@allbluecn/web-app 0.11.0 → 0.11.1

package/src/server/middlewares/security-headers.ts

@@ -17,9 +17,18 @@
 
 import { createMiddleware } from '@tanstack/react-start'
 
+// ⚠ script-src 必须含 'unsafe-inline'：TanStack Start SSR 向 HTML 注入内联
+// dehydration 脚本（window.$_TSR = {...}，携带每请求序列化的路由数据）。
+// 不可用 hash 替代——dehydration 内容随每次请求变化，无法预计算；
+// 不可用 nonce 替代——start-server-core 1.168/1.169 无 SSR nonce 自动注入
+// （Router 客户端虽读 meta csp-nonce，服务端无生成方）。若收紧为 'self'，
+// hydration 脚本被 CSP 拦截 → $_TSR undefined → 客户端崩溃全站白屏
+// （SSR HTML 与静态资源均正常，仅浏览器端崩溃；Pro 生产 2026-09-11 已复现）。
+// ⚠ va.vercel-scripts.com：Vercel Analytics / Speed Insights 的脚本域名
+// （__root.tsx 的 <Analytics /> / <SpeedInsights />），缺失则脚本被静默阻止。
 const PROD_CSP = [
   "default-src 'self'",
-  "script-src 'self'",
+  "script-src 'self' 'unsafe-inline' https://va.vercel-scripts.com",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob: https:",
   "font-src 'self' data:",
@@ -37,7 +46,7 @@ const PROD_CSP = [
 
 const DEV_CSP = [
   "default-src 'self' 'unsafe-inline' data: blob:",
-  "script-src 'self' 'unsafe-inline' data: blob:",
+  "script-src 'self' 'unsafe-inline' data: blob: https://va.vercel-scripts.com",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob: https: http:",
   "font-src 'self' data:",

package/src/server/notifications/__tests__/email-mirror.test.ts

@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const sendTemplateEmailMock = vi.fn()
+const checkEmailEligibilityMock = vi.fn()
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    notificationPreference: {
+      findUnique: vi.fn(),
+      create: vi.fn(),
+    },
+    notification: {
+      create: vi.fn(),
+    },
+    user: {
+      findUnique: vi.fn(),
+    },
+  },
+  Prisma: {},
+}))
+
+vi.mock('@/server/notifications/event-bus', () => ({
+  notificationBus: {
+    emit: vi.fn(),
+    subscribe: vi.fn(),
+  },
+}))
+
+vi.mock('@/server/email/preferences', () => ({
+  checkEmailEligibility: (...args: unknown[]) => checkEmailEligibilityMock(...args),
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: (...args: unknown[]) => sendTemplateEmailMock(...args),
+}))
+
+import { prisma } from '@allbluecn/database'
+import { notificationBus } from '@/server/notifications/event-bus'
+import { createNotification } from '../notification-service'
+
+const mockedFindUnique = prisma.notificationPreference.findUnique as ReturnType<typeof vi.fn>
+const mockedNotifCreate = prisma.notification.create as ReturnType<typeof vi.fn>
+const mockedUserFindUnique = prisma.user.findUnique as ReturnType<typeof vi.fn>
+const mockedEmit = notificationBus.emit as ReturnType<typeof vi.fn>
+
+const createdNotification = {
+  id: 'n1',
+  category: 'team',
+  type: 'invite',
+  title: 'New invite',
+  body: 'You have been invited',
+  link: '/invites/abc',
+  readAt: null,
+  createdAt: new Date('2026-08-29T10:00:00Z'),
+}
+
+const prefsBase = {
+  userId: 'u1',
+  categories: {
+    team: 'realtime',
+    collaboration: 'realtime',
+    system: 'realtime',
+    billing: 'realtime',
+    security: 'realtime',
+  },
+  emailCategories: {
+    team: true,
+    collaboration: true,
+    system: true,
+    billing: true,
+    security: true,
+  },
+  dndEnabled: false,
+  dndStart: '22:00',
+  dndEnd: '08:00',
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockedFindUnique.mockResolvedValue(prefsBase)
+  mockedNotifCreate.mockResolvedValue(createdNotification)
+  checkEmailEligibilityMock.mockResolvedValue({ sendable: true })
+  sendTemplateEmailMock.mockResolvedValue({ sent: true })
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+async function flushMicrotasks() {
+  for (let i = 0; i < 8; i++) await Promise.resolve()
+}
+
+describe('createNotification 邮件镜像（六条件链）', () => {
+  it('条件 2 失败：emailCategories[cat] 关闭 → 不发送邮件', async () => {
+    mockedFindUnique.mockResolvedValue({
+      ...prefsBase,
+      emailCategories: { ...prefsBase.emailCategories, team: false },
+    })
+
+    await createNotification({
+      userId: 'u1',
+      category: 'team',
+      type: 'invite',
+      title: 'New invite',
+    })
+    await flushMicrotasks()
+
+    expect(mockedEmit).toHaveBeenCalledTimes(1)
+    expect(checkEmailEligibilityMock).not.toHaveBeenCalled()
+    expect(mockedUserFindUnique).not.toHaveBeenCalled()
+    expect(sendTemplateEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('条件 4 失败：邮箱未验证 → 不发送邮件', async () => {
+    mockedUserFindUnique.mockResolvedValue({
+      email: 'u1@example.com',
+      emailVerified: null,
+      locale: 'zh',
+    })
+
+    await createNotification({
+      userId: 'u1',
+      category: 'team',
+      type: 'invite',
+      title: 'New invite',
+    })
+    await flushMicrotasks()
+
+    expect(mockedUserFindUnique).toHaveBeenCalledTimes(1)
+    expect(checkEmailEligibilityMock).not.toHaveBeenCalled()
+    expect(sendTemplateEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('条件 5 失败：DND 时段内 → 不发送邮件', async () => {
+    // 固定时间为 23:00，DND 22:00-08:00 跨零点区间内
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-08-29T23:00:00Z'))
+    mockedFindUnique.mockResolvedValue({
+      ...prefsBase,
+      dndEnabled: true,
+    })
+    mockedUserFindUnique.mockResolvedValue({
+      email: 'u1@example.com',
+      emailVerified: new Date(),
+      locale: 'zh',
+    })
+
+    await createNotification({
+      userId: 'u1',
+      category: 'team',
+      type: 'invite',
+      title: 'New invite',
+    })
+    await flushMicrotasks()
+
+    expect(checkEmailEligibilityMock).toHaveBeenCalledTimes(1)
+    expect(sendTemplateEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('六条件全开：发送邮件，vars 精确到 title/body/link', async () => {
+    mockedUserFindUnique.mockResolvedValue({
+      email: 'u1@example.com',
+      emailVerified: new Date(),
+      locale: 'en',
+    })
+
+    await createNotification({
+      userId: 'u1',
+      category: 'team',
+      type: 'invite',
+      title: 'New invite',
+      body: 'Body here',
+      link: '/invites/abc',
+    })
+    await flushMicrotasks()
+
+    expect(checkEmailEligibilityMock).toHaveBeenCalledWith('u1', 'notification')
+    expect(sendTemplateEmailMock).toHaveBeenCalledTimes(1)
+    expect(sendTemplateEmailMock).toHaveBeenCalledWith({
+      key: 'notification.mirror',
+      to: 'u1@example.com',
+      locale: 'en',
+      userId: 'u1',
+      vars: {
+        title: 'New invite',
+        body: 'Body here',
+        link: '/invites/abc',
+      },
+    })
+  })
+})

package/src/server/notifications/__tests__/verify-reminder.test.ts

@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: {
+      findUnique: vi.fn(),
+    },
+    notification: {
+      create: vi.fn(),
+      findFirst: vi.fn(),
+    },
+  },
+  Prisma: {},
+}))
+
+vi.mock('../notification-service', () => ({
+  createNotification: vi.fn(),
+}))
+
+import { prisma } from '@allbluecn/database'
+import { createNotification } from '../notification-service'
+import { ensureVerifyReminder } from '../verify-reminder'
+
+const mockedUserFindUnique = prisma.user.findUnique as ReturnType<typeof vi.fn>
+const mockedNotifFindFirst = prisma.notification.findFirst as ReturnType<typeof vi.fn>
+const mockedCreateNotification = createNotification as ReturnType<typeof vi.fn>
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('ensureVerifyReminder', () => {
+  it('returns early when user does not exist', async () => {
+    mockedUserFindUnique.mockResolvedValueOnce(null)
+
+    await ensureVerifyReminder('missing-user')
+
+    expect(mockedNotifFindFirst).not.toHaveBeenCalled()
+    expect(mockedCreateNotification).not.toHaveBeenCalled()
+  })
+
+  it('returns early when user is already verified', async () => {
+    mockedUserFindUnique.mockResolvedValueOnce({ emailVerified: new Date() })
+
+    await ensureVerifyReminder('u1')
+
+    expect(mockedNotifFindFirst).not.toHaveBeenCalled()
+    expect(mockedCreateNotification).not.toHaveBeenCalled()
+  })
+
+  it('returns early when a reminder already exists for the user', async () => {
+    mockedUserFindUnique.mockResolvedValueOnce({ emailVerified: null })
+    mockedNotifFindFirst.mockResolvedValueOnce({ id: 'existing-reminder' })
+
+    await ensureVerifyReminder('u1')
+
+    expect(mockedNotifFindFirst).toHaveBeenCalledWith({
+      where: { userId: 'u1', type: 'email-verify-reminder' },
+      select: { id: true },
+    })
+    expect(mockedCreateNotification).not.toHaveBeenCalled()
+  })
+
+  it('creates a reminder notification for unverified users without existing reminder', async () => {
+    mockedUserFindUnique.mockResolvedValueOnce({ emailVerified: null })
+    mockedNotifFindFirst.mockResolvedValueOnce(null)
+    mockedCreateNotification.mockResolvedValueOnce(undefined)
+
+    await ensureVerifyReminder('u1')
+
+    expect(mockedCreateNotification).toHaveBeenCalledWith({
+      userId: 'u1',
+      category: 'system',
+      type: 'email-verify-reminder',
+      title: '邮箱尚未验证',
+      body: '验证邮箱后可开启邮件通知，保障账号安全。可在设置页重新发送验证邮件。',
+      link: '/settings/account',
+      force: true,
+    })
+  })
+
+  it('swallows errors so the caller never sees a rejection', async () => {
+    mockedUserFindUnique.mockRejectedValueOnce(new Error('db down'))
+    const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    await expect(ensureVerifyReminder('u1')).resolves.toBeUndefined()
+    expect(spy).toHaveBeenCalledWith(
+      'verify reminder failed',
+      expect.objectContaining({ userId: 'u1', reason: 'db down' }),
+    )
+    spy.mockRestore()
+  })
+})

package/src/server/notifications/notification-service.ts

@@ -9,11 +9,21 @@ import type {
 import {
   isInDndWindow,
   normalizeCategoryFrequencies,
+  normalizeEmailCategories,
   DEFAULT_CATEGORIES,
+  DEFAULT_EMAIL_CATEGORIES,
 } from '@allbluecn/kernel'
 import { notificationBus } from './event-bus'
+import { checkEmailEligibility } from '../email/preferences'
+import { sendTemplateEmail } from '../email'
 
-export { DEFAULT_CATEGORIES, isInDndWindow, normalizeCategoryFrequencies } from '@allbluecn/kernel'
+export {
+  DEFAULT_CATEGORIES,
+  DEFAULT_EMAIL_CATEGORIES,
+  isInDndWindow,
+  normalizeCategoryFrequencies,
+  normalizeEmailCategories,
+} from '@allbluecn/kernel'
 
 export interface CreateNotificationInput {
   userId: string
@@ -52,6 +62,7 @@ export async function getOrCreatePreferences(userId: string): Promise<Notificati
   if (existing) {
     return {
       categories: normalizeCategoryFrequencies(existing.categories),
+      emailCategories: normalizeEmailCategories(existing.emailCategories),
       dndEnabled: existing.dndEnabled,
       dndStart: existing.dndStart,
       dndEnd: existing.dndEnd,
@@ -59,6 +70,7 @@ export async function getOrCreatePreferences(userId: string): Promise<Notificati
   }
   const defaults: NotificationPreferences = {
     categories: { ...DEFAULT_CATEGORIES },
+    emailCategories: { ...DEFAULT_EMAIL_CATEGORIES },
     dndEnabled: false,
     dndStart: '22:00',
     dndEnd: '08:00',
@@ -68,6 +80,7 @@ export async function getOrCreatePreferences(userId: string): Promise<Notificati
       data: {
         userId,
         categories: defaults.categories,
+        emailCategories: defaults.emailCategories,
         dndEnabled: defaults.dndEnabled,
         dndStart: defaults.dndStart,
         dndEnd: defaults.dndEnd,
@@ -119,12 +132,69 @@ export async function createNotification(input: CreateNotificationInput): Promis
 
     if (input.force || frequency === 'realtime') {
       notificationBus.emit(input.userId, { kind: 'notification', notification: item })
+      // 邮件镜像（fire-and-forget，不阻塞站内通知）：条件 1-5 在此判定，条件 6（频控）由 outbox 内部执行
+      void mirrorToEmail({
+        userId: input.userId,
+        category: input.category,
+        title: input.title,
+        body: input.body ?? null,
+        link: input.link ?? null,
+      })
     }
   } catch (e) {
     console.error('[notifications] create failed:', e instanceof Error ? e.message : 'unknown')
   }
 }
 
+/**
+ * 站内通知镜像到邮件（六条件链）。任何失败只记日志不抛出，不阻断站内通知。
+ * 条件 1（force/realtime）由调用方判定；条件 2/3/4/5 在此判定；条件 6（频控）由 outbox 内部执行。
+ */
+async function mirrorToEmail(input: {
+  userId: string
+  category: NotificationCategory
+  title: string
+  body: string | null
+  link: string | null
+}): Promise<void> {
+  try {
+    // 条件 2：邮件渠道开关（通知偏好里该类别的 emailCategories 需开启）
+    const prefs = await getOrCreatePreferences(input.userId)
+    if (!prefs.emailCategories[input.category]) return
+
+    // 条件 4：邮箱已验证（User.email 存在且 emailVerified 非空）
+    const user = await prisma.user.findUnique({
+      where: { id: input.userId },
+      select: { email: true, emailVerified: true, locale: true },
+    })
+    if (!user?.email || !user.emailVerified) return
+
+    // 条件 3：EmailPreference 未退订/未抑制
+    const eligibility = await checkEmailEligibility(input.userId, 'notification')
+    if (!eligibility.sendable) return
+
+    // 条件 5：DND 时段外（复用内核 isInDndWindow，已处理跨零点区间）
+    const now = new Date()
+    const hhmm = `${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`
+    if (isInDndWindow(prefs, hhmm)) return
+
+    await sendTemplateEmail({
+      key: 'notification.mirror',
+      to: user.email,
+      locale: user.locale ?? 'zh',
+      userId: input.userId,
+      vars: {
+        title: input.title,
+        body: input.body ?? undefined,
+        link: input.link ?? undefined,
+      },
+    })
+  } catch (e) {
+    // 镜像失败不影响站内通知；仅记录
+    console.error('[notifications] mirror to email failed:', e instanceof Error ? e.message : 'unknown')
+  }
+}
+
 function formatDigestBody(titles: string[], total: number): string {
   const lines = titles.slice(0, DIGEST_SUMMARY_ITEMS).map((t) => `· ${t}`)
   if (total > DIGEST_SUMMARY_ITEMS) {

package/src/server/notifications/verify-reminder.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { prisma } from '@allbluecn/database'
+import { m } from '@/paraglide/messages.js'
+import { createNotification } from './notification-service'
+
+const REMINDER_TYPE = 'email-verify-reminder'
+
+export async function ensureVerifyReminder(userId: string): Promise<void> {
+  try {
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { emailVerified: true, locale: true },
+    })
+    if (!user || user.emailVerified) return
+
+    const existing = await prisma.notification.findFirst({
+      where: { userId, type: REMINDER_TYPE },
+      select: { id: true },
+    })
+    if (existing) return
+
+    const msgOptions = user.locale === 'en' ? { locale: 'en' as const } : undefined
+
+    await createNotification({
+      userId,
+      category: 'system',
+      type: REMINDER_TYPE,
+      title: m.notifications_verify_emailReminderTitle(undefined, msgOptions),
+      body: m.notifications_verify_emailReminderBody(undefined, msgOptions),
+      link: '/settings/account',
+      force: true,
+    })
+  } catch (err) {
+    console.error('verify reminder failed', {
+      userId,
+      reason: err instanceof Error ? err.message : String(err),
+    })
+  }
+}

package/src/server/oauth-config.ts

@@ -0,0 +1,59 @@
+// ⚠ 仅服务端 import。依赖 prisma + node:crypto，禁止在客户端组件/路由文件顶层引用。
+//
+// 设计：
+//   - 60s 模块级缓存（CACHE_TTL_MS）：admin 后台保存后 web 端最多 60s 生效，符合计划 spec。
+//   - 数据源：DB（OAuthProviderConfig）优先；DB 无 google 记录时回落 env（AUTH_GOOGLE_ID/SECRET）。
+//   - 缓存失效：invalidateOAuthConfigCache 为跨 app 场景预留（当前无调用方；跨 app 通过 TTL 自然过期）。
+//   - clientSecret 存 AES-256-GCM 密文（见 crypto.ts），运行时解密。
+import { prisma } from '@allbluecn/database'
+import { decryptSecret } from '@allbluecn/kernel/crypto'
+
+export interface ResolvedOAuthProvider {
+  provider: 'google' | (string & {})
+  clientId: string
+  clientSecret: string
+}
+
+const CACHE_TTL_MS = 60_000
+let cache: { at: number; providers: ResolvedOAuthProvider[] } | null = null
+
+export async function getResolvedOAuthProviders(): Promise<ResolvedOAuthProvider[]> {
+  if (cache && Date.now() - cache.at < CACHE_TTL_MS) return cache.providers
+  const rows = await prisma.oAuthProviderConfig.findMany({
+    where: { enabled: true },
+    select: { provider: true, clientId: true, clientSecret: true },
+  }).catch((e) => {
+    console.error('[oauth-config] DB 读取失败，回落 env:', e instanceof Error ? e.message : String(e))
+    return []
+  })
+  const providers: ResolvedOAuthProvider[] = rows
+    .map((r) => {
+      const clientSecret = decryptSecret(r.clientSecret)
+      if (!clientSecret) {
+        console.warn(`[oauth-config] provider="${r.provider}" clientSecret 解密失败或为空，跳过`)
+      }
+      return {
+        provider: r.provider,
+        clientId: r.clientId,
+        clientSecret: clientSecret ?? '',
+      }
+    })
+    .filter((r) => r.clientId && r.clientSecret)
+  if (
+    !providers.some((p) => p.provider === 'google') &&
+    process.env.AUTH_GOOGLE_ID &&
+    process.env.AUTH_GOOGLE_SECRET
+  ) {
+    providers.push({
+      provider: 'google',
+      clientId: process.env.AUTH_GOOGLE_ID,
+      clientSecret: process.env.AUTH_GOOGLE_SECRET,
+    })
+  }
+  cache = { at: Date.now(), providers }
+  return providers
+}
+
+export function invalidateOAuthConfigCache() {
+  cache = null
+}