@allbluecn/web-app 0.10.3 → 0.11.1

package/src/components/workspace/{workspace-members-manager.tsx → members/workspace-members-manager.tsx}

@@ -84,7 +84,7 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
   const [teamUsers, setTeamUsers] = useState<TeamUser[]>([]);
   const [teamUsersLoading, setTeamUsersLoading] = useState(false);
   const [searchQuery, setSearchQuery] = useState("");
-  const [selectedUserId, setSelectedUserId] = useState("");
+  const [selectedUserIds, setSelectedUserIds] = useState<string[]>([]);
   const [memberRole, setMemberRole] = useState<"admin" | "member" | "viewer">("member");
   const [addingMember, setAddingMember] = useState(false);
   const [removeDialogOpen, setRemoveDialogOpen] = useState(false);
@@ -107,29 +107,54 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
       u.email?.toLowerCase().includes(searchQuery.toLowerCase())
   );
 
+  const toggleUser = (userId: string) => {
+    setSelectedUserIds((prev) =>
+      prev.includes(userId) ? prev.filter((id) => id !== userId) : [...prev, userId]
+    );
+  };
+
   const openAddMember = () => {
-    setSelectedUserId("");
+    setSelectedUserIds([]);
     setSearchQuery("");
     setMemberRole("member");
     setMemberDialogOpen(true);
   };
 
   const handleAddMember = async () => {
-    if (!selectedUserId) {
+    if (selectedUserIds.length === 0) {
       toast.error(m.project_invite_selectMember());
       return;
     }
     setAddingMember(true);
+    const failed: string[] = [];
+    let lastError: string | null = null;
     try {
-      await addWorkspaceMemberFn({
-        data: { workspaceId, userId: selectedUserId, role: memberRole },
-      });
-      toast.success(m.workspace_home_memberRemoved());
-      setMemberDialogOpen(false);
-      setSelectedUserId("");
-      onMembersUpdated();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : m.workspace_home_addMemberFailed());
+      for (const userId of selectedUserIds) {
+        try {
+          await addWorkspaceMemberFn({
+            data: { workspaceId, userId, role: memberRole },
+          });
+        } catch (err) {
+          failed.push(userId);
+          lastError = err instanceof Error ? err.message : null;
+        }
+      }
+      if (failed.length === 0) {
+        toast.success(m.workspace_home_memberAdded());
+        setMemberDialogOpen(false);
+        setSelectedUserIds([]);
+        onMembersUpdated();
+      } else {
+        const failedNames = teamUsers
+          .filter((u) => failed.includes(u.id))
+          .map((u) => u.username)
+          .join(", ");
+        toast.error(
+          `${m.workspace_home_addMemberFailed()}: ${failedNames}${lastError ? ` (${lastError})` : ""}`
+        );
+        setSelectedUserIds(failed);
+        if (failed.length < selectedUserIds.length) onMembersUpdated();
+      }
     } finally {
       setAddingMember(false);
     }
@@ -222,32 +247,45 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
                   {m.workspace_home_noMembers()}
                 </div>
               ) : (
-                filteredTeamUsers.map((user) => (
-                  <label
-                    key={user.id}
-                    className={`flex items-center gap-3 px-3 py-2.5 cursor-pointer transition-colors ${
-                      selectedUserId === user.id ? "bg-primary/10" : "hover:bg-accent"
-                    }`}
-                  >
-                    <input
-                      type="radio"
-                      name="workspace-member"
-                      value={user.id}
-                      checked={selectedUserId === user.id}
-                      onChange={() => setSelectedUserId(user.id)}
-                      className="accent-primary"
-                    />
-                    <UserAvatar
-                      name={user.username}
-                      avatarConfig={user.avatarConfig as AvatarConfig | undefined}
-                      bgShape={user.bgShape as ShapeType | undefined}
-                      bgColor={user.bgColor ?? undefined}
-                      size="sm"
-                    />
-                    <span className="text-sm font-medium">{user.username}</span>
-                    <span className="text-xs text-muted-foreground ml-auto">{user.email}</span>
-                  </label>
-                ))
+                filteredTeamUsers.map((user) => {
+                  const isOwner = user.seatType === "owner";
+                  const isSelected = selectedUserIds.includes(user.id);
+                  return (
+                    <label
+                      key={user.id}
+                      className={`flex items-center gap-3 px-3 py-2.5 transition-colors ${
+                        isOwner
+                          ? "cursor-not-allowed opacity-60"
+                          : isSelected
+                            ? "cursor-pointer bg-primary/10"
+                            : "cursor-pointer hover:bg-accent"
+                      }`}
+                    >
+                      <input
+                        type="checkbox"
+                        value={user.id}
+                        checked={isSelected}
+                        disabled={isOwner}
+                        onChange={() => toggleUser(user.id)}
+                        className="accent-primary"
+                      />
+                      <UserAvatar
+                        name={user.username}
+                        avatarConfig={user.avatarConfig as AvatarConfig | undefined}
+                        bgShape={user.bgShape as ShapeType | undefined}
+                        bgColor={user.bgColor ?? undefined}
+                        size="sm"
+                      />
+                      <span className="text-sm font-medium">{user.username}</span>
+                      {isOwner && (
+                        <span className="text-xs text-muted-foreground">
+                          ({m.workspace_home_role_owner()})
+                        </span>
+                      )}
+                      <span className="text-xs text-muted-foreground ml-auto">{user.email}</span>
+                    </label>
+                  );
+                })
               )}
             </div>
             <div className="grid gap-2">
@@ -268,9 +306,9 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
             <Button variant="outline" onClick={() => setMemberDialogOpen(false)}>
               {m.common_button_cancel()}
             </Button>
-            <Button onClick={handleAddMember} disabled={addingMember || !selectedUserId}>
+            <Button onClick={handleAddMember} disabled={addingMember || selectedUserIds.length === 0}>
               {addingMember ? <Loader2 className="size-4 animate-spin" /> : <Check className="size-4 mr-1.5" />}
-              {m.projects_project_invite_sendInvite()}
+              {m.workspace_home_addMember()}
             </Button>
           </DialogFooter>
         </DialogContent>

package/src/lib/__tests__/edition-desktop.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it, afterEach, vi } from 'vitest'
+import { isDesktopEdition } from '../edition-desktop'
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('isDesktopEdition', () => {
+  it('VITE_DEPLOY_TARGET=desktop → true', () => {
+    vi.stubEnv('VITE_DEPLOY_TARGET', 'desktop')
+    expect(isDesktopEdition()).toBe(true)
+  })
+
+  it('VITE_DEPLOY_TARGET=web → false', () => {
+    vi.stubEnv('VITE_DEPLOY_TARGET', 'web')
+    expect(isDesktopEdition()).toBe(false)
+  })
+
+  it('未注入构建常量 → false（Web 部署默认）', () => {
+    vi.stubEnv('VITE_DEPLOY_TARGET', '')
+    expect(isDesktopEdition()).toBe(false)
+  })
+})

package/src/lib/__tests__/msw-sample.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it, afterEach } from "vitest"
+import { setupServer } from "msw/node"
+import { http, HttpResponse } from "msw"
+import { fetchJson } from "../fetch-json"
+
+// msw 样板：拦截 fetch 层，让接口测试与真实网络解耦。
+// 后续 serverFn 客户端 / SDK fetch 测试统一复用此模式。
+const server = setupServer(
+  http.get("https://api.example.com/models", () =>
+    HttpResponse.json([{ id: "gpt-x", displayName: "GPT X" }])
+  ),
+  http.post("https://api.example.com/echo", async ({ request }) =>
+    HttpResponse.json({ received: await request.json() })
+  ),
+  http.get("https://api.example.com/fail", () =>
+    HttpResponse.json({ error: "boom" }, { status: 500 })
+  )
+)
+
+describe("msw 接口 mock 样板", () => {
+  afterEach(() => {
+    server.resetHandlers()
+    server.close()
+  })
+
+  it("GET 拦截返回桩数据", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    const data = await fetchJson<{ id: string }[]>("https://api.example.com/models")
+    expect(data[0]!.id).toBe("gpt-x")
+  })
+
+  it("POST 请求体透传", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    const data = await fetchJson<{ received: { a: number } }>("https://api.example.com/echo", {
+      method: "POST",
+      body: JSON.stringify({ a: 1 }),
+    })
+    expect(data.received.a).toBe(1)
+  })
+
+  it("未拦截的请求直接报错（防测试悄悄打真网）", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    await expect(fetchJson("https://unhandled.example.com/x")).rejects.toThrow()
+  })
+
+  it("非 2xx 响应抛错，消息含状态码", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    await expect(fetchJson("https://api.example.com/fail")).rejects.toThrow(/HTTP 500/)
+  })
+
+  it("调用方传入的 AbortSignal 不被默认超时覆盖", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    const controller = new AbortController()
+    const data = await fetchJson<{ id: string }[]>("https://api.example.com/models", {
+      signal: controller.signal,
+    })
+    expect(data[0]!.id).toBe("gpt-x")
+  })
+
+  it("传入已 abort 的 signal 立即抛 AbortError", async () => {
+    server.listen({ onUnhandledRequest: "error" })
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      fetchJson("https://api.example.com/models", { signal: controller.signal })
+    ).rejects.toThrow()
+  })
+})

package/src/lib/__tests__/pgvector.test.ts

@@ -52,7 +52,7 @@ describe('searchByVector', () => {
 
   it('throws on illegal table name', async () => {
     await expect(searchByVector([0.1], 'users; DROP TABLE users; --'))
-      .rejects.toMatchObject({ message: expect.stringMatching(/非法表名/) })
+      .rejects.toThrow(/非法表名/)
   })
 
   it('accepts allowed table names', async () => {
@@ -81,7 +81,7 @@ describe('insertEmbedding', () => {
 
   it('throws on illegal table name', async () => {
     await expect(insertEmbedding('users', 'id', 'c', [0.1]))
-      .rejects.toMatchObject({ message: expect.stringMatching(/非法表名/) })
+      .rejects.toThrow(/非法表名/)
   })
 
   it('extraFields values are not concatenated into SQL string', async () => {

package/src/lib/app-version.ts

@@ -17,7 +17,7 @@
 
 // 版本号由 vite.shared.ts 构建时注入（__APP_VERSION__），无需运行时读取 package.json
 declare const __APP_VERSION__: string
-const APP_VERSION: string = __APP_VERSION__
+export const APP_VERSION: string = __APP_VERSION__
 
 declare const __APP_UPDATE_DATE__: string
 const APP_UPDATE_DATE: string = __APP_UPDATE_DATE__

package/src/lib/auth/auth.config.ts

@@ -23,6 +23,7 @@ import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
 import { resolveIpLocation, getClientIp } from '@allbluecn/kernel'
+import { getResolvedOAuthProviders } from '@/server/oauth-config'
 
 type CachedProfile = {
   username: string
@@ -92,6 +93,109 @@ function pickBgColor(seed: string) {
   return presetBgColors[Math.abs(hash) % presetBgColors.length]
 }
 
+const credentialsProvider = CredentialsProvider({
+  name: 'credentials',
+  credentials: {
+    email: { label: 'Email', type: 'email' },
+    password: { label: 'Password', type: 'password' },
+    ssoToken: { label: 'SSO Token', type: 'text' },
+  },
+  async authorize(credentials, request) {
+    const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string; ssoToken?: string }
+    if (creds.ssoToken) {
+      const { resolveSsoTokenUser } = await import('./sso-authorize')
+      const user = await resolveSsoTokenUser(creds.ssoToken)
+      if (!user) return null
+      return { id: user.id, email: user.email, name: user.name, role: user.role }
+    }
+    if (!creds.email || !creds.password) return null
+
+    const user = await prisma.user.findUnique({
+      where: { email: creds.email.toLowerCase().trim() },
+      select: { id: true, email: true, username: true, password: true, role: true, status: true },
+    })
+
+    // 用户不存在：userId 为外键，无法记录日志（保持现状）
+    if (!user) return null
+
+    // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
+    let ip: string | null = null
+    let userAgent: string | null = null
+    try {
+      const headers = request?.headers as { get?: (name: string) => string | null } | undefined
+      if (headers && typeof headers.get === 'function') {
+        ip = getClientIp(request as Request)
+        userAgent = headers.get('user-agent') || null
+      }
+    } catch {
+      // 忽略：IP/UA 仅用于日志，获取失败不影响登录
+    }
+
+    // 安全记录登录日志（DB 异常不阻塞登录流程）
+    const recordLog = async (success: boolean, message?: string, location?: string) => {
+      try {
+        await prisma.loginLog.create({
+          data: {
+            userId: user.id,
+            ip,
+            userAgent,
+            location: location ?? null,
+            success,
+            ...(message ? { message } : {}),
+          },
+        })
+      } catch (err) {
+        console.error('[auth] 记录登录日志失败:', err instanceof Error ? err.message : String(err))
+      }
+    }
+
+    // 账号状态异常：记录失败原因
+    if (user.status === 'BANNED') {
+      await recordLog(false, '账号已封禁')
+      return null
+    }
+    if (user.status === 'INACTIVE') {
+      await recordLog(false, '账号未激活')
+      return null
+    }
+    if (user.status !== 'ACTIVE') {
+      await recordLog(false, '账号状态异常')
+      return null
+    }
+
+    const isValid = await bcrypt.compare(creds.password, user.password)
+    if (!isValid) {
+      await recordLog(false, '密码错误')
+      return null
+    }
+
+    // 登录成功：记录 IP/UA/地理位置
+    const location = await resolveIpLocation(ip)
+    await recordLog(true, undefined, location)
+    await prisma.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } })
+
+    const remember = creds.remember === 'true'
+    const stayLoggedIn = creds.stayLoggedIn === 'true'
+    return {
+      id: user.id,
+      email: user.email,
+      name: user.username,
+      role: user.role,
+      remember,
+      stayLoggedIn,
+    }
+  },
+})
+
+const GOOGLE_PROVIDER_BASE = {
+  authorization: {
+    url: 'https://accounts.google.com/o/oauth2/v2/auth',
+    params: { prompt: 'consent', access_type: 'offline', response_type: 'code' },
+  },
+  token: 'https://oauth2.googleapis.com/token',
+  userinfo: 'https://www.googleapis.com/oauth2/v3/userinfo',
+} as const
+
 export const authConfig: StartAuthJSConfig = {
   basePath: '/api/auth',
   session: { strategy: 'jwt', maxAge: 30 * 24 * 60 * 60 },
@@ -111,109 +215,12 @@ export const authConfig: StartAuthJSConfig = {
     },
   },
   providers: [
-    CredentialsProvider({
-      name: 'credentials',
-      credentials: {
-        email: { label: 'Email', type: 'email' },
-        password: { label: 'Password', type: 'password' },
-        ssoToken: { label: 'SSO Token', type: 'text' },
-      },
-      async authorize(credentials, request) {
-        const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string; ssoToken?: string }
-        if (creds.ssoToken) {
-          const { resolveSsoTokenUser } = await import('./sso-authorize')
-          const user = await resolveSsoTokenUser(creds.ssoToken)
-          if (!user) return null
-          return { id: user.id, email: user.email, name: user.name, role: user.role }
-        }
-        if (!creds.email || !creds.password) return null
-
-        const user = await prisma.user.findUnique({
-          where: { email: creds.email },
-          select: { id: true, email: true, username: true, password: true, role: true, status: true },
-        })
-
-        // 用户不存在：userId 为外键，无法记录日志（保持现状）
-        if (!user) return null
-
-        // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
-        let ip: string | null = null
-        let userAgent: string | null = null
-        try {
-          const headers = request?.headers as { get?: (name: string) => string | null } | undefined
-          if (headers && typeof headers.get === 'function') {
-            ip = getClientIp(request as Request)
-            userAgent = headers.get('user-agent') || null
-          }
-        } catch {
-          // 忽略：IP/UA 仅用于日志，获取失败不影响登录
-        }
-
-        // 安全记录登录日志（DB 异常不阻塞登录流程）
-        const recordLog = async (success: boolean, message?: string, location?: string) => {
-          try {
-            await prisma.loginLog.create({
-              data: {
-                userId: user.id,
-                ip,
-                userAgent,
-                location: location ?? null,
-                success,
-                ...(message ? { message } : {}),
-              },
-            })
-          } catch (err) {
-            console.error('[auth] 记录登录日志失败:', err instanceof Error ? err.message : String(err))
-          }
-        }
-
-        // 账号状态异常：记录失败原因
-        if (user.status === 'BANNED') {
-          await recordLog(false, '账号已封禁')
-          return null
-        }
-        if (user.status === 'INACTIVE') {
-          await recordLog(false, '账号未激活')
-          return null
-        }
-        if (user.status !== 'ACTIVE') {
-          await recordLog(false, '账号状态异常')
-          return null
-        }
-
-        const isValid = await bcrypt.compare(creds.password, user.password)
-        if (!isValid) {
-          await recordLog(false, '密码错误')
-          return null
-        }
-
-        // 登录成功：记录 IP/UA/地理位置
-        const location = await resolveIpLocation(ip)
-        await recordLog(true, undefined, location)
-        await prisma.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } })
-
-        const remember = creds.remember === 'true'
-        const stayLoggedIn = creds.stayLoggedIn === 'true'
-        return {
-          id: user.id,
-          email: user.email,
-          name: user.username,
-          role: user.role,
-          remember,
-          stayLoggedIn,
-        }
-      },
-    }),
+    credentialsProvider,
     ...(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET
       ? [GoogleProvider({
           clientId: process.env.AUTH_GOOGLE_ID,
           clientSecret: process.env.AUTH_GOOGLE_SECRET,
-          authorization: {
-            url: 'https://accounts.google.com/o/oauth2/v2/auth',
-            params: { prompt: 'consent', access_type: 'offline', response_type: 'code' },
-          },
-          token: 'https://oauth2.googleapis.com/token',
-          userinfo: 'https://www.googleapis.com/oauth2/v3/userinfo',
+          ...GOOGLE_PROVIDER_BASE,
         })]
       : []),
   ],
@@ -381,3 +388,20 @@ export const authConfig: StartAuthJSConfig = {
     },
   },
 }
+
+/** 异步工厂：DB OAuth 配置优先（60s 缓存），无则回落 env 静态 authConfig.providers */
+export async function getAuthConfig(): Promise<StartAuthJSConfig> {
+  const resolved = await getResolvedOAuthProviders()
+  const google = resolved.find((p) => p.provider === 'google')
+  const providers = google
+    ? [
+        credentialsProvider,
+        GoogleProvider({
+          clientId: google.clientId,
+          clientSecret: google.clientSecret,
+          ...GOOGLE_PROVIDER_BASE,
+        }),
+      ]
+    : authConfig.providers
+  return { ...authConfig, providers }
+}