@allbluecn/web-app 0.10.3 → 0.11.1

package/src/server/serverFns/__tests__/workspace-kb-utils.test.ts

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import { quickDocItemSchema, quickDocItemKey, generalDocHref } from "../workspace-kb-utils";
+
+describe("quickDocItemSchema 互斥校验", () => {
+  it("docId 单独存在合法", () => {
+    expect(quickDocItemSchema.parse({ docId: "d1", displayTitle: "标题" })).toMatchObject({ docId: "d1" });
+  });
+  it("externalGroup+externalId 合法", () => {
+    expect(
+      quickDocItemSchema.parse({ externalGroup: "legal", externalId: "x1", displayTitle: "标题" }),
+    ).toMatchObject({ externalGroup: "legal" });
+  });
+  it("docId 与 external 同时存在拒绝", () => {
+    expect(() =>
+      quickDocItemSchema.parse({ docId: "d1", externalGroup: "legal", externalId: "x1", displayTitle: "标题" }),
+    ).toThrow();
+  });
+  it("两者皆无拒绝", () => {
+    expect(() => quickDocItemSchema.parse({ displayTitle: "标题" })).toThrow();
+  });
+  it("空标题拒绝", () => {
+    expect(() => quickDocItemSchema.parse({ docId: "d1", displayTitle: "" })).toThrow();
+  });
+});
+
+describe("quickDocItemKey / generalDocHref", () => {
+  it("doc 态返回 docId", () => {
+    expect(quickDocItemKey({ docId: "d1", externalGroup: undefined, externalId: undefined })).toBe("d1");
+  });
+  it("ext 态返回 ext: 前缀 id", () => {
+    expect(quickDocItemKey({ docId: undefined, externalGroup: "legal", externalId: "x1" })).toBe("ext:legal:x1");
+  });
+  it("href 映射", () => {
+    expect(generalDocHref("legal", "9")).toBe("/knowledge/laws/9");
+    expect(generalDocHref("summary", "9")).toBe("/knowledge/summary");
+  });
+});

package/src/server/serverFns/__tests__/workspace-kb.test.ts

@@ -0,0 +1,348 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const mocks = vi.hoisted(() => ({
+  currentSession: vi.fn(),
+  wsFindUnique: vi.fn(),
+  wkbFindMany: vi.fn(),
+  wkbDeleteMany: vi.fn(),
+  wkbCreateMany: vi.fn(),
+  wqdFindMany: vi.fn(),
+  wqdFindUnique: vi.fn(),
+  wqdUpdate: vi.fn(),
+  wqdDelete: vi.fn(),
+  wqdAggregate: vi.fn(),
+  wqdCreate: vi.fn(),
+  wqdFindFirst: vi.fn(),
+  legalFindMany: vi.fn(),
+  kbFindMany: vi.fn(),
+  kbFindFirst: vi.fn(),
+  transaction: vi.fn(),
+  docFindMany: vi.fn(),
+  docFindFirst: vi.fn(),
+  articleFavoriteFindMany: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
+    workspace: { findUnique: mocks.wsFindUnique },
+    workspaceKnowledgeBase: { findMany: mocks.wkbFindMany, deleteMany: mocks.wkbDeleteMany, createMany: mocks.wkbCreateMany },
+    workspaceQuickDoc: {
+      findMany: mocks.wqdFindMany,
+      findUnique: mocks.wqdFindUnique,
+      update: mocks.wqdUpdate,
+      delete: mocks.wqdDelete,
+      aggregate: mocks.wqdAggregate,
+      create: mocks.wqdCreate,
+      findFirst: mocks.wqdFindFirst,
+    },
+    legalRegulation: { findMany: mocks.legalFindMany },
+    knowledgeBase: { findMany: mocks.kbFindMany, findFirst: mocks.kbFindFirst },
+    knowledgeDocument: { findMany: mocks.docFindMany, findFirst: mocks.docFindFirst },
+    articleFavorite: { findMany: mocks.articleFavoriteFindMany },
+    $transaction: mocks.transaction,
+  };
+  return { prisma, Prisma: {} };
+});
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.currentSession }));
+
+// 默认 transaction mock：调用回调并透传 tx 对象
+beforeEach(() => {
+  mocks.transaction.mockImplementation(async (fn: (tx: any) => any) =>
+    fn({ workspaceKnowledgeBase: { deleteMany: mocks.wkbDeleteMany, createMany: mocks.wkbCreateMany } }),
+  );
+});
+
+import {
+  getWorkspaceKbCardFn,
+  listWorkspaceAvailableKbsFn,
+  setWorkspaceKbsFn,
+  searchQuickDocCandidatesFn,
+  addQuickDocsFn,
+  renameQuickDocFn,
+  removeQuickDocFn,
+  reorderQuickDocsFn,
+} from "../workspace-kb";
+
+const MEMBER_WS = { ownerId: "u1", members: [] };
+const MEMBER_AS_MEMBER = { ownerId: "other", members: [{ id: "m1" }] };
+const NON_MEMBER = { ownerId: "other", members: [] };
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
+});
+
+describe("getWorkspaceKbCardFn", () => {
+  it("非成员拒绝", async () => {
+    mocks.wsFindUnique.mockResolvedValue(NON_MEMBER);
+    await expect(
+      getWorkspaceKbCardFn({ data: { workspaceId: "ws1" } }),
+    ).rejects.toThrow("成员");
+  });
+
+  it("返回 kbs + quickDocs（doc 态带 kb 信息、ext 态标题兜底）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wkbFindMany.mockResolvedValue([
+      { kb: { id: "kb1", name: "团队库", icon: "notebook", visibility: "team" } },
+    ]);
+    mocks.wqdFindMany.mockResolvedValue([
+      {
+        id: "q1", displayTitle: "接入指南", sortOrder: 0, docId: "d1",
+        externalGroup: null, externalId: null,
+        doc: { title: "接入指南", icon: "doc", isDeleted: false, kb: { id: "kb1", name: "团队库" } },
+      },
+      {
+        id: "q2", displayTitle: "数据安全法", sortOrder: 1, docId: null,
+        externalGroup: "legal", externalId: "x9",
+        doc: null,
+      },
+    ]);
+    mocks.legalFindMany.mockResolvedValue([{ id: "x9", title: "数据安全法（现行）" }]);
+    const res = await getWorkspaceKbCardFn({ data: { workspaceId: "ws1" } });
+    expect(res.kbs).toHaveLength(1);
+    expect(res.quickDocs[0]).toMatchObject({ source: "doc", kbId: "kb1", stale: false });
+    expect(res.quickDocs[1]).toMatchObject({
+      source: "general", group: "legal", externalId: "x9",
+      sourceTitle: "数据安全法（现行）", stale: false,
+    });
+  });
+
+  it("外部条目源已删除 → stale: true 且仍返回", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_AS_MEMBER);
+    mocks.wkbFindMany.mockResolvedValue([]);
+    mocks.wqdFindMany.mockResolvedValue([
+      { id: "q3", displayTitle: "旧法条", sortOrder: 0, docId: null, externalGroup: "legal", externalId: "gone", doc: null },
+    ]);
+    mocks.legalFindMany.mockResolvedValue([]); // 源查不到
+    const res = await getWorkspaceKbCardFn({ data: { workspaceId: "ws1" } });
+    expect(res.quickDocs[0]).toMatchObject({ stale: true, displayTitle: "旧法条" });
+  });
+});
+
+describe("listWorkspaceAvailableKbsFn", () => {
+  it("返回已关联 ∪ 用户 team 库，带 linked 标记", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wkbFindMany.mockResolvedValue([{ kbId: "kbLinked" }]);
+    mocks.kbFindMany.mockResolvedValue([
+      { id: "kbLinked", name: "他人的库", icon: "notebook", visibility: "team" },
+      { id: "kbMine", name: "我的库", icon: "notebook", visibility: "team" },
+    ]);
+    const res = await listWorkspaceAvailableKbsFn({ data: { workspaceId: "ws1" } });
+    expect(res.find((k: any) => k.id === "kbLinked")?.linked).toBe(true);
+    expect(res.find((k: any) => k.id === "kbMine")?.linked).toBe(false);
+  });
+});
+
+describe("setWorkspaceKbsFn", () => {
+  it("非 team 库拒绝且不写库", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }]); // 请求 2 个只查回 1 个
+    await expect(
+      setWorkspaceKbsFn({ data: { workspaceId: "ws1", kbIds: ["kb1", "kb2"] } }),
+    ).rejects.toThrow("团队可见");
+    expect(mocks.transaction).not.toHaveBeenCalled();
+  });
+
+  it("全量同步：删差集 + 增新增", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }, { id: "kb2" }]);
+    await setWorkspaceKbsFn({ data: { workspaceId: "ws1", kbIds: ["kb1", "kb2"] } });
+    expect(mocks.wkbDeleteMany).toHaveBeenCalledWith({
+      where: { workspaceId: "ws1", kbId: { notIn: ["kb1", "kb2"] } },
+    });
+    expect(mocks.wkbCreateMany).toHaveBeenCalledWith({
+      data: [
+        { workspaceId: "ws1", kbId: "kb1" },
+        { workspaceId: "ws1", kbId: "kb2" },
+      ],
+      skipDuplicates: true,
+    });
+  });
+});
+
+describe("searchQuickDocCandidatesFn", () => {
+  it("kbId 态返回该库文档树（须属用户 team 库）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.kbFindFirst.mockResolvedValue({ id: "kb1" });
+    mocks.docFindMany.mockResolvedValue([
+      { id: "d1", title: "接入指南", parentId: null, icon: "doc", kb: { id: "kb1", name: "团队库", icon: "notebook" } },
+    ]);
+    const res = await searchQuickDocCandidatesFn({
+      data: { workspaceId: "ws1", kbId: "kb1", query: "" },
+    });
+    expect(res.items[0]).toMatchObject({ id: "d1", kbId: "kb1", parentId: null });
+  });
+
+  it("generalGroup 态走通用表（含 ext 前缀 id）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.articleFavoriteFindMany.mockResolvedValue([]);
+    mocks.legalFindMany.mockResolvedValue([{ id: "x9", title: "数据安全法" }]);
+    const res = await searchQuickDocCandidatesFn({
+      data: { workspaceId: "ws1", generalGroup: "legal", query: "" },
+    });
+    expect(res.items[0]).toMatchObject({ id: "ext:legal:x9", title: "数据安全法" });
+  });
+});
+
+describe("addQuickDocsFn", () => {
+  it("互斥违规被 validator 拒绝", async () => {
+    await expect(
+      addQuickDocsFn({
+        data: {
+          workspaceId: "ws1",
+          items: [{ docId: "d1", externalGroup: "legal", externalId: "x1", displayTitle: "x" }],
+        },
+      }),
+    ).rejects.toThrow("二选一");
+  });
+
+  it("文档不存在 → failed outOfScope；存在 → 创建且落到最短列末尾", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    // 现有布局：col0 有 2 行（max sortOrder 1）、col1 有 1 行（max sortOrder 0）
+    mocks.wqdFindMany.mockResolvedValue([
+      { columnIndex: 0, sortOrder: 0 },
+      { columnIndex: 0, sortOrder: 1 },
+      { columnIndex: 1, sortOrder: 0 },
+    ]);
+    mocks.docFindFirst.mockResolvedValueOnce(null) // d1 不存在
+      .mockResolvedValueOnce({ id: "d2" }); // d2 存在
+    mocks.wqdFindFirst.mockResolvedValue(null); // 无重复
+    mocks.wqdCreate.mockImplementation(async (args: any) => ({ id: "new-" + args.data.docId }));
+    const res = await addQuickDocsFn({
+      data: {
+        workspaceId: "ws1",
+        items: [
+          { docId: "d1", displayTitle: "失效文档" },
+          { docId: "d2", displayTitle: "有效文档" },
+        ],
+      },
+    });
+    expect(res.failed).toEqual([{ key: "d1", reason: "outOfScope" }]);
+    expect(res.created).toEqual(["d2"]);
+    // col2/3/4 为空列（0 行）比 col1（1 行）更短，新文档落到第一个空列 col2 末尾
+    expect(mocks.wqdCreate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ docId: "d2", columnIndex: 2, sortOrder: 0 }),
+      }),
+    );
+  });
+
+  it("summary 组外部条目拒绝（无实体表）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    const res = await addQuickDocsFn({
+      data: { workspaceId: "ws1", items: [{ externalGroup: "summary", externalId: "s1", displayTitle: "周报" }] },
+    });
+    expect(res.failed).toEqual([{ key: "ext:summary:s1", reason: "outOfScope" }]);
+  });
+});
+
+describe("renameQuickDocFn", () => {
+  it("非本工作空间成员拒绝", async () => {
+    mocks.wqdFindUnique.mockResolvedValue({ workspaceId: "ws1" });
+    mocks.wsFindUnique.mockResolvedValue(NON_MEMBER);
+    await expect(
+      renameQuickDocFn({ data: { quickDocId: "q1", displayTitle: "新标题" } }),
+    ).rejects.toThrow("成员");
+    expect(mocks.wqdUpdate).not.toHaveBeenCalled();
+  });
+  it("成员重命名成功", async () => {
+    mocks.wqdFindUnique.mockResolvedValue({ workspaceId: "ws1" });
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    await renameQuickDocFn({ data: { quickDocId: "q1", displayTitle: "新标题" } });
+    expect(mocks.wqdUpdate).toHaveBeenCalledWith({
+      where: { id: "q1" },
+      data: { displayTitle: "新标题" },
+    });
+  });
+});
+
+describe("removeQuickDocFn", () => {
+  it("成员删除成功", async () => {
+    mocks.wqdFindUnique.mockResolvedValue({ workspaceId: "ws1" });
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_AS_MEMBER);
+    await removeQuickDocFn({ data: { quickDocId: "q1" } });
+    expect(mocks.wqdDelete).toHaveBeenCalledWith({ where: { id: "q1" } });
+  });
+});
+
+describe("reorderQuickDocsFn", () => {
+  it("包含非本工作空间 id 拒绝", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wqdFindMany.mockResolvedValue([{ id: "q1" }]); // 请求 2 个只属 1 个
+    await expect(
+      reorderQuickDocsFn({
+        data: {
+          workspaceId: "ws1",
+          items: [
+            { id: "q1", columnIndex: 0, sortOrder: 0 },
+            { id: "qX", columnIndex: 1, sortOrder: 0 },
+          ],
+        },
+      }),
+    ).rejects.toThrow("不属于");
+  });
+  it("按传入的列归属与顺序重写 columnIndex/sortOrder", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wqdFindMany.mockResolvedValue([{ id: "q1" }, { id: "q2" }]);
+    const updates: any[] = [];
+    mocks.wqdUpdate.mockImplementation(async (args: any) => { updates.push(args); return args; });
+    mocks.transaction.mockImplementation(async (ops: any[]) => Promise.all(ops.map((op) => op)));
+    await reorderQuickDocsFn({
+      data: {
+        workspaceId: "ws1",
+        items: [
+          { id: "q2", columnIndex: 1, sortOrder: 0 },
+          { id: "q1", columnIndex: 2, sortOrder: 3 },
+        ],
+      },
+    });
+    expect(mocks.wqdUpdate).toHaveBeenNthCalledWith(1, {
+      where: { id: "q2" },
+      data: { columnIndex: 1, sortOrder: 0 },
+    });
+    expect(mocks.wqdUpdate).toHaveBeenNthCalledWith(2, {
+      where: { id: "q1" },
+      data: { columnIndex: 2, sortOrder: 3 },
+    });
+  });
+});

package/src/server/serverFns/__tests__/workspace.test.ts

@@ -68,6 +68,7 @@ const mocks = vi.hoisted(() => ({
   knowledgeBaseDeleteMany: vi.fn(),
   knowledgeBaseUpdateMany: vi.fn(),
   knowledgeBaseCreate: vi.fn(),
+  wkbCreate: vi.fn(),
   usageRecordDeleteMany: vi.fn(),
   aiUsageLogDeleteMany: vi.fn(),
   ssoProviderDeleteMany: vi.fn(),
@@ -132,6 +133,9 @@ vi.mock("@allbluecn/database", () => ({
       deleteMany: mocks.knowledgeBaseDeleteMany,
       updateMany: mocks.knowledgeBaseUpdateMany,
     },
+    workspaceKnowledgeBase: {
+      create: mocks.wkbCreate,
+    },
     usageRecord: {
       deleteMany: mocks.usageRecordDeleteMany,
     },
@@ -161,6 +165,9 @@ vi.mock("@allbluecn/database", () => ({
           deleteMany: mocks.knowledgeBaseDeleteMany,
           updateMany: mocks.knowledgeBaseUpdateMany,
         },
+        workspaceKnowledgeBase: {
+          create: mocks.wkbCreate,
+        },
         usageRecord: {
           deleteMany: mocks.usageRecordDeleteMany,
         },
@@ -215,6 +222,7 @@ describe("createWorkspaceFn", () => {
   it("创建工作空间后 owner 即为所有者", async () => {
     const ws = { id: "ws1", name: "测试空间", icon: "folder", ownerId: "u1" };
     mocks.workspaceCreate.mockResolvedValue(ws);
+    mocks.knowledgeBaseCreate.mockResolvedValue({ id: "kb1" });
 
     const result = await createWorkspaceFn({
       data: { name: "测试空间", icon: "folder", description: "介绍" },
@@ -231,7 +239,7 @@ describe("createWorkspaceFn", () => {
 
     await expect(
       createWorkspaceFn({ data: { name: "测试" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("未认证") });
+    ).rejects.toThrow("未认证");
   });
 
   it("名称为空时 zod validator 拦截", async () => {
@@ -239,6 +247,18 @@ describe("createWorkspaceFn", () => {
       createWorkspaceFn({ data: { name: "", icon: "folder" } }),
     ).rejects.toThrow();
   });
+
+  it("创建工作空间时事务内自动关联同步创建的知识库", async () => {
+    mocks.knowledgeBaseCreate.mockResolvedValue({ id: "kb1" });
+    const ws = { id: "ws1", name: "测试空间", icon: "folder", ownerId: "u1" };
+    mocks.workspaceCreate.mockResolvedValue(ws);
+    mocks.wkbCreate.mockResolvedValue({ id: "wkb1" });
+
+    await createWorkspaceFn({ data: { name: "测试空间" } });
+    expect(mocks.wkbCreate).toHaveBeenCalledWith({
+      data: { workspaceId: "ws1", kbId: "kb1" },
+    });
+  });
 });
 
 describe("listWorkspacesFn", () => {
@@ -312,7 +332,7 @@ describe("getWorkspaceDetailFn", () => {
 
     await expect(
       getWorkspaceDetailFn({ data: { workspaceId: "ws1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("工作空间不存在") });
+    ).rejects.toThrow("工作空间不存在");
     expect(mocks.workspaceFindUnique).toHaveBeenCalledTimes(1);
   });
 
@@ -321,7 +341,7 @@ describe("getWorkspaceDetailFn", () => {
 
     await expect(
       getWorkspaceDetailFn({ data: { workspaceId: "ws1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅工作空间所有者可访问") });
+    ).rejects.toThrow("仅工作空间所有者可访问");
   });
 });
 
@@ -350,7 +370,7 @@ describe("listWorkspaceProjectsFn", () => {
 
     await expect(
       listWorkspaceProjectsFn({ data: { workspaceId: "ws1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅工作空间所有者可访问") });
+    ).rejects.toThrow("仅工作空间所有者可访问");
   });
 });
 
@@ -443,7 +463,7 @@ describe("deleteWorkspaceFn", () => {
 
     await expect(
       deleteWorkspaceFn({ data: { workspaceId: "ws1", mode: "transfer" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("转移模式必须指定目标工作空间") });
+    ).rejects.toThrow("转移模式必须指定目标工作空间");
     expect(mocks.workspaceDelete).not.toHaveBeenCalled();
   });
 
@@ -455,7 +475,7 @@ describe("deleteWorkspaceFn", () => {
       deleteWorkspaceFn({
         data: { workspaceId: "ws1", mode: "transfer", targetWorkspaceId: "ws1" },
       }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("不可转移到自身") });
+    ).rejects.toThrow("不可转移到自身");
     expect(mocks.workspaceDelete).not.toHaveBeenCalled();
   });
 
@@ -482,7 +502,7 @@ describe("deleteWorkspaceFn", () => {
 
     await expect(
       deleteWorkspaceFn({ data: { workspaceId: "ws1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅工作空间所有者可访问") });
+    ).rejects.toThrow("仅工作空间所有者可访问");
   });
 });
 
@@ -514,6 +534,6 @@ describe("updateWorkspaceFn", () => {
       updateWorkspaceFn({
         data: { workspaceId: "ws1", name: "新名称" },
       }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("仅工作空间所有者可访问") });
+    ).rejects.toThrow("仅工作空间所有者可访问");
   });
 });

package/src/server/serverFns/auth/email-verification.ts

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { getCurrentSession } from '@/lib/session'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
+
+const VERIFY_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+
+const appUrl = () => process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+export const confirmEmailVerificationFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }) => {
+    const row = await prisma.emailVerificationToken.findUnique({
+      where: { token: data.token },
+    })
+    if (!row || row.usedAt || new Date() > row.expiresAt) {
+      return { ok: false as const }
+    }
+
+    const claimed = await prisma.$transaction(async (tx) => {
+      const claim = await tx.emailVerificationToken.updateMany({
+        where: { id: row.id, usedAt: null },
+        data: { usedAt: new Date() },
+      })
+      if (claim.count === 0) return false
+      await tx.user.update({
+        where: { id: row.userId },
+        data: { emailVerified: new Date() },
+      })
+      return true
+    })
+    if (!claimed) return { ok: false as const }
+
+    const user = await prisma.user.findUnique({
+      where: { id: row.userId },
+      select: { email: true, locale: true },
+    })
+    if (user) {
+      await sendTemplateEmail({
+        key: 'auth.welcome',
+        to: user.email,
+        locale: user.locale ?? 'zh',
+        userId: row.userId,
+        vars: { dashboardUrl: `${appUrl()}/dashboard` },
+      }).catch((err) => {
+        console.error('welcome email failed', {
+          userId: row.userId,
+          templateKey: 'auth.welcome',
+          reason: err instanceof Error ? err.message : String(err),
+        })
+      })
+    }
+
+    return { ok: true as const }
+  })
+
+export const resendVerificationEmailFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
+  .handler(async () => {
+    const request = getRequest()
+    const session = await getCurrentSession(request)
+    const userId = session?.user?.id
+    if (!userId) throw new Error('请先登录')
+
+    await checkAuthRateLimit('resendVerify', 5, 15 * 60 * 1000)
+
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { email: true, username: true, emailVerified: true, locale: true },
+    })
+    if (!user) throw new Error('用户不存在')
+    if (user.emailVerified) return { alreadyVerified: true }
+
+    const token = generateEmailToken()
+    await prisma.emailVerificationToken.create({
+      data: {
+        token,
+        userId,
+        expiresAt: new Date(Date.now() + VERIFY_TOKEN_TTL_MS),
+      },
+    })
+
+    await sendTemplateEmail({
+      key: 'auth.verify-email',
+      to: user.email,
+      locale: user.locale ?? 'zh',
+      userId,
+      vars: { url: `${appUrl()}/verify-email?token=${token}`, username: user.username },
+    }).catch((err) => {
+      console.error('resend verification email failed', {
+        userId,
+        templateKey: 'auth.verify-email',
+        reason: err instanceof Error ? err.message : String(err),
+      })
+    })
+
+    return { alreadyVerified: false }
+  })
+
+export const getEmailVerifiedStatusFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async () => {
+    const request = getRequest()
+    const session = await getCurrentSession(request)
+    if (!session?.user?.id) return { verified: null as boolean | null }
+
+    const user = await prisma.user.findUnique({
+      where: { id: session.user.id },
+      select: { emailVerified: true },
+    })
+    return { verified: !!user?.emailVerified }
+  })