@allbluecn/web-app 0.10.3 → 0.11.1

package/src/server/serverFns/__tests__/link-preview.test.ts

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// link-preview 域覆盖补全：checkLinkEmbeddableFn 外链嵌入校验。
+// 关键断言：非法/空 URL 与 SSRF 主机拒绝时零 HTTP 请求（fetch 未触达）；
+// 白名单域名放行并解析 title/description。fetch 用 vi.fn 替代真实 HTTP。
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data);
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const M = vi.hoisted(() => ({ requireAuth: vi.fn() }));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+
+import { checkLinkEmbeddableFn } from "../story/link-preview";
+
+const APP_ORIGIN = "https://app.allblue.cn";
+const URL_OK = "https://docs.example.com/page";
+
+type FetchMock = ReturnType<typeof vi.fn>;
+let fetchMock: FetchMock;
+
+/** 构造 fetch 响应 mock（含可取消 body） */
+const jsonResponse = (headers: Record<string, string> = {}) => {
+  const body = { cancel: vi.fn().mockResolvedValue(undefined) };
+  return {
+    headers: { get: (k: string) => headers[k.toLowerCase()] ?? null },
+    body,
+  };
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: "u1" } });
+  fetchMock = vi.fn().mockResolvedValue(jsonResponse());
+  vi.stubGlobal("fetch", fetchMock);
+  // jsdom 环境缺 AbortSignal.timeout（Node 17.3+ 才有），补一个等价实现
+  if (!AbortSignal.timeout) {
+    vi.stubGlobal("AbortSignal", { timeout: (_ms: number) => new AbortController().signal });
+  }
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("checkLinkEmbeddableFn", () => {
+  it("未登录直接拒绝，且不发起任何网络请求", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["非 http/https 协议", "ftp://docs.example.com/page"],
+    ["localhost", "http://localhost:8000/admin"],
+    ["IPv6 回环", "http://[::1]/admin"],
+    ["A 类内网 10.x", "http://10.0.0.8/x"],
+    ["回环 127.x", "http://127.0.0.1/x"],
+    ["链路本地 169.254.x", "http://169.254.10.10/x"],
+    ["C 类内网 192.168.x", "http://192.168.1.1/x"],
+    ["B 类内网 172.16.x", "http://172.20.0.1/x"],
+    ["零网段", "http://0.0.0.0/x"],
+    ["组播 224+", "http://239.1.1.1/x"],
+    ["本地域 .local", "http://host.local/x"],
+    ["内部域 .internal", "http://api.internal/x"],
+  ] as Array<[string, string]>)(
+    "%s 被 SSRF 防护拒绝（不发网络请求）",
+    async (_name, url) => {
+      const res = await checkLinkEmbeddableFn({ data: { url } });
+      expect(res).toEqual({ embeddable: false, reason: "invalid" });
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
+
+  it("合法公网 URL 且响应允许嵌入时返回 embeddable", async () => {
+    const response = jsonResponse({ "content-type": "text/html" });
+    fetchMock.mockResolvedValue(response);
+
+    const res = await checkLinkEmbeddableFn({ data: { url: URL_OK } });
+
+    expect(res).toEqual({ embeddable: true });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [calledUrl, init] = fetchMock.mock.calls[0];
+    expect(calledUrl).toBe(URL_OK);
+    expect(init).toMatchObject({ method: "GET", redirect: "follow" });
+    expect(init.headers["user-agent"]).toContain("AllBlueEmbedCheck");
+    // 预检无需读取正文，读完响应头即释放 body
+    expect(response.body.cancel).toHaveBeenCalled();
+  });
+
+  it("PDF 内容类型也允许嵌入", async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "application/pdf" }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("非 HTML/PDF 内容类型返回 not-html", async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "application/json" }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: false, reason: "not-html" });
+  });
+
+  it.each([
+    ["X-Frame-Options: DENY", { "x-frame-options": "DENY" }],
+    ["X-Frame-Options: SAMEORIGIN", { "x-frame-options": "SAMEORIGIN" }],
+  ])("%s 被拒", async (_name, headers) => {
+    fetchMock.mockResolvedValue(jsonResponse({ "content-type": "text/html", ...headers }));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP frame-ancestors 'none' 被拒", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "default-src 'self'; frame-ancestors 'none'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP frame-ancestors 为 * 时放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors *",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("CSP frame-ancestors 显式命中应用域名时放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors https://app.allblue.cn https://other.example.com",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("CSP frame-ancestors 未命中应用域名时拒绝", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors https://other.example.com",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: false, reason: "blocked" });
+  });
+
+  it("CSP 无 frame-ancestors 指令时视为放行", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "default-src 'self'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK, origin: APP_ORIGIN } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("目标与应用同源时 'self' 视为允许", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({
+        "content-type": "text/html",
+        "content-security-policy": "frame-ancestors 'self'",
+      }),
+    );
+    await expect(
+      checkLinkEmbeddableFn({
+        data: { url: "https://app.allblue.cn/embed/page", origin: APP_ORIGIN },
+      }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("预检超时/网络异常时降级为可嵌入（交由 iframe 实际尝试）", async () => {
+    fetchMock.mockRejectedValue(new Error("timeout"));
+    await expect(
+      checkLinkEmbeddableFn({ data: { url: URL_OK } }),
+    ).resolves.toEqual({ embeddable: true });
+  });
+
+  it("validator 拒绝非法 URL（不是合法 URL 格式）", async () => {
+    await expect(checkLinkEmbeddableFn({ data: { url: "not-a-url" } })).rejects.toThrow();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/__tests__/project-kb.test.ts

@@ -84,7 +84,7 @@ describe("setProjectKbsFn 校验", () => {
     mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }]); // 请求 [kb1(team), kb2(general)] 但只查回 kb1
     await expect(
       setProjectKbsFn({ data: { projectId: "p1", kbIds: ["kb1", "kb2"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅允许团队可见") });
+    ).rejects.toThrow("仅允许团队可见");
     expect(mocks.transaction).not.toHaveBeenCalled();
   });
 
@@ -117,14 +117,14 @@ describe("setKbProjectsFn 校验", () => {
     mocks.kbFindFirst.mockResolvedValue({ id: "kbG", visibility: "general" });
     await expect(
       setKbProjectsFn({ data: { kbId: "kbG", projectIds: ["p1"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("通用知识库") });
+    ).rejects.toThrow("通用知识库");
   });
 
   it("private KB 拒绝关联", async () => {
     mocks.kbFindFirst.mockResolvedValue({ id: "kbP", visibility: "private" });
     await expect(
       setKbProjectsFn({ data: { kbId: "kbP", projectIds: ["p1"] } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("私有知识库") });
+    ).rejects.toThrow("私有知识库");
   });
 });
 

package/src/server/serverFns/__tests__/project-team-assign.test.ts

@@ -65,7 +65,7 @@ describe('addProjectMemberFromTeamFn', () => {
     vi.mocked(prisma.project.findUnique).mockResolvedValue({ id: 'p1', ownerId: 'owner1', workspaceId: 'ws1' } as never)
     vi.mocked(prisma.teamMembership.findUnique).mockResolvedValue(null)
     await expect(addProjectMemberFromTeamFn({ data: { projectId: 'p1', userId: 'u9' } }))
-      .rejects.toMatchObject({ message: expect.stringContaining('团队') })
+      .rejects.toThrow('团队')
   })
 
   it('guest 强制 viewer 角色', async () => {

package/src/server/serverFns/__tests__/story-comments.test.ts

@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// story-comments 域覆盖补全：4 个 serverFn（list/create/update/delete）。
+// 关键断言：未登录拒绝且不触达评论查询；删除走级联（含回复子评论计数）；
+// 每条断言锁死 Prisma where 形状。mock 骨架同 workspace-kb-idor.test.ts 样板。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data);
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn();
+  return {
+    requireAuth: f(),
+    storyComment: { findUnique: f(), findMany: f(), create: f(), update: f(), delete: f() },
+    storyActivity: { create: f() },
+  };
+});
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    storyComment: M.storyComment,
+    storyActivity: M.storyActivity,
+  },
+  Prisma: {},
+}));
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+
+import {
+  createCommentFn,
+  deleteCommentFn,
+  listCommentsFn,
+  updateCommentFn,
+} from "../story/story-comments";
+import { USER_BRIEF_SELECT } from "../story/types";
+
+const USER = "u-current";
+const OTHER = "u-other";
+const STORY_ID = "st-1";
+const T1 = new Date("2026-01-01T00:00:00Z");
+const T2 = new Date("2026-01-02T00:00:00Z");
+
+const userRow = {
+  id: USER,
+  username: "alice",
+  email: "alice@example.com",
+  avatarConfig: null,
+  bgShape: null,
+  bgColor: null,
+};
+const commentRow = (over: Record<string, unknown> = {}) => ({
+  id: "c1",
+  content: "评论内容",
+  parentId: null,
+  createdAt: T1,
+  updatedAt: T1,
+  user: userRow,
+  reactions: [],
+  ...over,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: USER } });
+  M.storyComment.create.mockResolvedValue(commentRow());
+  M.storyActivity.create.mockResolvedValue({});
+});
+
+describe("listCommentsFn", () => {
+  it("按 createdAt 升序取出后组装为多级回复树", async () => {
+    M.storyComment.findMany.mockResolvedValue([
+      commentRow({ id: "c1", parentId: null, reactions: [{ emoji: "👍", userId: OTHER }] }),
+      commentRow({ id: "c2", parentId: "c1" }),
+      commentRow({ id: "c3", parentId: "c2" }),
+    ]);
+
+    const res = await listCommentsFn({ data: { storyId: STORY_ID } });
+
+    expect(M.storyComment.findMany).toHaveBeenCalledWith({
+      where: { storyId: STORY_ID },
+      orderBy: { createdAt: "asc" },
+      select: {
+        id: true,
+        content: true,
+        parentId: true,
+        createdAt: true,
+        updatedAt: true,
+        user: { select: USER_BRIEF_SELECT },
+        reactions: { select: { emoji: true, userId: true } },
+      },
+    });
+    expect(res).toHaveLength(1);
+    expect(res[0].id).toBe("c1");
+    expect(res[0].parentId).toBeNull();
+    expect(res[0].createdAt).toBe(T1.toISOString());
+    expect(res[0].user.id).toBe(USER);
+    expect(res[0].reactions).toEqual([{ emoji: "👍", count: 1, userIds: [OTHER], reacted: false }]);
+    expect(res[0].replies).toHaveLength(1);
+    expect(res[0].replies[0].id).toBe("c2");
+    expect(res[0].replies[0].parentId).toBe("c1");
+    expect(res[0].replies[0].replies).toHaveLength(1);
+    expect(res[0].replies[0].replies[0].id).toBe("c3");
+    expect(res[0].replies[0].replies[0].replies).toEqual([]);
+  });
+
+  it("无评论时返回空数组", async () => {
+    M.storyComment.findMany.mockResolvedValue([]);
+    await expect(listCommentsFn({ data: { storyId: STORY_ID } })).resolves.toEqual([]);
+  });
+
+  it("未登录拒绝且不查询评论", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(listCommentsFn({ data: { storyId: STORY_ID } })).rejects.toThrow("UNAUTHORIZED");
+    expect(M.storyComment.findMany).not.toHaveBeenCalled();
+  });
+});
+
+describe("createCommentFn", () => {
+  it("创建评论并追加 commented 活动记录", async () => {
+    const content = "x".repeat(60);
+    M.storyComment.create.mockResolvedValue(commentRow({ content, parentId: null }));
+
+    const res = await createCommentFn({ data: { storyId: STORY_ID, content, parentId: null } });
+
+    expect(M.storyComment.create).toHaveBeenCalledWith({
+      data: { storyId: STORY_ID, userId: USER, parentId: null, content },
+      select: {
+        id: true,
+        content: true,
+        parentId: true,
+        createdAt: true,
+        updatedAt: true,
+        user: { select: USER_BRIEF_SELECT },
+      },
+    });
+    expect(M.storyActivity.create).toHaveBeenCalledWith({
+      data: { storyId: STORY_ID, userId: USER, action: "commented", newValue: "x".repeat(50) },
+    });
+    expect(res.content).toBe(content);
+    expect(res.createdAt).toBe(T1.toISOString());
+    expect(res.replies).toEqual([]);
+    expect(res.reactions).toEqual([]);
+  });
+
+  it("子评论带上 parentId 写入", async () => {
+    await createCommentFn({ data: { storyId: STORY_ID, content: "回复", parentId: "c1" } });
+    expect(M.storyComment.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ parentId: "c1" }) }),
+    );
+  });
+
+  it("空内容被 validator 拒绝（不落库）", async () => {
+    await expect(createCommentFn({ data: { storyId: STORY_ID, content: "" } })).rejects.toThrow();
+    expect(M.storyComment.create).not.toHaveBeenCalled();
+  });
+
+  it("未登录拒绝且不创建评论", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      createCommentFn({ data: { storyId: STORY_ID, content: "hi" } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(M.storyComment.create).not.toHaveBeenCalled();
+  });
+});
+
+describe("updateCommentFn", () => {
+  it("本人评论可编辑并返回新内容", async () => {
+    M.storyComment.findUnique.mockResolvedValue({ userId: USER });
+    M.storyComment.update.mockResolvedValue({ id: "c1", content: "新内容", updatedAt: T2 });
+
+    const res = await updateCommentFn({ data: { commentId: "c1", content: "新内容" } });
+
+    expect(M.storyComment.findUnique).toHaveBeenCalledWith({
+      where: { id: "c1" },
+      select: { userId: true },
+    });
+    expect(M.storyComment.update).toHaveBeenCalledWith({
+      where: { id: "c1" },
+      data: { content: "新内容" },
+      select: { id: true, content: true, updatedAt: true },
+    });
+    expect(res).toEqual({ id: "c1", content: "新内容", updatedAt: T2.toISOString() });
+  });
+
+  it("他人评论被拒且不执行更新", async () => {
+    M.storyComment.findUnique.mockResolvedValue({ userId: OTHER });
+    await expect(
+      updateCommentFn({ data: { commentId: "c1", content: "篡改" } }),
+    ).rejects.toThrow("无权编辑他人评论");
+    expect(M.storyComment.update).not.toHaveBeenCalled();
+  });
+
+  it("评论不存在时报错且不执行更新", async () => {
+    M.storyComment.findUnique.mockResolvedValue(null);
+    await expect(
+      updateCommentFn({ data: { commentId: "missing", content: "x" } }),
+    ).rejects.toThrow("评论不存在");
+    expect(M.storyComment.update).not.toHaveBeenCalled();
+  });
+});
+
+describe("deleteCommentFn", () => {
+  it("本人评论可删除", async () => {
+    M.storyComment.findUnique.mockResolvedValue({ userId: USER });
+    M.storyComment.delete.mockResolvedValue({ id: "c1" });
+
+    await expect(deleteCommentFn({ data: { commentId: "c1" } })).resolves.toEqual({ success: true });
+    expect(M.storyComment.delete).toHaveBeenCalledWith({ where: { id: "c1" } });
+  });
+
+  it("他人评论被拒且不删除", async () => {
+    M.storyComment.findUnique.mockResolvedValue({ userId: OTHER });
+    await expect(deleteCommentFn({ data: { commentId: "c1" } })).rejects.toThrow("无权删除他人评论");
+    expect(M.storyComment.delete).not.toHaveBeenCalled();
+  });
+
+  it("评论不存在时报错且不删除", async () => {
+    M.storyComment.findUnique.mockResolvedValue(null);
+    await expect(deleteCommentFn({ data: { commentId: "missing" } })).rejects.toThrow("评论不存在");
+    expect(M.storyComment.delete).not.toHaveBeenCalled();
+  });
+
+  it("未登录拒绝且不查询评论归属", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(deleteCommentFn({ data: { commentId: "c1" } })).rejects.toThrow("UNAUTHORIZED");
+    expect(M.storyComment.findUnique).not.toHaveBeenCalled();
+    expect(M.storyComment.delete).not.toHaveBeenCalled();
+  });
+});