@allbluecn/web-app 0.10.3 → 0.11.1

package/src/server/serverFns/auth/forgot-password.ts

@@ -20,9 +20,10 @@ import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { randomBytes } from 'crypto'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail } from '@/server/email'
 
 const forgotPasswordSchema = z.object({
-  email: z.string().email('请输入有效邮箱'),
+  email: z.string().transform((v) => v.toLowerCase().trim()).pipe(z.string().email('请输入有效邮箱')),
 })
 
 function generateToken(): string {
@@ -35,20 +36,39 @@ export const forgotPasswordFn = createServerFn({ method: 'POST' })
     await checkAuthRateLimit('forgotPassword', 5, 15 * 60 * 1000)
     const user = await prisma.user.findUnique({
       where: { email: data.email },
-      select: { id: true },
+      select: { id: true, email: true, locale: true },
     })
 
     if (user) {
       const token = generateToken()
       const expiresAt = new Date(Date.now() + 15 * 60 * 1000)
 
+      let created = false
       try {
         await prisma.passwordResetToken.create({
           data: { token, userId: user.id, expiresAt },
         })
+        created = true
       } catch (dbError) {
         console.error('Database error:', dbError instanceof Error ? dbError.message : String(dbError))
       }
+
+      if (created) {
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+        await sendTemplateEmail({
+          key: 'auth.reset-password',
+          to: user.email,
+          locale: user.locale ?? 'zh',
+          userId: user.id,
+          vars: { url: `${appUrl}/reset-password?token=${token}` },
+        }).catch((err) => {
+          console.error('reset password email failed', {
+            userId: user.id,
+            templateKey: 'auth.reset-password',
+            reason: err instanceof Error ? err.message : String(err),
+          })
+        })
+      }
     }
 
     return {

package/src/server/serverFns/auth/providers.ts

@@ -16,12 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { getResolvedOAuthProviders } from '@/server/oauth-config'
 
 export interface AuthProvidersInfo {
   googleEnabled: boolean
 }
 
 export const getAuthProviders = createServerFn({ method: 'GET' }).handler(async (): Promise<AuthProvidersInfo> => {
-  const googleEnabled = !!(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET)
-  return { googleEnabled }
-})
+  const providers = await getResolvedOAuthProviders()
+  return { googleEnabled: providers.some((p) => p.provider === 'google') }
+})

package/src/server/serverFns/auth/register.ts

@@ -17,22 +17,26 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { prisma, Prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { getRegistrationMode, consumeInvitationCode } from '@/server/auth-registration'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
 
-const registerSchema = z.object({
-  username: z.string().min(3).max(20),
-  email: z.string().email(),
-  password: z.string().min(8),
-  invitationCode: z.string().optional(),
+const registerServerSchema = z.object({
+  username: z.string().regex(/^[a-zA-Z0-9_-]{3,20}$/),
+  email: z.string().transform((v) => v.toLowerCase().trim()).pipe(z.string().email()),
+  password: z.string().min(8).max(32).regex(/[a-zA-Z]/).regex(/[0-9]/),
+  invitationCode: z.string().optional().default(''),
 })
 
 export const registerFn = createServerFn({ method: 'POST' })
-  .validator(registerSchema)
+  .validator(registerServerSchema)
   .handler(async ({ data }) => {
     await checkAuthRateLimit('register', 5, 15 * 60 * 1000)
+    const mode = await getRegistrationMode()
+
     const exists = await prisma.user.findFirst({
       where: { OR: [{ email: data.email }, { username: data.username }] },
       select: { id: true },
@@ -43,16 +47,56 @@ export const registerFn = createServerFn({ method: 'POST' })
     const hash = data.username.split('').reduce((h, c) => c.charCodeAt(0) + ((h << 5) - h), 0)
     const bgColor = presetBgColors[Math.abs(hash) % presetBgColors.length]
 
-    const user = await prisma.user.create({
-      data: {
-        username: data.username,
-        email: data.email,
-        password: hashedPassword,
-        avatarConfig: getRandomConfig() as object,
-        bgShape: 'square',
-        bgColor,
-        status: 'ACTIVE',
-      },
-    })
-    return { id: user.id, email: user.email, username: user.username }
+    try {
+      const user = await prisma.$transaction(async (tx) => {
+        let codeId: string | null = null
+        if (mode === 'invite') {
+          if (!data.invitationCode) throw new Error('请输入邀请码')
+          const consumed = await consumeInvitationCode(tx, data.invitationCode)
+          if (!consumed.ok) throw new Error(consumed.error)
+          codeId = consumed.codeId
+        }
+        const created = await tx.user.create({
+          data: {
+            username: data.username,
+            email: data.email,
+            password: hashedPassword,
+            avatarConfig: getRandomConfig() as object,
+            bgShape: 'square',
+            bgColor,
+            status: 'ACTIVE',
+          },
+        })
+        if (codeId) {
+          await tx.invitationUse.create({ data: { codeId, userId: created.id } })
+        }
+        return created
+      })
+
+      const token = generateEmailToken()
+      await prisma.emailVerificationToken.create({
+        data: { token, userId: user.id, expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) },
+      })
+      const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+      await sendTemplateEmail({
+        key: 'auth.verify-email',
+        to: user.email,
+        locale: 'zh',
+        userId: user.id,
+        vars: { url: `${appUrl}/verify-email?token=${token}`, username: user.username },
+      }).catch((err) => {
+        console.error('verification email failed', {
+          userId: user.id,
+          templateKey: 'auth.verify-email',
+          reason: err instanceof Error ? err.message : String(err),
+        })
+      })
+
+      return { id: user.id, email: user.email, username: user.username }
+    } catch (err) {
+      if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2002') {
+        throw new Error('用户名或邮箱已存在')
+      }
+      throw new Error(err instanceof Error ? err.message : '注册失败')
+    }
   })

package/src/server/serverFns/auth/registration-mode.ts

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRegistrationMode } from '@/server/auth-registration'
+
+export const getRegistrationModeFn = createServerFn({ method: 'GET' }).handler(
+  async () => ({ mode: await getRegistrationMode() }),
+)

package/src/server/serverFns/auth/reset-password.ts

@@ -23,7 +23,7 @@ import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const resetPasswordSchema = z.object({
   token: z.string().min(1, 'Token is required'),
-  password: z.string().min(8, '密码至少 8 位').max(32),
+  password: z.string().min(8, '密码至少 8 位').max(32).regex(/[a-zA-Z]/, '密码需包含字母').regex(/[0-9]/, '密码需包含数字'),
 })
 
 export const validateResetTokenFn = createServerFn({ method: 'GET' })

package/src/server/serverFns/auth/{invitation.ts → verify-reminder.ts}

@@ -16,34 +16,17 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
-import { requireAdmin } from '@/server/auth-helpers'
+import { getCurrentSession } from '@/lib/session'
+import { ensureVerifyReminder } from '@/server/notifications/verify-reminder'
 
-const DEFAULT_CODE = '123123'
-
-export const createDefaultInvitationFn = createServerFn({ method: 'POST' })
+export const ensureVerifyReminderFn = createServerFn({ method: 'POST' })
   .validator(z.object({}))
   .handler(async () => {
-    const hasPermission = true
-
-    const existing = await prisma.invitationCode.findUnique({
-      where: { code: DEFAULT_CODE },
-    })
-    if (existing) {
-      return { message: 'Invitation code already exists', code: existing }
-    }
-
-    const expiresAt = new Date()
-    expiresAt.setDate(expiresAt.getDate() + 1)
-
-    const invCode = await prisma.invitationCode.create({
-      data: {
-        code: DEFAULT_CODE,
-        maxUses: 1,
-        expiresAt,
-      },
-    })
-
-    return { message: 'Default invitation code created', code: invCode }
+    const session = await getCurrentSession(getRequest())
+    const userId = session?.user?.id
+    if (!userId) return { reminded: false }
+    await ensureVerifyReminder(userId)
+    return { reminded: true }
   })

package/src/server/serverFns/changelog/__tests__/subscribe.test.ts

@@ -0,0 +1,119 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const sendTemplateEmailMock = vi.hoisted(() => vi.fn().mockResolvedValue({ sent: true }))
+
+const emailSubscriberMock = vi.hoisted(() => ({
+  findUnique: vi.fn(),
+  upsert: vi.fn(),
+  updateMany: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: { emailSubscriber: emailSubscriberMock },
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: (...args: unknown[]) => sendTemplateEmailMock(...args),
+  generateEmailToken: () => 'tok-' + 'x'.repeat(64),
+}))
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    let validator: { safeParse: (d: unknown) => { success: boolean; data?: unknown } } | undefined
+    let handler: ((args: { data: unknown }) => Promise<unknown>) | undefined
+    const chain = {
+      validator(v: unknown) {
+        validator = v as { safeParse: (d: unknown) => { success: boolean; data?: unknown } }
+        return chain
+      },
+      handler(h: unknown) {
+        handler = h as (args: { data: unknown }) => Promise<unknown>
+        return async (args: { data: unknown }) => {
+          if (validator) {
+            const parsed = validator.safeParse(args.data)
+            if (!parsed.success) throw new Error('zod validation failed')
+            args = { data: parsed.data }
+          }
+          return handler!(args)
+        }
+      },
+    }
+    return chain
+  },
+}))
+
+import { subscribeChangelogFn, confirmChangelogSubscriptionFn } from '../subscribe'
+
+const invoke = async (fn: unknown, data: unknown) =>
+  (fn as (args: { data: unknown }) => Promise<unknown>)({ data })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('subscribeChangelogFn', () => {
+  it('已 confirmed 且未退订 → already，不发邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: new Date(), unsubscribedAt: null,
+    })
+    const r = await invoke(subscribeChangelogFn, { email: 'A@B.com' })
+    expect(r).toEqual({ status: 'already' })
+    expect(emailSubscriberMock.upsert).not.toHaveBeenCalled()
+    expect(sendTemplateEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('未 confirmed → upsert 新 token 并发确认邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: null, unsubscribedAt: null,
+    })
+    emailSubscriberMock.upsert.mockResolvedValue({})
+    const r = await invoke(subscribeChangelogFn, { email: 'a@b.com', locale: 'en' })
+    expect(r).toEqual({ status: 'pending' })
+    const upsert = emailSubscriberMock.upsert.mock.calls[0][0]
+    expect(upsert.where).toEqual({ email: 'a@b.com' })
+    expect(upsert.update.confirmToken).toBe('tok-' + 'x'.repeat(64))
+    expect(upsert.update.locale).toBe('en')
+    expect(upsert.update.createdAt).toBeInstanceOf(Date)
+    const email = sendTemplateEmailMock.mock.calls[0][0]
+    expect(email.key).toBe('product.changelog-confirm')
+    expect(email.to).toBe('a@b.com')
+    expect(email.locale).toBe('en')
+    expect(String(email.vars.confirmUrl)).toContain('/changelog/confirm?token=tok-')
+  })
+
+  it('已退订 → 重新发确认邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: new Date(), unsubscribedAt: new Date(),
+    })
+    emailSubscriberMock.upsert.mockResolvedValue({})
+    const r = await invoke(subscribeChangelogFn, { email: 'a@b.com' })
+    expect(r).toEqual({ status: 'pending' })
+    expect(sendTemplateEmailMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('email 为空 → zod 拒绝', async () => {
+    await expect(invoke(subscribeChangelogFn, { email: 'nope' })).rejects.toThrow()
+  })
+})
+
+describe('confirmChangelogSubscriptionFn', () => {
+  it('updateMany 命中 1 行 → ok', async () => {
+    emailSubscriberMock.updateMany.mockResolvedValue({ count: 1 })
+    const r = await invoke(confirmChangelogSubscriptionFn, { token: 't' })
+    expect(r).toEqual({ ok: true })
+    const where = emailSubscriberMock.updateMany.mock.calls[0][0].where
+    expect(where.confirmToken).toBe('t')
+    expect(where.confirmedAt).toBeNull()
+    expect(where.createdAt.gte).toBeInstanceOf(Date)
+  })
+
+  it('token 无效或已确认或过期 → count 0 → not ok（防并发双写）', async () => {
+    emailSubscriberMock.updateMany.mockResolvedValue({ count: 0 })
+    const r = await invoke(confirmChangelogSubscriptionFn, { token: 'bad' })
+    expect(r).toEqual({ ok: false })
+  })
+})

package/src/server/serverFns/changelog/subscribe.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
+
+const CONFIRM_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+const CONFIRM_TEMPLATE_KEY = 'product.changelog-confirm'
+
+const appUrl = () => process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+const normalizeLocale = (locale: string | undefined) => (locale === 'en' ? 'en' : 'zh')
+
+export interface ChangelogSubscribeResult {
+  status: 'already' | 'pending'
+}
+
+export const subscribeChangelogFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      email: z.string().email().transform((v) => v.toLowerCase()),
+      locale: z.string().optional(),
+    }),
+  )
+  .handler(async ({ data }): Promise<ChangelogSubscribeResult> => {
+    await checkAuthRateLimit('changelogSubscribe', 5, 15 * 60 * 1000)
+
+    const email = data.email
+    const existing = await prisma.emailSubscriber.findUnique({ where: { email } })
+    if (existing?.confirmedAt && !existing.unsubscribedAt) {
+      return { status: 'already' }
+    }
+
+    const confirmToken = generateEmailToken()
+    const locale = normalizeLocale(data.locale)
+    const now = new Date()
+    await prisma.emailSubscriber.upsert({
+      where: { email },
+      create: { email, locale, confirmToken },
+      // 重订阅时清零 unsubscribedAt，让已退订用户重新订阅后回到「已确认」状态（confirmedAt 保留）。
+      update: { confirmToken, locale, createdAt: now, unsubscribedAt: null },
+    })
+
+    await sendTemplateEmail({
+      key: CONFIRM_TEMPLATE_KEY,
+      to: email,
+      locale,
+      vars: { confirmUrl: `${appUrl()}/changelog/confirm?token=${confirmToken}` },
+    }).catch((err) => {
+      console.error('changelog confirm email failed', {
+        templateKey: CONFIRM_TEMPLATE_KEY,
+        reason: err instanceof Error ? err.message : String(err),
+      })
+    })
+
+    return { status: 'pending' }
+  })
+
+export interface ChangelogConfirmResult {
+  ok: boolean
+}
+
+export const confirmChangelogSubscriptionFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }): Promise<ChangelogConfirmResult> => {
+    const floor = new Date(Date.now() - CONFIRM_TOKEN_TTL_MS)
+    const claimed = await prisma.emailSubscriber.updateMany({
+      where: { confirmToken: data.token, confirmedAt: null, createdAt: { gte: floor } },
+      data: { confirmedAt: new Date() },
+    })
+    return { ok: claimed.count === 1 }
+  })

package/src/server/serverFns/email-unsubscribe.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { verifyUnsubscribeToken } from '@/server/email/deliverability'
+
+export interface UnsubscribeByEmailTokenResult {
+  ok: boolean
+  mechanism?: 'user' | 'subscriber'
+}
+
+export const unsubscribeByEmailTokenFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }): Promise<UnsubscribeByEmailTokenResult> => {
+    // 防 token 爆破扫描：单 IP 15 分钟内最多 20 次
+    await checkAuthRateLimit('unsubscribe', 20, 15 * 60 * 1000)
+
+    // 机制 1：注册用户 HMAC 无状态 token（对 userId+email+category 签名，10 年有效）
+    // 命中即 upsert EmailPreference，一键全退（本页不做分类精确退订）
+    const payload = verifyUnsubscribeToken(data.token)
+    if (payload) {
+      await prisma.emailPreference.upsert({
+        where: { userId: payload.userId },
+        create: { userId: payload.userId, unsubscribedAll: true },
+        update: { unsubscribedAll: true },
+      })
+      return { ok: true, mechanism: 'user' }
+    }
+
+    // 机制 2：订阅者 DB token（changelog 确认/退订共用 confirmToken）
+    // 幂等保护：仅未退订记录可退订；重复点击已退订链接返回 ok 而非 fail（避免骚扰）
+    const now = new Date()
+    const claimed = await prisma.emailSubscriber.updateMany({
+      where: { confirmToken: data.token, unsubscribedAt: null },
+      data: { unsubscribedAt: now },
+    })
+    if (claimed.count > 0) return { ok: true, mechanism: 'subscriber' }
+
+    // 重复退订幂等返回：token 命中但已退订 → 也返回 ok（用户可能重复点击链接）
+    const alreadyUnsubscribed = await prisma.emailSubscriber.findUnique({
+      where: { confirmToken: data.token },
+      select: { unsubscribedAt: true },
+    })
+    if (alreadyUnsubscribed?.unsubscribedAt) {
+      return { ok: true, mechanism: 'subscriber' }
+    }
+
+    return { ok: false }
+  })

package/src/server/serverFns/iteration/__tests__/iteration-crud.test.ts

@@ -95,7 +95,7 @@ describe("createIterationsFn", () => {
     ]);
     await expect(
       createIterationsFn({ data: { projectId: "p1", name: "S2", startDate: "2026-09-10", endDate: "2026-09-23" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("重叠") });
+    ).rejects.toThrow("重叠");
   });
 
   it("合法日期调用 create 且日期按 UTC 0 点入库", async () => {
@@ -130,9 +130,7 @@ describe("updateIterationsFn", () => {
       archived: false,
       projectId: "p1",
     });
-    await expect(updateIterationsFn({ data: { id: "i1", name: "改名" } })).rejects.toMatchObject({
-      message: expect.stringContaining("不可编辑"),
-    });
+    await expect(updateIterationsFn({ data: { id: "i1", name: "改名" } })).rejects.toThrow("不可编辑");
   });
 
   it("改期时校验与其他迭代不重叠", async () => {
@@ -148,7 +146,7 @@ describe("updateIterationsFn", () => {
     ]);
     await expect(
       updateIterationsFn({ data: { id: "i1", startDate: "2026-09-18", endDate: "2026-09-25" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("重叠") });
+    ).rejects.toThrow("重叠");
   });
 });
 

package/src/server/serverFns/iteration/__tests__/iteration-stories.test.ts

@@ -83,7 +83,7 @@ describe("setStoryIterationFn", () => {
     });
     await expect(
       setStoryIterationFn({ data: { storyId: "s1", iterationId: "i1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("已完成") });
+    ).rejects.toThrow("已完成");
   });
 
   it("合法目标更新 story 并记录活动", async () => {

package/src/server/serverFns/iteration/__tests__/iteration-transfer.test.ts

@@ -85,7 +85,7 @@ describe("transferUnfinishedFn", () => {
     });
     await expect(
       transferUnfinishedFn({ data: { iterationId: "src1", targetIterationId: "tgt1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("已完成") });
+    ).rejects.toThrow("已完成");
   });
 
   it("where 断言 state notIn 且 iterationId = 源迭代", async () => {
@@ -118,7 +118,7 @@ describe("transferUnfinishedFn", () => {
     });
     await expect(
       transferUnfinishedFn({ data: { iterationId: "src1", targetIterationId: "tgt1" } }),
-    ).rejects.toMatchObject({ message: expect.stringContaining("迭代不存在") });
+    ).rejects.toThrow("迭代不存在");
   });
 
   it("二次调用（无未完成）返回 { count: 0 }，不抛错", async () => {