访问自己的 workspace 放行", async () => {
+    mocks.currentSession.mockResolvedValue({ user: { id: OWNER } });
+    mocks.wsFindUnique.mockResolvedValue(wsOf(OWNER, []));
+    const res = await listWorkspaceAvailableKbsFn({ data: { workspaceId: WS_ID } });
+    expect(res).toBeTruthy();
+    expect(res).toBeInstanceOf(Array);
+  });
+
+  it("active 成员访问非自己创建的 workspace 放行", async () => {
+    mocks.currentSession.mockResolvedValue({ user: { id: OTHER_USER } });
+    mocks.wsFindUnique.mockResolvedValue(wsOf(OWNER, [OTHER_USER]));
+    const res = await listWorkspaceAvailableKbsFn({ data: { workspaceId: WS_ID } });
+    expect(res).toBeTruthy();
+  });
+
+  // 注意：pending 与非成员在本函数视角下查询结果相同（active 成员均为空），
+  // 二者区分力不来自 mock 数据形态，而来自下方对 wsFindUnique 查询形状
+  // （status: "active"）的断言——新增域的样板请一并复制该形状断言。
+  it.each([
+    [
+      "非成员被拒",
+      wsOf(OWNER, []),
+      /仅工作空间成员可访问/,
+    ],
+    [
+      "仅 pending 成员（未激活）被拒",
+      wsOf(OWNER, []),
+      /仅工作空间成员可访问/,
+    ],
+    ["workspace 不存在被拒", null, /工作空间不存在/],
+  ] as Array<[string, unknown, RegExp]>)(
+    "%s",
+    async (_name, ws, expectedError) => {
+      mocks.currentSession.mockResolvedValue({ user: { id: OTHER_USER } });
+      mocks.wsFindUnique.mockResolvedValue(ws);
+      await expect(
+        listWorkspaceAvailableKbsFn({ data: { workspaceId: WS_ID } }),
+      ).rejects.toThrow(expectedError);
+      for (const query of resourceQueries) {
+        expect(query).not.toHaveBeenCalled();
+      }
+    },
+  );
+
+  it("非成员被拒时成员查询严格按 active 过滤（pending 不计入放行）", async () => {
+    mocks.currentSession.mockResolvedValue({ user: { id: OTHER_USER } });
+    mocks.wsFindUnique.mockResolvedValue(wsOf(OWNER, []));
+    await expect(
+      listWorkspaceAvailableKbsFn({ data: { workspaceId: WS_ID } }),
+    ).rejects.toThrow(/仅工作空间成员可访问/);
+    expect(mocks.wsFindUnique).toHaveBeenCalledWith({
+      where: { id: WS_ID },
+      select: {
+        ownerId: true,
+        members: { where: { userId: OTHER_USER, status: "active" }, select: { id: true } },
+      },
+    });
+  });
+
+  it("未登录直接拒绝", async () => {
+    mocks.currentSession.mockRejectedValue(new Error("UNAUTHORIZED"));
+    mocks.wsFindUnique.mockResolvedValue(wsOf(OWNER, []));
+    await expect(
+      listWorkspaceAvailableKbsFn({ data: { workspaceId: WS_ID } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    // requireAuth 先于 requireWorkspaceMember：未登录时连归属查询都不得发起
+    expect(mocks.wsFindUnique).not.toHaveBeenCalled();
+    for (const query of resourceQueries) {
+      expect(query).not.toHaveBeenCalled();
+    }
+  });
+});