@allbluecn/web-app 0.17.2 → 0.18.0

package/src/server/serverFns/story/__tests__/story-dependencies.test.ts

@@ -49,11 +49,13 @@ const mocks = vi.hoisted(() => ({
   depFindFirst: vi.fn(),
   depFindUnique: vi.fn(),
   depCreate: vi.fn(),
+  depCreateManyAndReturn: vi.fn(),
   depUpdate: vi.fn(),
   depDelete: vi.fn(),
   storyFindMany: vi.fn(),
   storyFindUnique: vi.fn(),
   activityCreate: vi.fn(),
+  memberFindUnique: vi.fn(),
   currentSession: vi.fn(),
 }));
 
@@ -64,11 +66,15 @@ vi.mock("@allbluecn/database", () => {
       findFirst: mocks.depFindFirst,
       findUnique: mocks.depFindUnique,
       create: mocks.depCreate,
+      createManyAndReturn: mocks.depCreateManyAndReturn,
       update: mocks.depUpdate,
       delete: mocks.depDelete,
     },
     story: { findMany: mocks.storyFindMany, findUnique: mocks.storyFindUnique },
     storyActivity: { create: mocks.activityCreate },
+    projectMember: { findUnique: mocks.memberFindUnique },
+    // 交互式事务：tx 即 prisma mock 本身
+    $transaction: async (arg: any) => (typeof arg === "function" ? arg(prisma) : Promise.all(arg)),
   };
   return { prisma, Prisma: {} };
 });
@@ -112,11 +118,24 @@ beforeEach(() => {
   mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
   // 默认 DB 无既有依赖边（handler 开头一次性取全边建邻接表，必须返回数组）
   mocks.depFindMany.mockResolvedValue([]);
+  // 批量建边（DB-01）：createManyAndReturn 按 (sourceId,targetId) 回带自增 id
+  mocks.depCreateManyAndReturn.mockImplementation(({ data }: any) =>
+    Promise.resolve(
+      (Array.isArray(data) ? data : [data]).map((row: any, i: number) => ({
+        id: `d-${row.sourceId}-${row.targetId}-${i}`,
+        sourceId: row.sourceId,
+        targetId: row.targetId,
+      })),
+    ),
+  );
   // 活动写入段：端点 label 查询 + create 返回（含 select 字段）
   mocks.storyFindMany.mockResolvedValue([
-    { id: "a", identifier: "A-1", name: "story a" },
-    { id: "b", identifier: "B-1", name: "story b" },
+    { id: "a", identifier: "A-1", name: "story a", projectId: "p1" },
+    { id: "b", identifier: "B-1", name: "story b", projectId: "p1" },
+    { id: "c", identifier: "C-1", name: "story c", projectId: "p1" },
   ]);
+  // 默认 u1 是 p1 的有效成员（SEC-03 口径：suspended 视同无权）
+  mocks.memberFindUnique.mockResolvedValue({ status: "active" });
   mocks.activityCreate.mockImplementation(({ data }: any) =>
     Promise.resolve({
       id: `act-${data.storyId}`,
@@ -139,54 +158,47 @@ describe("addDependenciesFn", () => {
     });
     expect(res.created).toHaveLength(0);
     expect(res.failed[0].targetId).toBe("a");
-    expect(mocks.depCreate).not.toHaveBeenCalled();
+    expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
   });
 
-  it("pair 级判重：同 pair 任意方向任意类型已存在则拒绝", async () => {
-    mocks.depFindFirst.mockResolvedValue({ id: "d0" }); // 命中已有边
+  it("pair 级判重：同 pair 任意方向任意类型已存在则拒绝（DB-01：复用取全边集合，0 次额外 findFirst）", async () => {
+    // 既有反向边 b -> a，请求正向 a -> b：归一化无向键命中 → DUPLICATED
+    mocks.depFindMany.mockResolvedValue([{ sourceId: "b", targetId: "a" }]);
     const res = await addDependenciesFn({
       data: {
         items: [
-          { sourceId: "a", targetId: "b", type: "STARTS_BEFORE" }, // 正向查 (a,b,*)
+          { sourceId: "a", targetId: "b", type: "STARTS_BEFORE" }, // 正向，反向边已存在
         ],
       },
     });
     expect(res.failed[0].targetId).toBe("b");
-    expect(mocks.depCreate).not.toHaveBeenCalled();
-    // 守住双向查询：实现退化为单方向（漏掉反向 OR）时本断言必须失败
-    expect(mocks.depFindFirst).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: expect.objectContaining({
-          OR: expect.arrayContaining([
-            { sourceId: "a", targetId: "b" },
-            { sourceId: "b", targetId: "a" },
-          ]),
-        }),
-      }),
-    );
+    expect(res.failed[0].reason).toBe("DUPLICATED");
+    expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
+    // 判重完全来自取全边预取（select 白名单形状不变），无逐边 findFirst
+    expect(mocks.depFindMany).toHaveBeenCalledTimes(1);
+    expect(mocks.depFindMany).toHaveBeenCalledWith({
+      select: { sourceId: true, targetId: true },
+    });
+    expect(mocks.depFindFirst).not.toHaveBeenCalled();
   });
 
-  it("循环依赖拒绝：target 可达 source（跨类型混合环）", async () => {
-    mocks.depFindFirst.mockResolvedValue(null); // 无重复
-    // 图：b -> a 已存在（b BLOCKS a）；插入 a -> b 成环
-    // handler 开头一次性取全边，返回全图唯一一条边
-    mocks.depFindMany.mockResolvedValue([{ sourceId: "b", targetId: "a" }]);
+  it("循环依赖拒绝：target 可达 source（两跳路径，非直接边）", async () => {
+    // 图：a -> x -> b 已存在；插入 b -> a 成环（pair (b,a) 无直接边，查重不拦截，环检测拦截）
+    mocks.depFindMany.mockResolvedValue([
+      { sourceId: "a", targetId: "x" },
+      { sourceId: "x", targetId: "b" },
+    ]);
     const res = await addDependenciesFn({
-      data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKS" }] },
+      data: { items: [{ sourceId: "b", targetId: "a", type: "BLOCKS" }] },
     });
-    expect(res.failed[0].targetId).toBe("b");
-    expect(mocks.depCreate).not.toHaveBeenCalled();
+    expect(res.failed[0].targetId).toBe("a");
+    expect(res.failed[0].reason).toBe("CYCLE");
+    expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
   });
 
-  it("批内互指环：第二条被逐条拦截", async () => {
-    mocks.depFindFirst.mockResolvedValue(null);
-    mocks.depFindMany.mockResolvedValue([]);
-    mocks.depCreate.mockImplementation(({ data }: any) =>
-      Promise.resolve({ id: `d-${data.sourceId}-${data.targetId}`, ...data }),
-    );
-    // 第一条插入 a->b 后，第二条 b->a 的环检测需看到它：
-    // 实现必须把本批已插入边并入检测图（depFindMany 之后的内存集合）
-    // 这里 mock depFindMany 每次返回空（DB 无边），实现需自维护本批边
+  it("批内互指环：第二条被逐条拦截（本批边并入检测图 + 查重集合）", async () => {
+    // DB 无既有边；第一条 a->b 插入后，第二条 b->a 须命中批内查重集合（DUPLICATED，
+    // 与原「插入后 findFirst 可见」语义一致）
     const res = await addDependenciesFn({
       data: {
         items: [
@@ -197,27 +209,43 @@ describe("addDependenciesFn", () => {
     });
     expect(res.created).toHaveLength(1);
     expect(res.failed[0].targetId).toBe("a");
+    expect(res.failed[0].reason).toBe("DUPLICATED");
   });
 
-  it("合法边创建成功", async () => {
-    mocks.depFindFirst.mockResolvedValue(null);
-    mocks.depFindMany.mockResolvedValue([]);
-    mocks.depCreate.mockResolvedValue({ id: "d1" });
+  it("合法边批量创建成功：一次 createManyAndReturn 替代 N 次 create（DB-01 契约）", async () => {
     const res = await addDependenciesFn({
-      data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKS" }] },
+      data: {
+        items: [
+          { sourceId: "a", targetId: "b", type: "BLOCKS" },
+          { sourceId: "a", targetId: "c", type: "BLOCKS" },
+        ],
+      },
     });
-    expect(res.created).toHaveLength(1);
-    expect(mocks.depCreate).toHaveBeenCalledOnce();
+    expect(res.created).toHaveLength(2);
+    // 批量形状契约：单次 createManyAndReturn + data 数组（含 type），在 $transaction 内
+    expect(mocks.depCreateManyAndReturn).toHaveBeenCalledTimes(1);
+    expect(mocks.depCreateManyAndReturn).toHaveBeenCalledWith({
+      data: [
+        { sourceId: "a", targetId: "b", type: "BLOCKS" },
+        { sourceId: "a", targetId: "c", type: "BLOCKS" },
+      ],
+      select: { id: true, sourceId: true, targetId: true },
+    });
+    expect(mocks.depCreate).not.toHaveBeenCalled();
     // 性能契约：环检测的图只查一次（取全边），且不带任何 where 过滤
     expect(mocks.depFindMany).toHaveBeenCalledTimes(1);
     expect(mocks.depFindMany).toHaveBeenCalledWith({
       select: { sourceId: true, targetId: true },
     });
+    // created 按 items 输入序回带（经 sourceId|targetId 映射，不依赖返回行顺序）
+    expect(res.created).toEqual(["d-a-b-0", "d-a-c-1"]);
     // 活动契约：依赖两端各记一条「添加依赖关系」，newValue 为对方描述
-    expect(res.activities).toHaveLength(2);
+    expect(res.activities).toHaveLength(4);
     expect(res.activities.map((x) => [x.storyId, x.newValue]).sort()).toEqual([
       ["a", "B-1 story b"],
+      ["a", "C-1 story c"],
       ["b", "A-1 story a"],
+      ["c", "A-1 story a"],
     ]);
   });
 
@@ -227,7 +255,24 @@ describe("addDependenciesFn", () => {
         data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKED_BY" as any }] },
       }),
     ).rejects.toThrow();
-    expect(mocks.depCreate).not.toHaveBeenCalled();
+    expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
+  });
+
+  it("SEC-03：端点混入非成员项目 story 时整批拒绝、零建边", async () => {
+    // 端点 a 在 p1（成员）、c 在 p_foreign（非成员）→ 整批拒绝
+    mocks.storyFindMany.mockResolvedValue([
+      { id: "a", projectId: "p1" },
+      { id: "c", projectId: "p_foreign" },
+    ]);
+    mocks.memberFindUnique.mockImplementation(async (args: any) =>
+      args.where.projectId_userId.projectId === "p1" ? { status: "active" } : null,
+    );
+    await expect(
+      addDependenciesFn({
+        data: { items: [{ sourceId: "a", targetId: "c", type: "BLOCKS" }] },
+      }),
+    ).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
   });
 });
 

package/src/server/serverFns/story/__tests__/story-search.test.ts

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// searchStoriesFn 的 projectId scope 参数（R11 裁决）回归测试：
+// 不传保持既有行为（用户独立项目），传成员项目按该项目搜索。
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+        return wrapped;
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => ({}),
+}));
+
+const mocks = vi.hoisted(() => ({
+  currentSession: vi.fn(),
+  getPrisma: vi.fn(),
+  storyFindMany: vi.fn(),
+  storyUpdateMany: vi.fn(),
+  memberFindMany: vi.fn(),
+  transaction: vi.fn(),
+  ensureBuiltinIndependentProject: vi.fn(),
+  resolveStoryScopeProjectId: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: mocks.getPrisma,
+}));
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.currentSession,
+}));
+
+vi.mock("@/server/builtin-project", () => ({
+  ensureBuiltinIndependentProject: mocks.ensureBuiltinIndependentProject,
+  resolveStoryScopeProjectId: mocks.resolveStoryScopeProjectId,
+}));
+
+import { searchStoriesFn, reorderStoriesFn } from "../story-search";
+
+const SESSION = { user: { id: "u1" } };
+const INDEPENDENT_PROJECT_ID = "p_independent";
+const TEAM_PROJECT_ID = "p_team";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue(SESSION);
+  mocks.getPrisma.mockResolvedValue({
+    story: { findMany: mocks.storyFindMany, updateMany: mocks.storyUpdateMany },
+    projectMember: { findMany: mocks.memberFindMany },
+    $transaction: mocks.transaction,
+  });
+  mocks.ensureBuiltinIndependentProject.mockResolvedValue(INDEPENDENT_PROJECT_ID);
+  // 与真实实现同语义：成员 → 原 projectId；非成员/无效 → 回退独立项目
+  mocks.resolveStoryScopeProjectId.mockImplementation(
+    async (projectId: string | undefined, _userId: string) =>
+      projectId === TEAM_PROJECT_ID ? TEAM_PROJECT_ID : INDEPENDENT_PROJECT_ID,
+  );
+  mocks.storyFindMany.mockResolvedValue([
+    { id: "s1", name: "修复登录页", identifier: "TEAM-1" },
+  ]);
+  // reorderStoriesFn（SEC-03）：默认 USER 是 p_team 有效成员
+  mocks.memberFindMany.mockResolvedValue([{ projectId: TEAM_PROJECT_ID }]);
+  mocks.storyUpdateMany.mockResolvedValue({ count: 1 });
+  mocks.transaction.mockImplementation(async (arg: unknown) =>
+    Array.isArray(arg) ? Promise.all(arg) : Promise.resolve(undefined),
+  );
+});
+
+describe("searchStoriesFn projectId scope（R11）", () => {
+  it("不传 projectId：保持既有行为，搜索用户独立项目（向后兼容）", async () => {
+    const rows = await searchStoriesFn({ data: { query: "登录" } });
+    expect(mocks.ensureBuiltinIndependentProject).toHaveBeenCalledWith("u1");
+    expect(mocks.resolveStoryScopeProjectId).not.toHaveBeenCalled();
+    expect(mocks.storyFindMany.mock.calls[0][0].where.projectId).toBe(INDEPENDENT_PROJECT_ID);
+    expect(rows).toEqual([{ id: "s1", title: "修复登录页", identifier: "TEAM-1" }]);
+  });
+
+  it("传成员项目 projectId：按该项目 scope 搜索（BUG 关联选择器场景）", async () => {
+    await searchStoriesFn({ data: { query: "登录", projectId: TEAM_PROJECT_ID } });
+    expect(mocks.resolveStoryScopeProjectId).toHaveBeenCalledWith(TEAM_PROJECT_ID, "u1");
+    const args = mocks.storyFindMany.mock.calls[0][0];
+    expect(args.where.projectId).toBe(TEAM_PROJECT_ID);
+  });
+
+  it("传非成员 projectId：服务端 scope 解析回退独立项目，越权搜索不生效", async () => {
+    await searchStoriesFn({ data: { query: "登录", projectId: "p_not_member" } });
+    const args = mocks.storyFindMany.mock.calls[0][0];
+    expect(args.where.projectId).toBe(INDEPENDENT_PROJECT_ID);
+  });
+
+  it("excludeIds 透传到 where.id.notIn（当前已关联需求不重复出现在候选）", async () => {
+    await searchStoriesFn({ data: { query: "登录", projectId: TEAM_PROJECT_ID, excludeIds: ["s9"] } });
+    expect(mocks.storyFindMany.mock.calls[0][0].where.id).toEqual({ notIn: ["s9"] });
+  });
+});
+
+describe("reorderStoriesFn（SEC-03 可见性过滤）", () => {
+  it("成员正常排序：updateMany where 带可访问项目过滤", async () => {
+    await reorderStoriesFn({ data: { items: [{ id: "s1", boardOrder: 5 }] } });
+    expect(mocks.storyUpdateMany).toHaveBeenCalledWith({
+      where: { id: "s1", projectId: { in: [TEAM_PROJECT_ID] } },
+      data: { boardOrder: 5 },
+    });
+  });
+
+  it("SEC-03：混入非成员项目 id 时被可见性 where 过滤（静默跳过，不中断整批）", async () => {
+    await reorderStoriesFn({
+      data: { items: [{ id: "mine", boardOrder: 1 }, { id: "foreign", boardOrder: 2 }] },
+    });
+    const calls = mocks.storyUpdateMany.mock.calls.map((c: any[]) => c[0].where.id);
+    expect(calls).toEqual(["mine", "foreign"]);
+    for (const call of mocks.storyUpdateMany.mock.calls) {
+      expect(call[0].where.projectId).toEqual({ in: [TEAM_PROJECT_ID] });
+    }
+  });
+
+  it("SEC-03：非任何项目成员（空可访问集合）时 where.projectId.in 为空数组，零更新", async () => {
+    mocks.memberFindMany.mockResolvedValue([]);
+    await reorderStoriesFn({ data: { items: [{ id: "s1", boardOrder: 1 }] } });
+    expect(mocks.storyUpdateMany).toHaveBeenCalledWith({
+      where: { id: "s1", projectId: { in: [] } },
+      data: { boardOrder: 1 },
+    });
+  });
+
+  it("未登录拒绝且不查询成员关系", async () => {
+    mocks.currentSession.mockRejectedValue(new Error("unauthorized"));
+    await expect(
+      reorderStoriesFn({ data: { items: [{ id: "s1", boardOrder: 1 }] } }),
+    ).rejects.toThrow("unauthorized");
+    expect(mocks.memberFindMany).not.toHaveBeenCalled();
+    expect(mocks.storyUpdateMany).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/story/__tests__/story-transfer.test.ts

@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// story-transfer 鉴权覆盖（SEC-03）：转移双 handler 的非成员拒绝 +
+// listProjectStoriesFn 的 scope 解析（显式 projectId 回退 / 「全部项目」分支可访问集合过滤）。
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+        return wrapped;
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => ({}),
+}));
+
+const mocks = vi.hoisted(() => ({
+  storyFindUnique: vi.fn(),
+  storyFindMany: vi.fn(),
+  storyUpdate: vi.fn(),
+  projectFindUnique: vi.fn(),
+  sequenceCounterUpsert: vi.fn(),
+  activityCreate: vi.fn(),
+  memberFindUnique: vi.fn(),
+  memberFindMany: vi.fn(),
+  currentSession: vi.fn(),
+  resolveStoryScopeProjectId: vi.fn(),
+  ensureBuiltinIndependentProject: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
+    story: {
+      findUnique: mocks.storyFindUnique,
+      findMany: mocks.storyFindMany,
+      update: mocks.storyUpdate,
+    },
+    project: { findUnique: mocks.projectFindUnique },
+    sequenceCounter: { upsert: mocks.sequenceCounterUpsert },
+    storyActivity: { create: mocks.activityCreate },
+    projectMember: {
+      findUnique: mocks.memberFindUnique,
+      findMany: mocks.memberFindMany,
+    },
+    // $transaction(fn) 直接以 prisma 本身作为 tx 执行（tx.* 调用落到同一组 mock 上）
+    $transaction: (cb: any) => cb(prisma),
+  };
+  return { prisma, Prisma: {} };
+});
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.currentSession,
+}));
+
+vi.mock("@/server/builtin-project", () => ({
+  resolveStoryScopeProjectId: mocks.resolveStoryScopeProjectId,
+  ensureBuiltinIndependentProject: mocks.ensureBuiltinIndependentProject,
+}));
+
+import {
+  transferStoryToProjectFn,
+  transferStoryAsChildFn,
+  listProjectStoriesFn,
+} from "../story-transfer";
+
+const USER = "u-1";
+const P_SRC = "p-src";
+const P_OTHER = "p-other";
+const P_TARGET = "p-target";
+const INDEPENDENT = "p-independent";
+
+const storyRow = (over: Record<string, unknown> = {}) => ({
+  id: "st-1",
+  identifier: "SRC-1",
+  sequenceId: 1,
+  name: "需求甲",
+  description: null,
+  state: "backlog",
+  priority: "none",
+  archived: false,
+  startDate: null,
+  targetDate: null,
+  boardOrder: 0,
+  projectId: P_SRC,
+  parentId: null,
+  parent: null,
+  assignee: null,
+  createdBy: { id: "u-creator", username: "creator", email: "e", avatarConfig: null, bgShape: null, bgColor: null },
+  updatedBy: null,
+  labels: [],
+  createdAt: new Date("2026-01-01T00:00:00Z"),
+  updatedAt: new Date("2026-01-02T00:00:00Z"),
+  ...over,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue({ user: { id: USER } });
+  // 成员关系默认：USER 属于 p-src，其余项目非成员
+  mocks.memberFindUnique.mockImplementation(async (args: any) =>
+    args.where.projectId_userId.projectId === P_SRC ? { status: "active" } : null,
+  );
+  mocks.memberFindMany.mockResolvedValue([{ projectId: P_SRC }]);
+  mocks.resolveStoryScopeProjectId.mockImplementation(
+    async (projectId: string | undefined) =>
+      projectId === P_SRC ? P_SRC : INDEPENDENT,
+  );
+  mocks.ensureBuiltinIndependentProject.mockResolvedValue(INDEPENDENT);
+  mocks.storyFindMany.mockResolvedValue([]);
+  mocks.activityCreate.mockResolvedValue({});
+});
+
+describe("transferStoryToProjectFn", () => {
+  it("成员在两个所属项目间转移：更新 projectId 并写转移活动", async () => {
+    mocks.memberFindUnique.mockResolvedValue({ status: "active" }); // 双项目均成员
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    mocks.projectFindUnique.mockResolvedValue({ id: P_TARGET, name: "目标项目", displayId: "TGT" });
+    mocks.sequenceCounterUpsert.mockResolvedValue({ scope: P_TARGET, seq: 3 });
+    mocks.storyUpdate.mockResolvedValue(storyRow({ projectId: P_TARGET, identifier: "TGT-3" }));
+
+    const res = await transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_TARGET } });
+
+    expect(mocks.storyUpdate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: "st-1" },
+        data: expect.objectContaining({ projectId: P_TARGET }),
+      }),
+    );
+    expect(res.projectId).toBe(P_TARGET);
+  });
+
+  it("SEC-03：对目标项目非成员时拒绝且零写入", async () => {
+    // 源项目 p-src 成员（默认 mock），目标 p-target 非成员
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    await expect(
+      transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_TARGET } }),
+    ).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.storyUpdate).not.toHaveBeenCalled();
+    expect(mocks.sequenceCounterUpsert).not.toHaveBeenCalled();
+  });
+
+  it("SEC-03：对源项目非成员时拒绝且零写入（防移走他人需求）", async () => {
+    mocks.memberFindUnique.mockResolvedValue(null); // 任何项目都非成员
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    await expect(
+      transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_OTHER } }),
+    ).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.storyUpdate).not.toHaveBeenCalled();
+  });
+
+  it("需求不存在时快速失败", async () => {
+    mocks.storyFindUnique.mockResolvedValue(null);
+    await expect(
+      transferStoryToProjectFn({ data: { storyId: "missing", targetProjectId: P_TARGET } }),
+    ).rejects.toThrow("需求不存在");
+    expect(mocks.storyUpdate).not.toHaveBeenCalled();
+  });
+});
+
+describe("transferStoryAsChildFn", () => {
+  const parentRow = (over: Record<string, unknown> = {}) => ({
+    id: "st-parent",
+    identifier: "PAR-1",
+    name: "父需求",
+    projectId: P_TARGET,
+    parentId: null,
+    ...over,
+  });
+
+  it("SEC-03：子需求现属项目非成员时拒绝且零写入", async () => {
+    mocks.storyFindUnique.mockImplementation(async (args: any) => {
+      if (args.where?.id === "st-1") return storyRow(); // 子需求属 p-src（USER 非成员场景由下方 mock 控制）
+      if (args.where?.id === "st-parent") return parentRow();
+      return null;
+    });
+    mocks.memberFindUnique.mockResolvedValue(null); // 任何项目都非成员
+    await expect(
+      transferStoryAsChildFn({ data: { storyId: "st-1", parentStoryId: "st-parent" } }),
+    ).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.storyUpdate).not.toHaveBeenCalled();
+  });
+
+  it("SEC-03：目标父需求项目非成员时拒绝且零写入", async () => {
+    mocks.storyFindUnique.mockImplementation(async (args: any) => {
+      if (args.where?.id === "st-1") return storyRow(); // 属 p-src（成员）
+      if (args.where?.id === "st-parent") return parentRow(); // 属 p-target（非成员）
+      return null;
+    });
+    mocks.projectFindUnique.mockResolvedValue({ id: P_SRC, displayId: "PRJ" });
+    await expect(
+      transferStoryAsChildFn({ data: { storyId: "st-1", parentStoryId: "st-parent" } }),
+    ).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.storyUpdate).not.toHaveBeenCalled();
+  });
+});
+
+describe("listProjectStoriesFn（读 scope，SEC-03）", () => {
+  it("SEC-03：传非成员 projectId 时静默回退独立项目（不泄露他人项目需求）", async () => {
+    await listProjectStoriesFn({ data: { projectId: P_OTHER, mode: "parent" } });
+    expect(mocks.resolveStoryScopeProjectId).toHaveBeenCalledWith(P_OTHER, USER);
+    expect(mocks.storyFindMany.mock.calls[0][0].where.projectId).toBe(INDEPENDENT);
+  });
+
+  it("SEC-03：不传 projectId（「全部项目」选择器）时仅查用户为有效成员的项目集合", async () => {
+    await listProjectStoriesFn({ data: { mode: "dependency" } });
+    expect(mocks.resolveStoryScopeProjectId).not.toHaveBeenCalled();
+    expect(mocks.memberFindMany).toHaveBeenCalledWith({
+      where: { userId: USER, status: { not: "suspended" } },
+      select: { projectId: true },
+    });
+    expect(mocks.storyFindMany.mock.calls[0][0].where.projectId).toEqual({ in: [P_SRC] });
+  });
+
+  it("SEC-03：零可访问项目（「全部项目」分支）时 where.projectId.in 为空数组，不返回任何行", async () => {
+    mocks.memberFindMany.mockResolvedValue([]);
+    await listProjectStoriesFn({ data: { mode: "dependency" } });
+    expect(mocks.storyFindMany.mock.calls[0][0].where.projectId).toEqual({ in: [] });
+  });
+});

package/src/server/serverFns/story/index.ts

@@ -104,10 +104,10 @@ export {
 } from "./story-attachments";
 
 export {
-  linkPrdFn,
-  unlinkPrdFn,
-  getLinkedPrdsFn,
-  searchPrdsFn,
+  linkDesignFn,
+  unlinkDesignFn,
+  getLinkedDesignsFn,
+  searchDesignsFn,
   listStoryAvailableKbsFn,
   searchKbDocsFn,
   linkDocsFn,