@allbluecn/web-app 0.10.3 → 0.11.1

package/src/routes/_nav/route.tsx

@@ -21,6 +21,11 @@ import { useMemo } from 'react'
 
 import { m } from '@/paraglide/messages.js'
 import { isDesktopServer } from '@/server/desktop-guest'
+import { listPinnedWorkspacesBriefFn } from '@/server/serverFns/workspace'
+import { listKnowledgeFn } from '@/server/serverFns/knowledge'
+import { ensureVerifyReminderFn } from '@/server/serverFns/auth/verify-reminder'
+import { WORKSPACES_QUERY_KEY } from '@/lib/collections/reference/workspaces-collection'
+import { KNOWLEDGE_BASES_QUERY_KEY } from '@/lib/collections/knowledge/knowledge-bases-collection'
 import { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from '@/components/ui/empty'
 import { Button } from '@/components/ui/button'
 import { GlobalErrorBoundary } from '@/components/error/global-error-boundary'
@@ -157,6 +162,27 @@ export const Route = createFileRoute('/_nav')({
       })
     }
   },
+  loader: async ({ context }) => {
+    const { queryClient } = context
+    // SSR 预取侧边栏常驻菜单（工作空间/知识库）数据，刷新后 hydrate 首帧即有数据，
+    // 避免侧边栏菜单每次刷新重新加载
+    await Promise.all([
+      queryClient.ensureQueryData({
+        queryKey: WORKSPACES_QUERY_KEY,
+        queryFn: () => listPinnedWorkspacesBriefFn(),
+      }),
+      queryClient.ensureQueryData({
+        queryKey: KNOWLEDGE_BASES_QUERY_KEY,
+        queryFn: () => listKnowledgeFn(),
+      }),
+    ]).catch(() => {
+      // 预取失败降级为客户端 fetch（与旧行为一致），不阻塞页面
+    })
+
+    if (context.session?.user?.id) {
+      ensureVerifyReminderFn({ data: {} }).catch(() => undefined)
+    }
+  },
   notFoundComponent: NavNotFound,
   errorComponent: GlobalErrorBoundary,
 })

package/src/routes/_nav/workspaces/$workspaceId/route.lazy.tsx

@@ -20,21 +20,22 @@ import { useEffect, useState } from "react";
 import { useTheme } from "next-themes";
 import { GlyphMatrix } from "@/components/magicui/glyph-matrix";
 import { CreateProjectDialog } from "@/components/project/create-project-dialog";
-import { EditWorkspaceDialog } from "@/components/workspace/edit-workspace-dialog";
+import { EditWorkspaceDialog } from "@/components/workspace/dialogs/edit-workspace-dialog";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
 import {
   deleteWorkspaceFn,
   listWorkspaceMembersFn,
   listWorkspacesFn,
 } from "@/server/serverFns/workspace";
 import { deleteProjectFn } from "@/server/serverFns/project";
-import { WorkspaceHeader } from "@/components/workspace/workspace-header";
-import { WorkspaceKbCard } from "@/components/workspace/workspace-kb-card";
-import { WorkspaceContributionCard } from "@/components/workspace/workspace-contribution-card";
-import { WorkspaceProjectList } from "@/components/workspace/workspace-project-list";
-import { WorkspaceActivityCard } from "@/components/workspace/workspace-activity-card";
-import { WorkspaceMembersManager } from "@/components/workspace/workspace-members-manager";
+import { WorkspaceHeader } from "@/components/workspace/header/workspace-header";
+import { WorkspaceKbCard } from "@/components/workspace/kb/workspace-kb-card";
+import { WorkspaceContributionCard } from "@/components/workspace/contribution/workspace-contribution-card";
+import { WorkspaceProjectList } from "@/components/workspace/projects/workspace-project-list";
+import { WorkspaceActivityCard } from "@/components/workspace/activity/workspace-activity-card";
+import { WorkspaceMembersManager } from "@/components/workspace/members/workspace-members-manager";
+import type { WorkspaceKbCardData } from "@/server/serverFns/workspace-kb-utils";
 import { m } from "@/paraglide/messages.js";
 
 type DetailData = {
@@ -75,10 +76,11 @@ type DetailData = {
     joinedAt: Date;
     user?: { id: string; username: string; email: string; avatarConfig?: unknown; bgShape?: string | null; bgColor?: string | null };
   }[];
+  kbCard: WorkspaceKbCardData;
 };
 
 function WorkspaceDetailPage() {
-  const { workspace, projects, activities, contributionData, members } = Route.useLoaderData() as DetailData;
+  const { workspace, projects, activities, contributionData, members, kbCard } = Route.useLoaderData() as DetailData;
   const [editOpen, setEditOpen] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
   const [projectEditOpen, setProjectEditOpen] = useState(false);
@@ -150,7 +152,7 @@ function WorkspaceDetailPage() {
           onEdit={() => setEditOpen(true)}
           onDelete={() => setDeleteOpen(true)}
         />
-        <WorkspaceKbCard />
+        <WorkspaceKbCard workspaceId={workspace.id} data={kbCard} />
         <div className="grid gap-6 lg:grid-cols-3">
           <div className="lg:col-span-2 space-y-6">
             <WorkspaceContributionCard data={contributionData} />
@@ -166,7 +168,7 @@ function WorkspaceDetailPage() {
               workspaceId={workspace.id}
               workspaceOwnerId={workspace.ownerId}
               members={members}
-              onMembersUpdated={() => window.dispatchEvent(new CustomEvent("workspace-members-updated"))}
+              onMembersUpdated={() => { void router.invalidate(); }}
             />
           </div>
         </div>

package/src/routes/_nav/workspaces/$workspaceId/route.tsx

@@ -23,17 +23,19 @@ import {
   getWorkspaceActivityDataFn,
   listWorkspaceMembersFn,
 } from "@/server/serverFns/workspace";
+import { getWorkspaceKbCardFn } from "@/server/serverFns/workspace-kb";
 
 export const Route = createFileRoute("/_nav/workspaces/$workspaceId")({
   loader: async ({ params }) => {
-    const [workspace, projects, activities, contributionData, members] = await Promise.all([
+    const [workspace, projects, activities, contributionData, members, kbCard] = await Promise.all([
       getWorkspaceDetailFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceProjectsFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceActivitiesFn({ data: { workspaceId: params.workspaceId, take: 5 } }),
       getWorkspaceActivityDataFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceMembersFn({ data: { workspaceId: params.workspaceId } }),
+      getWorkspaceKbCardFn({ data: { workspaceId: params.workspaceId } }),
     ]);
-    return { workspace, projects, activities, contributionData, members };
+    return { workspace, projects, activities, contributionData, members, kbCard };
   },
   pendingComponent: () => null,
 });

package/src/routes/_nav/workspaces/$workspaceId/settings/route.lazy.tsx

@@ -28,7 +28,7 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { LucideIconPicker } from "@/components/shared-kit/icons/lucide-icon-picker";
 
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
 import {
   updateWorkspaceFn,
   deleteWorkspaceFn,

package/src/routes/_nav/workspaces/index.lazy.tsx

@@ -30,9 +30,9 @@ import {
 import { Separator } from "@/components/ui/separator";
 import { GlyphMatrix } from "@/components/magicui/glyph-matrix";
 import { LucideIconByName } from "@/components/shared-kit/icons/lucide-icon-picker/lucide-icon-by-name";
-import { CreateWorkspaceDialog } from "@/components/workspace/create-workspace-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
-import { EditWorkspaceDialog } from "@/components/workspace/edit-workspace-dialog";
+import { CreateWorkspaceDialog } from "@/components/workspace/dialogs/create-workspace-dialog";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
+import { EditWorkspaceDialog } from "@/components/workspace/dialogs/edit-workspace-dialog";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
 import { toggleWorkspacePinFn, deleteWorkspaceFn } from "@/server/serverFns/workspace";
 import { toast } from "@/components/ui/sonner";

package/src/routes/_public/index/route.tsx

@@ -17,11 +17,12 @@
 
 import { createFileRoute, redirect } from '@tanstack/react-router'
 import { isSaasEdition } from '@/lib/edition'
+import { isDesktopEdition } from '@/lib/edition-desktop'
 import AgencyHeroSection from '@/components/shadcn-space/blocks/hero-01'
 
 export const Route = createFileRoute('/_public/')({
   beforeLoad: () => {
-    if (!isSaasEdition) throw redirect({ to: '/dashboard' })
+    if (!isSaasEdition || isDesktopEdition()) throw redirect({ to: '/dashboard' })
   },
   component: IndexPage,
 })

package/src/routes/api/auth/desktop-callback.ts

@@ -2,7 +2,7 @@ import { createFileRoute } from '@tanstack/react-router'
 import { getSession } from 'start-authjs'
 import { prisma } from '@allbluecn/database'
 import { getProService, isProEdition } from '@/server/pro-services'
-import { authConfig } from '@/lib/auth/auth.config'
+import { getAuthConfig } from '@/lib/auth/auth.config'
 import { generateEntitlementsToken } from '@/server/entitlements-token'
 import type { FeatureKey } from '@allbluecn/kernel'
 
@@ -10,7 +10,7 @@ export const Route = createFileRoute('/api/auth/desktop-callback')({
   server: {
     handlers: {
       GET: async ({ request }) => {
-        const session = await getSession(request, authConfig)
+        const session = await getSession(request, await getAuthConfig())
         if (!session?.user) {
           return new Response('未登录', { status: 401 })
         }

package/src/routes/api/billing-webhook.ts

@@ -18,6 +18,7 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { getProService } from '@/server/pro-services'
 import { WebhookSignatureError } from '@allbluecn/kernel'
+import { sendBillingEmailForEvent } from '@/server/billing-email'
 
 export const Route = createFileRoute('/api/billing-webhook')({
   server: {
@@ -32,6 +33,9 @@ export const Route = createFileRoute('/api/billing-webhook')({
         const rawBody = await request.text()
         try {
           await (getProService('billing')!)?.handleWebhookEvent(rawBody, signature)
+          if (getProService('billing')) {
+            await sendBillingEmailForEvent(rawBody)
+          }
           return new Response(JSON.stringify({ received: true }), {
             status: 200,
             headers: { 'Content-Type': 'application/json' },

package/src/routes/api/cron/changelog-release.ts

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from '@tanstack/react-router'
+import { prisma } from '@allbluecn/database'
+import { sendTemplateEmail } from '@/server/email'
+import { APP_VERSION } from '@/lib/app-version'
+
+const BATCH_SIZE = 50
+const LAST_RELEASED_KEY = 'changelog.lastReleasedVersion'
+
+async function isAuthorized(request: Request): Promise<boolean> {
+  const secret = process.env.CRON_SECRET
+  if (!secret) {
+    return process.env.NODE_ENV !== 'production'
+  }
+  return (request.headers.get('authorization') ?? '') === `Bearer ${secret}`
+}
+
+export const Route = createFileRoute('/api/cron/changelog-release')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        if (!(await isAuthorized(request))) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
+        const current = APP_VERSION
+        const last = await prisma.systemSetting.findUnique({
+          where: { key: LAST_RELEASED_KEY },
+        })
+        if (last?.value === current) {
+          return Response.json({ done: true, reason: 'up-to-date' })
+        }
+
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+        // Prisma 无 NOT EXISTS 便捷写法：用 emailLog.dedupeKey 前缀反查已发送 email，
+        // 再在 subscriber 查询层用 notIn 排除，避免「取 batch → filter」导致的死循环。
+        const sentEmails = await prisma.emailLog.findMany({
+          where: { dedupeKey: { startsWith: `release:${current}:` } },
+          select: { to: true },
+        })
+        const sentEmailSet = new Set(sentEmails.map((e) => e.to))
+
+        const subs = await prisma.emailSubscriber.findMany({
+          where: {
+            confirmedAt: { not: null },
+            unsubscribedAt: null,
+            email: { notIn: [...sentEmailSet] },
+          },
+          select: { email: true, locale: true, confirmToken: true },
+          take: BATCH_SIZE,
+        })
+
+        let sent = 0
+        for (const sub of subs) {
+          const dedupeKey = `release:${current}:${sub.email}`
+          const res = await sendTemplateEmail({
+            key: 'product.changelog-release',
+            to: sub.email,
+            locale: sub.locale,
+            dedupeKey,
+            unsubscribeUrl: `${appUrl}/email-unsubscribe?token=${sub.confirmToken}`,
+            vars: {
+              version: current,
+              highlights: '',
+              detailUrl: `${appUrl}/changelog`,
+            },
+          })
+          if (res.sent) sent++
+        }
+
+        if (subs.length < BATCH_SIZE) {
+          await prisma.systemSetting.upsert({
+            where: { key: LAST_RELEASED_KEY },
+            create: { key: LAST_RELEASED_KEY, value: current, desc: 'changelog 已发布版本号' },
+            update: { value: current },
+          })
+          return Response.json({ done: true, sent })
+        }
+        return Response.json({ done: false, sent })
+      },
+    },
+  },
+})

package/src/routes/api/cron/subscription-reminders.ts

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from '@tanstack/react-router'
+import { prisma } from '@allbluecn/database'
+import { sendTemplateEmail } from '@/server/email'
+
+const DAY_MS = 24 * 60 * 60 * 1000
+
+const WINDOWS = [
+  { days: 7, offsetMs: 7 * DAY_MS },
+  { days: 3, offsetMs: 3 * DAY_MS },
+  { days: 1, offsetMs: 1 * DAY_MS },
+] as const
+
+function startOfDay(d: Date): Date {
+  return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()))
+}
+
+function dateOnly(d: Date): string {
+  return d.toISOString().slice(0, 10)
+}
+
+async function isAuthorized(request: Request): Promise<boolean> {
+  const secret = process.env.CRON_SECRET
+  if (!secret) {
+    return process.env.NODE_ENV !== 'production'
+  }
+  return (request.headers.get('authorization') ?? '') === `Bearer ${secret}`
+}
+
+export const Route = createFileRoute('/api/cron/subscription-reminders')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        if (!(await isAuthorized(request))) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
+        const todayStart = startOfDay(new Date())
+        const wideUntil = new Date(todayStart.getTime() + WINDOWS[0].offsetMs)
+
+        const subs = await prisma.subscription.findMany({
+          where: {
+            OR: [
+              {
+                status: 'ACTIVE',
+                cancelAtPeriodEnd: true,
+                currentPeriodEnd: { gte: todayStart, lte: wideUntil },
+              },
+              {
+                status: 'TRIALING',
+                trialEndsAt: { gte: todayStart, lte: wideUntil },
+              },
+            ],
+          },
+          include: {
+            user: { select: { email: true, locale: true } },
+            plan: { select: { displayName: true } },
+          },
+        })
+
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+        let processed = 0
+
+        for (const sub of subs) {
+          if (!sub.user?.email || !sub.plan) continue
+          const endDate = sub.status === 'TRIALING' ? sub.trialEndsAt : sub.currentPeriodEnd
+          if (!endDate) continue
+          const endDateStr = dateOnly(endDate)
+
+          for (const w of WINDOWS) {
+            const until = new Date(todayStart.getTime() + w.offsetMs)
+            if (endDate < todayStart || endDate > until) continue
+            const dedupeKey = `sub-reminder:${sub.id}:${endDateStr}:${w.days}`
+            const res = await sendTemplateEmail({
+              key: 'billing.subscription-ending',
+              to: sub.user.email,
+              locale: sub.user.locale ?? 'zh',
+              userId: sub.userId,
+              dedupeKey,
+              vars: {
+                planName: sub.plan.displayName,
+                endDate: endDateStr,
+                dashboardUrl: `${appUrl}/settings/billing`,
+              },
+            })
+            if (res.sent) processed++
+          }
+        }
+
+        return Response.json({ processed })
+      },
+    },
+  },
+})

package/src/routes/api.auth.$.ts

@@ -16,16 +16,14 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createFileRoute } from '@tanstack/react-router'
-import { authConfig } from '@/lib/auth/auth.config'
+import { getAuthConfig } from '@/lib/auth/auth.config'
 import { StartAuthJS } from 'start-authjs'
 
-const authHandlers = StartAuthJS(authConfig)
-
 export const Route = createFileRoute('/api/auth/$')({
   server: {
     handlers: {
-      GET: ({ request }) => authHandlers.GET({ request }),
-      POST: ({ request }) => authHandlers.POST({ request }),
+      GET: async ({ request }) => (await StartAuthJS(await getAuthConfig())).GET({ request }),
+      POST: async ({ request }) => (await StartAuthJS(await getAuthConfig())).POST({ request }),
     },
   },
 })

package/src/server/__tests__/agent-crud.test.ts

@@ -178,14 +178,14 @@ describe('agent-crud serverFn', () => {
 
     it('FeatureUnavailableError / FeatureForbiddenError → 抛错不建', async () => {
       mocks.requireFeature.mockRejectedValue(new Error('FeatureUnavailableError: xxx'))
-      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toMatchObject({ message: expect.stringMatching(/FeatureUnavailable|FeatureForbidden/) })
+      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toThrow(/FeatureUnavailable|FeatureForbidden/)
       expect(mocks.create).not.toHaveBeenCalled()
     })
 
     it('ResourceLimitError → 抛错不建', async () => {
       mocks.requireFeature.mockResolvedValue(undefined as any)
       mocks.requireResource.mockRejectedValue(new Error('ResourceLimitError: agentQuota 已达上限'))
-      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toMatchObject({ message: expect.stringMatching(/ResourceLimit|已达上限/) })
+      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toThrow(/ResourceLimit|已达上限/)
       expect(mocks.create).not.toHaveBeenCalled()
     })
 
@@ -236,7 +236,7 @@ describe('agent-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(updateAgentFn({ data: { id: 'ag-other', name: 'X' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(updateAgentFn({ data: { id: 'ag-other', name: 'X' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
 
@@ -272,7 +272,7 @@ describe('agent-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(deleteAgentFn({ data: { id: 'ag-other' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(deleteAgentFn({ data: { id: 'ag-other' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
   })

package/src/server/__tests__/auth-registration.test.ts

@@ -0,0 +1,60 @@
+import { describe, it, expect, vi } from 'vitest'
+import { consumeInvitationCode, type ConsumeResult } from '../auth-registration'
+import type { Prisma } from '@allbluecn/database'
+
+type TxMock = {
+  invitationCode: {
+    findUnique: ReturnType<typeof vi.fn>
+    updateMany: ReturnType<typeof vi.fn>
+  }
+}
+
+function makeTx(overrides: Record<string, unknown> = {}): { tx: Prisma.TransactionClient; mock: TxMock } {
+  const mock: TxMock = {
+    invitationCode: {
+      findUnique: vi.fn().mockResolvedValue({ id: 'code_1', maxUses: 2 }),
+      updateMany: vi.fn().mockResolvedValue({ count: 1 }),
+      ...overrides,
+    },
+  }
+  return { tx: mock as unknown as Prisma.TransactionClient, mock }
+}
+
+describe('consumeInvitationCode', () => {
+  it('有效邀请码：占一位并返回 codeId', async () => {
+    const { tx, mock } = makeTx()
+    const r: ConsumeResult = await consumeInvitationCode(tx, 'ABC')
+    expect(r).toEqual({ ok: true, codeId: 'code_1' })
+    expect(mock.invitationCode.updateMany).toHaveBeenCalledWith({
+      where: expect.objectContaining({
+        id: 'code_1',
+        usedCount: { lt: 2 },
+        disabledAt: null,
+        expiresAt: { gt: expect.any(Date) },
+      }),
+      data: { usedCount: { increment: 1 } },
+    })
+  })
+
+  it('邀请码不存在：返回「邀请码无效」', async () => {
+    const { tx, mock } = makeTx({ findUnique: vi.fn().mockResolvedValue(null) })
+    const r = await consumeInvitationCode(tx, 'NOPE')
+    expect(r).toEqual({ ok: false, error: '邀请码无效' })
+    expect(mock.invitationCode.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('配额耗尽/过期/禁用：updateMany count=0 → 返回用尽错误', async () => {
+    const { tx } = makeTx({ updateMany: vi.fn().mockResolvedValue({ count: 0 }) })
+    const r = await consumeInvitationCode(tx, 'FULL')
+    expect(r).toEqual({ ok: false, error: '邀请码已用尽、过期或被禁用' })
+  })
+
+  it('邀请码大小写与首尾空格归一化后匹配', async () => {
+    const { tx, mock } = makeTx()
+    await consumeInvitationCode(tx, '  abc ')
+    expect(mock.invitationCode.findUnique).toHaveBeenCalledWith({
+      where: { code: 'ABC' },
+      select: { id: true, maxUses: true },
+    })
+  })
+})

package/src/server/__tests__/chat-conversations.test.ts

@@ -145,9 +145,7 @@ describe("createConversationFn", () => {
 
     await expect(
       createConversationFn({ data: { agentId: "agent-xxx" } }),
-    ).rejects.toMatchObject({
-      message: expect.stringContaining("not found"),
-    })
+    ).rejects.toThrow("not found")
     expect(mocks.create).not.toHaveBeenCalled()
   })
 

package/src/server/__tests__/fetch-guard.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+import { assertFetchableUrl, FetchGuardError } from "../fetch-guard";
+
+describe("assertFetchableUrl SSRF 主机防护", () => {
+  it.each([
+    "http://127.0.0.1:8080/api",
+    "http://localhost:3000/x",
+    "http://10.0.0.5/internal",
+    "http://172.16.1.1/admin",
+    "http://192.168.1.1/router",
+    "http://169.254.169.254/latest/meta-data", // 云元数据
+    "http://0.0.0.0/",
+    "http://[::1]:8080/",
+    "http://[fe80::1]/", // 链路本地
+    "http://[::ffff:127.0.0.1]/", // IPv4-mapped IPv6 回环（SSRF 经典绕过）
+    "http://[::ffff:a9fe:a9fe]/", // IPv4-mapped 云元数据
+    "http://[::ffff:10.0.0.5]/", // mapped 归一形态 ::ffff:a00:5（URL 压缩组前导零）
+    "http://[::ffff:0:0:127.0.0.1]/", // IPv4-translated 变体（::ffff:0:0/96 前缀）
+    "http://[::127.0.0.1]/", // IPv4-compatible ::/96 回环
+    "http://[::a9fe:a9fe]/", // IPv4-compatible 云元数据
+    "http://[::10.0.0.5]/", // IPv4-compatible A 类私网
+    "http://[fc00::1]/", // IPv6 ULA 私网段
+    "http://[fd12:3456::1]/",
+  ])("拒绝私网/回环/元数据地址：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it.each([
+    "https://api.openai.com/v1/models",
+    "http://example.com/page",
+  ])("放行公网地址：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).not.toThrow();
+  });
+
+  it.each([
+    ["http://[2001:4860:4860::8888]/", "普通公网 IPv6"],
+    ["http://[::ffff:8.8.8.8]/", "IPv4-mapped 公网（防映射还原分支误伤）"],
+    ["http://[::ffff:0:0:8.8.8.8]/", "IPv4-mapped 翻译形态公网（防误伤对称覆盖）"],
+    ["http://[::8.8.8.8]/", "IPv4-compatible 公网（防内嵌分支误伤）"],
+    ["http://[2606:4700:4700::1111]/", "Cloudflare 公网 IPv6"],
+  ])("公网 IPv6 地址放行：%s（%s）", (url) => {
+    expect(() => assertFetchableUrl(url)).not.toThrow();
+  });
+
+  it.each([
+    "file:///etc/passwd",
+    "ftp://example.com/f",
+    "gopher://example.com/",
+  ])("仅允许 http/https 协议：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it("allowPrivate 显式放行内网（SearXNG 自托管场景）", () => {
+    expect(() =>
+      assertFetchableUrl("http://127.0.0.1:8888/search", { allowPrivate: true }),
+    ).not.toThrow();
+  });
+
+  it("allowHosts 白名单精确匹配放行", () => {
+    expect(() =>
+      assertFetchableUrl("https://searx.internal.corp/search", {
+        allowedHosts: ["searx.internal.corp"],
+      }),
+    ).not.toThrow();
+    expect(() =>
+      assertFetchableUrl("https://evil.corp/search", {
+        allowedHosts: ["searx.internal.corp"],
+      }),
+    ).toThrow(FetchGuardError);
+  });
+
+  it.each([
+    ["http://2130706433/", "十进制整数 127.0.0.1"],
+    ["http://0x7f000001/", "十六进制 127.0.0.1"],
+    ["http://017700000001/", "八进制整数 127.0.0.1"],
+    ["http://0177.0.0.1/", "点分八进制 127.0.0.1"],
+    ["http://99999999999999/", "超出 IPv4 范围（URL 构造期抛 Invalid URL）"],
+  ])("拒绝整数形式 IP 混淆：%s（%s）", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it("返回规范化 URL 供 fetch 使用", () => {
+    expect(assertFetchableUrl("https://example.com/a?q=1").href).toBe(
+      "https://example.com/a?q=1",
+    );
+  });
+
+  it("大写协议与省略段 IPv4 规范化后仍被拒绝", () => {
+    expect(() => assertFetchableUrl("HTTP://127.0.0.1/x")).toThrow(FetchGuardError);
+    expect(() => assertFetchableUrl("http://127.1/")).toThrow(FetchGuardError);
+  });
+
+  it("协议被拒绝时错误类型仍是 FetchGuardError", () => {
+    expect(() => assertFetchableUrl("file:///etc/passwd")).toThrow(FetchGuardError);
+    expect(() => assertFetchableUrl("file:///etc/passwd")).toThrow(
+      /不在允许范围/,
+    );
+  });
+});

package/src/server/__tests__/permissions.test.ts

@@ -62,8 +62,6 @@ describe('requirePermission', () => {
   it('有角色但 checkPermission 返回 none → 拒绝', async () => {
     vi.mocked(prisma.roleAssignment.count).mockResolvedValue(1)
     vi.mocked(getProService('permissions')!.checkPermission).mockResolvedValue('none')
-    await expect(requirePermission('u1', 'knowledge', 'write')).rejects.toMatchObject({
-      name: 'PermissionForbiddenError',
-    })
+    await expect(requirePermission('u1', 'knowledge', 'write')).rejects.toBeInstanceOf(PermissionForbiddenError)
   })
 })