@allbluecn/web-app 0.17.1 → 0.18.0

package/src/server/serverFns/bug/__tests__/detail-select.test.ts

@@ -0,0 +1,35 @@
+// extractScreenshotBlobId 契约锁定（任务 25 R1 顺手项）：blobId 是 img src 的
+// XSS 关键净化器——rawPayload 为不可信外部输入，仅白名单字符（cuid 兼容）
+// 放行，注入形态一律拒绝（返回 null → 前端回退占位，不产生可疑 src）。
+import { describe, expect, it } from "vitest";
+import { extractScreenshotBlobId } from "../bug-crud/detail-select";
+
+describe("extractScreenshotBlobId（img src 白名单契约）", () => {
+  it("合法 cuid 形态通过", () => {
+    expect(extractScreenshotBlobId({ blobId: "cmusbvk7y002g7n8or1h7d5xv" })).toBe(
+      "cmusbvk7y002g7n8or1h7d5xv",
+    );
+    // 大小写字母/数字/下划线/连字符均在白名单内
+    expect(extractScreenshotBlobId({ blobId: "Blob_01-aBc123" })).toBe("Blob_01-aBc123");
+  });
+
+  it("注入形态一律拒绝（引号/空白/路径/javascript:/超长/非字符串）", () => {
+    // HTML 属性逃逸尝试
+    expect(extractScreenshotBlobId({ blobId: 'abc" onerror="alert(1)' })).toBeNull();
+    // javascript: 协议串
+    expect(extractScreenshotBlobId({ blobId: "javascript:alert(1)" })).toBeNull();
+    // 路径穿越 / 空白
+    expect(extractScreenshotBlobId({ blobId: "../../etc/passwd" })).toBeNull();
+    expect(extractScreenshotBlobId({ blobId: "abc def" })).toBeNull();
+    // 超长（>64）与空串
+    expect(extractScreenshotBlobId({ blobId: "a".repeat(65) })).toBeNull();
+    expect(extractScreenshotBlobId({ blobId: "" })).toBeNull();
+    // 非字符串 / 非 record / 数组
+    expect(extractScreenshotBlobId({ blobId: 123 })).toBeNull();
+    expect(extractScreenshotBlobId({ other: "x" })).toBeNull();
+    expect(extractScreenshotBlobId("cmusbvk7y002g7n8or1h7d5xv")).toBeNull();
+    expect(extractScreenshotBlobId([{ blobId: "cmusbvk7y002g7n8or1h7d5xv" }])).toBeNull();
+    expect(extractScreenshotBlobId(null)).toBeNull();
+    expect(extractScreenshotBlobId(undefined)).toBeNull();
+  });
+});

package/src/server/serverFns/bug/bug-access-tokens.ts

@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 项目 BUG 设置页 serverFn（任务 15，规格 §8.7）：bug.report 凭证管理 +
+// BugProjectSettings 读写（惰性 upsert）。token 明文仅 createBugTokenFn 返回
+// 一次（服务端只存 sha256 hash + 8 字符前缀）；list 只回 prefix/状态等元数据。
+// 纯净 serverFn 文件：除 createServerFn 外无普通导出（成员校验复用
+// bug-permissions.ts，token 生成复用 server/bug-report/tokens.ts）。
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { requireAuth } from "@/server/auth-helpers";
+import { generateProjectToken } from "@/server/bug-report/tokens";
+import { assertProjectMembership } from "@/server/bug/bug-permissions";
+
+// ── 凭证（scope=bug.report）──
+
+const projectIdSchema = z.object({ projectId: z.string().min(1) });
+
+/** 凭证列表项：无明文无 hash 全文，仅 prefix + 状态元数据（§8.7 列表列） */
+interface BugTokenListItem {
+  id: string;
+  name: string;
+  tokenPrefix: string;
+  lastUsedAt: string | null;
+  revoked: boolean;
+  revokedAt: string | null;
+  createdAt: string;
+  createdByUsername: string | null;
+}
+
+export const listBugTokensFn = createServerFn({ method: "GET" })
+  .validator(projectIdSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const rows = await prisma.projectAccessToken.findMany({
+      where: { projectId: data.projectId, scope: "bug.report" },
+      orderBy: { createdAt: "desc" },
+      select: {
+        id: true,
+        name: true,
+        tokenPrefix: true,
+        lastUsedAt: true,
+        revokedAt: true,
+        createdAt: true,
+        createdBy: { select: { username: true } },
+      },
+    });
+    return rows.map(
+      (r): BugTokenListItem => ({
+        id: r.id,
+        name: r.name,
+        tokenPrefix: r.tokenPrefix,
+        lastUsedAt: r.lastUsedAt ? r.lastUsedAt.toISOString() : null,
+        revoked: r.revokedAt !== null,
+        revokedAt: r.revokedAt ? r.revokedAt.toISOString() : null,
+        createdAt: r.createdAt.toISOString(),
+        createdByUsername: r.createdBy?.username ?? null,
+      }),
+    );
+  });
+
+const createTokenSchema = z.object({
+  projectId: z.string().min(1),
+  name: z.string().trim().min(1).max(50),
+});
+
+export const createBugTokenFn = createServerFn({ method: "POST" })
+  .validator(createTokenSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const { plaintext, tokenHash, tokenPrefix } = generateProjectToken();
+    const row = await prisma.projectAccessToken.create({
+      data: {
+        projectId: data.projectId,
+        name: data.name,
+        scope: "bug.report",
+        tokenHash,
+        tokenPrefix,
+        createdById: userId,
+      },
+      select: { id: true, name: true, createdAt: true },
+    });
+    // 明文仅此处返回一次；服务端不落库，之后任何接口都无法再取回
+    return {
+      id: row.id,
+      name: row.name,
+      tokenPrefix,
+      plaintext,
+      createdAt: row.createdAt.toISOString(),
+    };
+  });
+
+const revokeTokenSchema = z.object({
+  projectId: z.string().min(1),
+  tokenId: z.string().min(1),
+});
+
+export const revokeBugTokenFn = createServerFn({ method: "POST" })
+  .validator(revokeTokenSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const revokedAt = new Date();
+    // DB-03：吊销查后写合并为条件 updateMany（where 含 revokedAt:null），
+    // 幂等防并发重复吊销；仅计数为 0 时（不存在/已吊销）回读区分错误文案
+    const res = await prisma.projectAccessToken.updateMany({
+      where: { id: data.tokenId, projectId: data.projectId, scope: "bug.report", revokedAt: null },
+      data: { revokedAt },
+    });
+    if (res.count === 0) {
+      const existing = await prisma.projectAccessToken.findFirst({
+        where: { id: data.tokenId, projectId: data.projectId, scope: "bug.report" },
+        select: { id: true },
+      });
+      if (!existing) throw new Error("凭证不存在");
+      throw new Error("该凭证已吊销");
+    }
+    return { id: data.tokenId, revokedAt: revokedAt.toISOString() };
+  });
+
+// ── BugProjectSettings（惰性 upsert：读缺省返回默认值不落库，写时 upsert）──
+
+const DEFAULT_BUG_PROJECT_SETTINGS = {
+  autoReportEnabled: true,
+  sampleRate: 1,
+  reopenOnDuplicate: true,
+  autoFixEnabled: false,
+  // 任务 34（规格 Q2）：false=AI 起草的测试失败 BUG 落 pendingConfirm=true 待确认闸门
+  autoSubmitTestBugs: false,
+} as const;
+
+export const getBugProjectSettingsFn = createServerFn({ method: "GET" })
+  .validator(projectIdSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const row = await prisma.bugProjectSettings.findUnique({
+      where: { projectId: data.projectId },
+    });
+    return row
+      ? {
+          autoReportEnabled: row.autoReportEnabled,
+          sampleRate: row.sampleRate,
+          reopenOnDuplicate: row.reopenOnDuplicate,
+          autoFixEnabled: row.autoFixEnabled,
+          autoSubmitTestBugs: row.autoSubmitTestBugs,
+        }
+      : { ...DEFAULT_BUG_PROJECT_SETTINGS };
+  });
+
+const updateSettingsSchema = z.object({
+  projectId: z.string().min(1),
+  autoReportEnabled: z.boolean().optional(),
+  sampleRate: z.number().min(0).max(1).optional(),
+  reopenOnDuplicate: z.boolean().optional(),
+  autoFixEnabled: z.boolean().optional(),
+  autoSubmitTestBugs: z.boolean().optional(),
+});
+
+export const updateBugProjectSettingsFn = createServerFn({ method: "POST" })
+  .validator(updateSettingsSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    // update 只写提供的字段（不重置其余）；create 合并默认值（未提供字段回默认）
+    const provided = {
+      ...(data.autoReportEnabled !== undefined ? { autoReportEnabled: data.autoReportEnabled } : {}),
+      ...(data.sampleRate !== undefined ? { sampleRate: data.sampleRate } : {}),
+      ...(data.reopenOnDuplicate !== undefined
+        ? { reopenOnDuplicate: data.reopenOnDuplicate }
+        : {}),
+      ...(data.autoFixEnabled !== undefined ? { autoFixEnabled: data.autoFixEnabled } : {}),
+      ...(data.autoSubmitTestBugs !== undefined
+        ? { autoSubmitTestBugs: data.autoSubmitTestBugs }
+        : {}),
+    };
+    const row = await prisma.bugProjectSettings.upsert({
+      where: { projectId: data.projectId },
+      create: { projectId: data.projectId, ...DEFAULT_BUG_PROJECT_SETTINGS, ...provided },
+      update: provided,
+    });
+    return {
+      autoReportEnabled: row.autoReportEnabled,
+      sampleRate: row.sampleRate,
+      reopenOnDuplicate: row.reopenOnDuplicate,
+      autoFixEnabled: row.autoFixEnabled,
+      autoSubmitTestBugs: row.autoSubmitTestBugs,
+    };
+  });

package/src/server/serverFns/bug/bug-activities.ts

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { requireAuth } from "@/server/auth-helpers";
+import type { AvatarConfig } from "@allbluecn/kernel";
+import { BUG_USER_BRIEF_SELECT } from "@/components/bug/types";
+import type { BugActivityItem } from "@/components/bug/types";
+import { assertBugProjectMember } from "@/server/bug/bug-permissions";
+
+// BugActivity.userId 可空（SDK/agent 产生），user 关系 onDelete: SetNull
+function castActivityUser(u: {
+  id: string;
+  username: string;
+  email: string;
+  avatarConfig: unknown;
+  bgShape: string | null;
+  bgColor: string | null;
+} | null) {
+  return u ? { ...u, avatarConfig: (u.avatarConfig as AvatarConfig | null) ?? null } : null;
+}
+
+const listActivitiesSchema = z.object({
+  bugId: z.string(),
+  take: z.number().int().min(1).max(200).default(50),
+  cursor: z.string().optional(),
+});
+
+export const listBugActivitiesFn = createServerFn({ method: "GET" })
+  .validator(listActivitiesSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+
+    await assertBugProjectMember(data.bugId, userId);
+
+    // cursor 分页走 (bugId, createdAt) 复合索引；take+1 探测 hasMore
+    const activities = await prisma.bugActivity.findMany({
+      where: {
+        bugId: data.bugId,
+        ...(data.cursor ? { createdAt: { lt: new Date(data.cursor) } } : {}),
+      },
+      orderBy: { createdAt: "desc" },
+      take: data.take + 1,
+      select: {
+        id: true,
+        action: true,
+        field: true,
+        oldValue: true,
+        newValue: true,
+        isAI: true,
+        actorType: true,
+        agentName: true,
+        createdAt: true,
+        user: { select: BUG_USER_BRIEF_SELECT },
+      },
+    });
+
+    const hasMore = activities.length > data.take;
+    const items = hasMore ? activities.slice(0, data.take) : activities;
+    const nextCursor = hasMore ? items[items.length - 1].createdAt.toISOString() : null;
+
+    const mapped: BugActivityItem[] = items.map((a) => ({
+      id: a.id,
+      action: a.action,
+      field: a.field,
+      oldValue: a.oldValue,
+      newValue: a.newValue,
+      isAI: a.isAI,
+      actorType: a.actorType,
+      agentName: a.agentName,
+      createdAt: a.createdAt.toISOString(),
+      user: castActivityUser(a.user),
+    }));
+
+    return { items: mapped, nextCursor };
+  });

package/src/server/serverFns/bug/bug-collect-tokens.ts

@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 收集页管理 serverFn（任务 19，规格 §9「管理」）：bug.collect scope 凭证的
+// 创建/列表/禁用 + token.config（自定义标题/引导语/字段开关）读写。token 明文
+// 仅 createCollectTokenFn 返回一次（收集链接含明文，复制后无法再取回）。
+// 纯净 serverFn 文件：除 createServerFn 外无普通导出（成员校验复用
+// bug-permissions.ts，token 生成复用 server/bug-report/tokens.ts）。
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import type { Prisma } from "@allbluecn/database";
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { requireAuth } from "@/server/auth-helpers";
+import { generateProjectToken } from "@/server/bug-report/tokens";
+import { assertProjectMembership } from "@/server/bug/bug-permissions";
+
+/** 收集页 config（与 collect-handler 的 CollectPageConfig 对齐，明文存 Json） */
+interface CollectPageConfigValue {
+  title: string | null;
+  description: string | null;
+  severityVisible: boolean;
+  screenshotEnabled: boolean;
+}
+
+interface CollectTokenListItem {
+  id: string;
+  name: string;
+  tokenPrefix: string;
+  lastUsedAt: string | null;
+  revoked: boolean;
+  revokedAt: string | null;
+  createdAt: string;
+  createdByUsername: string | null;
+  config: CollectPageConfigValue;
+}
+
+/** token.config（Json）宽容解析：缺省回落默认标题空 + 开关全开（与 collect-handler 同口径） */
+function parseCollectConfig(raw: unknown): CollectPageConfigValue {
+  const cfg = (typeof raw === "object" && raw !== null ? raw : {}) as Record<string, unknown>;
+  return {
+    title: typeof cfg.title === "string" && cfg.title ? cfg.title : null,
+    description: typeof cfg.description === "string" && cfg.description ? cfg.description : null,
+    severityVisible: cfg.severityVisible !== false,
+    screenshotEnabled: cfg.screenshotEnabled !== false,
+  };
+}
+
+const projectIdSchema = z.object({ projectId: z.string().min(1) });
+
+export const listCollectTokensFn = createServerFn({ method: "GET" })
+  .validator(projectIdSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const rows = await prisma.projectAccessToken.findMany({
+      where: { projectId: data.projectId, scope: "bug.collect" },
+      orderBy: { createdAt: "desc" },
+      select: {
+        id: true,
+        name: true,
+        tokenPrefix: true,
+        lastUsedAt: true,
+        revokedAt: true,
+        createdAt: true,
+        config: true,
+        createdBy: { select: { username: true } },
+      },
+    });
+    return rows.map((r) => ({
+      id: r.id,
+      name: r.name,
+      tokenPrefix: r.tokenPrefix,
+      lastUsedAt: r.lastUsedAt ? r.lastUsedAt.toISOString() : null,
+      revoked: r.revokedAt !== null,
+      revokedAt: r.revokedAt ? r.revokedAt.toISOString() : null,
+      createdAt: r.createdAt.toISOString(),
+      createdByUsername: r.createdBy?.username ?? null,
+      config: parseCollectConfig(r.config),
+    }));
+  });
+
+const createCollectTokenSchema = z.object({
+  projectId: z.string().min(1),
+  name: z.string().trim().min(1).max(50),
+});
+
+export const createCollectTokenFn = createServerFn({ method: "POST" })
+  .validator(createCollectTokenSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const { plaintext, tokenHash, tokenPrefix } = generateProjectToken();
+    const row = await prisma.projectAccessToken.create({
+      data: {
+        projectId: data.projectId,
+        name: data.name,
+        scope: "bug.collect",
+        tokenHash,
+        tokenPrefix,
+        createdById: userId,
+      },
+      select: { id: true, name: true, createdAt: true },
+    });
+    // 明文（即收集链接密钥）仅此处返回一次；服务端只存 sha256 hash
+    return {
+      id: row.id,
+      name: row.name,
+      tokenPrefix,
+      plaintext,
+      createdAt: row.createdAt.toISOString(),
+    };
+  });
+
+const revokeCollectTokenSchema = z.object({
+  projectId: z.string().min(1),
+  tokenId: z.string().min(1),
+});
+
+export const revokeCollectTokenFn = createServerFn({ method: "POST" })
+  .validator(revokeCollectTokenSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const revokedAt = new Date();
+    // DB-03：吊销查后写合并为条件 updateMany（where 含 revokedAt:null），
+    // 幂等防并发重复吊销；仅计数为 0 时（不存在/已禁用）回读区分错误文案
+    const res = await prisma.projectAccessToken.updateMany({
+      where: { id: data.tokenId, projectId: data.projectId, scope: "bug.collect", revokedAt: null },
+      data: { revokedAt },
+    });
+    if (res.count === 0) {
+      const existing = await prisma.projectAccessToken.findFirst({
+        where: { id: data.tokenId, projectId: data.projectId, scope: "bug.collect" },
+        select: { id: true },
+      });
+      if (!existing) throw new Error("收集链接不存在");
+      throw new Error("该收集链接已禁用");
+    }
+    return { id: data.tokenId, revokedAt: revokedAt.toISOString() };
+  });
+
+const updateCollectConfigSchema = z.object({
+  projectId: z.string().min(1),
+  tokenId: z.string().min(1),
+  title: z.string().trim().max(200).optional(),
+  description: z.string().trim().max(2_000).optional(),
+  severityVisible: z.boolean().optional(),
+  screenshotEnabled: z.boolean().optional(),
+});
+
+/** config 增量合并：仅写入提供的字段；标题/引导语空串表示清除（回落默认文案） */
+function mergeCollectConfig(
+  existing: unknown,
+  patch: {
+    title?: string;
+    description?: string;
+    severityVisible?: boolean;
+    screenshotEnabled?: boolean;
+  },
+): Prisma.InputJsonValue {
+  const next: Record<string, unknown> = {
+    ...(typeof existing === "object" && existing !== null ? existing : {}),
+  };
+  if (patch.title !== undefined) next.title = patch.title || null;
+  if (patch.description !== undefined) next.description = patch.description || null;
+  if (patch.severityVisible !== undefined) next.severityVisible = patch.severityVisible;
+  if (patch.screenshotEnabled !== undefined) next.screenshotEnabled = patch.screenshotEnabled;
+  return next as Prisma.InputJsonValue;
+}
+
+export const updateCollectConfigFn = createServerFn({ method: "POST" })
+  .validator(updateCollectConfigSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma();
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+    await assertProjectMembership(data.projectId, userId);
+
+    const existing = await prisma.projectAccessToken.findFirst({
+      where: { id: data.tokenId, projectId: data.projectId, scope: "bug.collect" },
+      select: { id: true, config: true },
+    });
+    if (!existing) throw new Error("收集链接不存在");
+
+    const { projectId: _p, tokenId: _t, ...patch } = data;
+    const row = await prisma.projectAccessToken.update({
+      where: { id: existing.id },
+      data: { config: mergeCollectConfig(existing.config, patch) },
+      select: { id: true, config: true },
+    });
+    return { id: row.id, config: parseCollectConfig(row.config) };
+  });

package/src/server/serverFns/bug/bug-collect.ts

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 公开收集页 serverFn（任务 18，规格 §9）：免 requireAuth（token 是唯一信任锚），
+// session 可选存在（登录用户提交落 reporter，匿名落项目 owner——核心逻辑在
+// server/bug-collect/collect-handler.ts）。纯净 serverFn 文件：除 createServerFn
+// 外无普通导出（serverFn 文件纯净约束）。
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { getCurrentSession } from "@/lib/session";
+import { BUG_SEVERITIES, type BugSeverity } from "@/shared/bug/constants";
+import {
+  getCollectPage,
+  submitCollectedBug,
+} from "@/server/bug-collect/collect-handler";
+
+// state/severity 写入侧 z.enum 收敛（DB 为 String，照 bug-crud.ts 白名单模式）
+const BUG_SEVERITY_VALUES = BUG_SEVERITIES.map((s) => s.value) as [
+  BugSeverity,
+  ...BugSeverity[],
+];
+
+export const getCollectPageFn = createServerFn({ method: "GET" })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }) => getCollectPage(data.token));
+
+const submitSchema = z.object({
+  token: z.string().min(1),
+  title: z.string().trim().min(1).max(200),
+  description: z.string().max(20_000).optional(),
+  reproduceSteps: z.string().max(20_000).optional(),
+  severity: z.enum(BUG_SEVERITY_VALUES).optional(),
+  screenshotBlobIds: z.array(z.string().min(1)).max(3).optional(),
+  // 蜜罐隐藏域：常规命名不泄露反机器人性质（§9），非空核心逻辑静默成功
+  companyWebsite: z.string().max(2_000).optional(),
+});
+
+export const submitCollectedBugFn = createServerFn({ method: "POST" })
+  .validator(submitSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest();
+    // IP 提取与既有 rate-limit key 惯例一致（x-forwarded-for，缺失回 unknown）
+    const ip = request.headers.get("x-forwarded-for") ?? "unknown";
+    const session = await getCurrentSession(request);
+    return submitCollectedBug({ ip, session, input: data });
+  });