@allbluecn/web-app 0.17.2 → 0.18.1

package/src/server/serverFns/__tests__/team-ownership-merge.test.ts

@@ -0,0 +1,307 @@
+// DB-03 任务 3.4：team.ts ×7 邀请/加入请求属主校验单查询化锁定测试。
+// 行为等价红线：错误文案（不存在 vs 状态机拒绝）逐字段保持；
+// 新行为 = 单次 findFirst({ where: { id, ownerId } }) 完成存在性+属主判定（findUnique 不再触达）。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data);
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn();
+  return {
+    requireAuth: f(),
+    requireTeamSeats: f(),
+    auditLog: f(),
+    sendTemplateEmail: f(),
+    user: { findUnique: f() },
+    teamInvitation: {
+      findUnique: f(), findFirst: f(), create: f(), update: f(),
+      updateMany: f(), findMany: f(), delete: f(), deleteMany: f(),
+    },
+    teamMembership: { findUnique: f(), findFirst: f(), create: f(), delete: f() },
+    teamJoinRequest: {
+      findUnique: f(), findFirst: f(), upsert: f(), update: f(),
+      updateMany: f(), findMany: f(), delete: f(),
+    },
+    projectMember: { deleteMany: f() },
+    $transaction: f(),
+  };
+});
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    user: M.user,
+    teamInvitation: M.teamInvitation,
+    teamMembership: M.teamMembership,
+    teamJoinRequest: M.teamJoinRequest,
+    projectMember: M.projectMember,
+    $transaction: M.$transaction,
+  },
+}));
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+vi.mock("@/server/resources", () => ({ requireTeamSeats: M.requireTeamSeats }));
+vi.mock("@/server/audit", () => ({ auditLog: M.auditLog }));
+vi.mock("@/server/email", () => ({ sendTemplateEmail: M.sendTemplateEmail }));
+
+import {
+  revokeTeamInvitationFn,
+  resendTeamInvitationFn,
+  approveTeamJoinRequestFn,
+  rejectTeamJoinRequestFn,
+  deleteTeamInvitationFn,
+  deleteTeamJoinRequestFn,
+  approveTeamInvitationFn,
+} from "../team";
+
+const OWNER = "owner1";
+const FUTURE = new Date(Date.now() + 60_000);
+const PAST = new Date(Date.now() - 60_000);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: OWNER } });
+  M.requireTeamSeats.mockResolvedValue(undefined);
+  M.sendTemplateEmail.mockResolvedValue({ sent: true });
+  M.$transaction.mockImplementation(async (fn: any) => {
+    const tx = {
+      teamMembership: { create: vi.fn().mockResolvedValue({ id: "m1" }) },
+      teamInvitation: { update: vi.fn().mockResolvedValue({}) },
+      teamJoinRequest: { update: vi.fn().mockResolvedValue({}) },
+    };
+    await fn(tx);
+    return tx;
+  });
+});
+
+describe("revokeTeamInvitationFn（单查询属主化）", () => {
+  it("自己的 pending 邀请：findFirst({id,ownerId}) 命中后置 revoked；findUnique 不触达", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "pending", channel: "email",
+    });
+
+    const res = await revokeTeamInvitationFn({ data: { invitationId: "inv1" } });
+
+    expect(M.teamInvitation.findFirst).toHaveBeenCalledWith({ where: { id: "inv1", ownerId: OWNER } });
+    expect(M.teamInvitation.findUnique).not.toHaveBeenCalled();
+    expect(M.teamInvitation.update).toHaveBeenCalledWith({ where: { id: "inv1" }, data: { status: "revoked" } });
+    expect(res.success).toBe(true);
+  });
+
+  it("link 渠道撤销同时失效 pending 加入申请", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv2", ownerId: OWNER, status: "pending", channel: "link",
+    });
+
+    await revokeTeamInvitationFn({ data: { invitationId: "inv2" } });
+
+    expect(M.teamJoinRequest.updateMany).toHaveBeenCalledWith({
+      where: { invitationId: "inv2", status: "pending" },
+      data: { status: "invalidated", processedAt: expect.any(Date) },
+    });
+  });
+
+  it("不存在或他人邀请统一「邀请不存在」（文案等价）", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue(null);
+    await expect(revokeTeamInvitationFn({ data: { invitationId: "x" } })).rejects.toThrow("邀请不存在");
+  });
+
+  it("非 pending 状态拒绝撤销（状态机文案等价）", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv3", ownerId: OWNER, status: "accepted", channel: "email",
+    });
+    await expect(revokeTeamInvitationFn({ data: { invitationId: "inv3" } })).rejects.toThrow(
+      "仅待处理/待批准邀请可撤销",
+    );
+  });
+});
+
+describe("resendTeamInvitationFn（单查询属主化）", () => {
+  it("pending 邀请重发：换 token 重置过期时间", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "pending", channel: "email", email: "a@x.com", seatType: "member",
+    });
+
+    const res = await resendTeamInvitationFn({ data: { invitationId: "inv1" } });
+
+    expect(M.teamInvitation.findFirst).toHaveBeenCalledWith({ where: { id: "inv1", ownerId: OWNER } });
+    expect(M.teamInvitation.findUnique).not.toHaveBeenCalled();
+    expect(M.teamInvitation.update).toHaveBeenCalledWith({
+      where: { id: "inv1" },
+      data: { token: expect.any(String), status: "pending", expiresAt: expect.any(Date) },
+    });
+    expect(res.success).toBe(true);
+  });
+
+  it("accepted 邀请拒绝重发", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "accepted", channel: "email", email: "a@x.com", seatType: "member",
+    });
+    await expect(resendTeamInvitationFn({ data: { invitationId: "inv1" } })).rejects.toThrow(
+      "仅待处理/已过期邀请可重发",
+    );
+  });
+});
+
+describe("approveTeamJoinRequestFn（单查询属主化）", () => {
+  it("申请+邀请关系经单次 findFirst include 取回；findUnique 不触达", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue({
+      id: "jr1", ownerId: OWNER, status: "pending", userId: "u9", email: "u9@x.com",
+      invitation: { id: "inv1", status: "pending", channel: "link", expiresAt: FUTURE },
+    });
+
+    const res = await approveTeamJoinRequestFn({ data: { requestId: "jr1", seatType: "member" } });
+
+    expect(M.teamJoinRequest.findFirst).toHaveBeenCalledWith({
+      where: { id: "jr1", ownerId: OWNER },
+      include: { invitation: { select: { id: true, status: true, channel: true, expiresAt: true } } },
+    });
+    expect(M.teamJoinRequest.findUnique).not.toHaveBeenCalled();
+    expect(res.success).toBe(true);
+  });
+
+  it("他人申请「申请不存在」", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue(null);
+    await expect(
+      approveTeamJoinRequestFn({ data: { requestId: "jrX", seatType: "member" } }),
+    ).rejects.toThrow("申请不存在");
+  });
+
+  it("邀请过期：申请置 invalidated 并拒绝批准（状态机等价）", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue({
+      id: "jr2", ownerId: OWNER, status: "pending", userId: "u9", email: "u9@x.com",
+      invitation: { id: "inv1", status: "pending", channel: "link", expiresAt: PAST },
+    });
+
+    await expect(
+      approveTeamJoinRequestFn({ data: { requestId: "jr2", seatType: "member" } }),
+    ).rejects.toThrow("邀请链接已过期或失效");
+    expect(M.teamJoinRequest.update).toHaveBeenCalledWith({
+      where: { id: "jr2" },
+      data: { status: "invalidated", processedAt: expect.any(Date) },
+    });
+  });
+});
+
+describe("rejectTeamJoinRequestFn（单查询属主化）", () => {
+  it("pending 申请置 rejected", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue({
+      id: "jr1", ownerId: OWNER, status: "pending", email: "a@x.com",
+    });
+
+    const res = await rejectTeamJoinRequestFn({ data: { requestId: "jr1" } });
+
+    expect(M.teamJoinRequest.findFirst).toHaveBeenCalledWith({ where: { id: "jr1", ownerId: OWNER } });
+    expect(M.teamJoinRequest.update).toHaveBeenCalledWith({
+      where: { id: "jr1" },
+      data: { status: "rejected", processedAt: expect.any(Date) },
+    });
+    expect(res.success).toBe(true);
+  });
+
+  it("非 pending 拒绝操作", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue({
+      id: "jr1", ownerId: OWNER, status: "approved", email: "a@x.com",
+    });
+    await expect(rejectTeamJoinRequestFn({ data: { requestId: "jr1" } })).rejects.toThrow("仅待审批申请可操作");
+  });
+});
+
+describe("deleteTeamInvitationFn（单查询属主化）", () => {
+  it("email 邀请可删", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, channel: "email", email: "x@y.com",
+    });
+
+    const res = await deleteTeamInvitationFn({ data: { invitationId: "inv1" } });
+
+    expect(M.teamInvitation.findFirst).toHaveBeenCalledWith({ where: { id: "inv1", ownerId: OWNER } });
+    expect(M.teamInvitation.delete).toHaveBeenCalledWith({ where: { id: "inv1" } });
+    expect(res.success).toBe(true);
+  });
+
+  it("link 渠道禁止单独删除", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv2", ownerId: OWNER, channel: "link", email: null,
+    });
+    await expect(deleteTeamInvitationFn({ data: { invitationId: "inv2" } })).rejects.toThrow("不可删除");
+  });
+});
+
+describe("deleteTeamJoinRequestFn（单查询属主化）", () => {
+  it("删除自己的申请记录", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue({
+      id: "jr1", ownerId: OWNER, email: "a@b.com", status: "rejected",
+    });
+
+    const res = await deleteTeamJoinRequestFn({ data: { requestId: "jr1" } });
+
+    expect(M.teamJoinRequest.findFirst).toHaveBeenCalledWith({ where: { id: "jr1", ownerId: OWNER } });
+    expect(M.teamJoinRequest.findUnique).not.toHaveBeenCalled();
+    expect(M.teamJoinRequest.delete).toHaveBeenCalledWith({ where: { id: "jr1" } });
+    expect(res.success).toBe(true);
+  });
+
+  it("不存在或他人申请「申请不存在」", async () => {
+    M.teamJoinRequest.findFirst.mockResolvedValue(null);
+    await expect(deleteTeamJoinRequestFn({ data: { requestId: "jrX" } })).rejects.toThrow("申请不存在");
+  });
+});
+
+describe("approveTeamInvitationFn（单查询属主化）", () => {
+  it("pending_approval email 邀请批准：事务内建 membership + 置 accepted", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "pending_approval", seatType: "member",
+      acceptedBy: "u2", token: "t1", channel: "email", email: "b@x.com",
+      applicantEmail: null, expiresAt: FUTURE,
+    });
+
+    const res = await approveTeamInvitationFn({ data: { invitationId: "inv1", seatType: "member" } });
+
+    expect(M.teamInvitation.findFirst).toHaveBeenCalledWith({ where: { id: "inv1", ownerId: OWNER } });
+    expect(M.teamInvitation.findUnique).not.toHaveBeenCalled();
+    expect(M.requireTeamSeats).toHaveBeenCalledWith(OWNER, "member", 1, { excludeInvitationId: "inv1" });
+    expect(res.success).toBe(true);
+  });
+
+  it("过期邀请拒绝批准（状态机等价）", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "pending_approval", seatType: "member",
+      acceptedBy: "u2", token: "t1", channel: "email", email: "b@x.com",
+      applicantEmail: null, expiresAt: PAST,
+    });
+    await expect(
+      approveTeamInvitationFn({ data: { invitationId: "inv1", seatType: "member" } }),
+    ).rejects.toThrow("邀请已过期，无法批准");
+  });
+
+  it("link 渠道申请引导走 approveTeamJoinRequestFn", async () => {
+    M.teamInvitation.findFirst.mockResolvedValue({
+      id: "inv1", ownerId: OWNER, status: "pending_approval", seatType: "member",
+      acceptedBy: "u2", token: "t1", channel: "link", email: null,
+      applicantEmail: null, expiresAt: FUTURE,
+    });
+    await expect(
+      approveTeamInvitationFn({ data: { invitationId: "inv1", seatType: "member" } }),
+    ).rejects.toThrow("approveTeamJoinRequestFn");
+  });
+});

package/src/server/serverFns/__tests__/workspace-kb.test.ts

@@ -52,6 +52,7 @@ const mocks = vi.hoisted(() => ({
   wqdDelete: vi.fn(),
   wqdAggregate: vi.fn(),
   wqdCreate: vi.fn(),
+  wqdCreateMany: vi.fn(),
   wqdFindFirst: vi.fn(),
   legalFindMany: vi.fn(),
   kbFindMany: vi.fn(),
@@ -73,6 +74,7 @@ vi.mock("@allbluecn/database", () => {
       delete: mocks.wqdDelete,
       aggregate: mocks.wqdAggregate,
       create: mocks.wqdCreate,
+      createMany: mocks.wqdCreateMany,
       findFirst: mocks.wqdFindFirst,
     },
     legalRegulation: { findMany: mocks.legalFindMany },
@@ -236,7 +238,7 @@ describe("addQuickDocsFn", () => {
     ).rejects.toThrow("二选一");
   });
 
-  it("文档不存在 → failed outOfScope；存在 → 创建且落到最短列末尾", async () => {
+  it("文档不存在 → failed outOfScope；存在 → 创建且落到最短列末尾（DB-01：in 预取 + createMany）", async () => {
     mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
     // 现有布局：col0 有 2 行（max sortOrder 1）、col1 有 1 行（max sortOrder 0）
     mocks.wqdFindMany.mockResolvedValue([
@@ -244,10 +246,9 @@ describe("addQuickDocsFn", () => {
       { columnIndex: 0, sortOrder: 1 },
       { columnIndex: 1, sortOrder: 0 },
     ]);
-    mocks.docFindFirst.mockResolvedValueOnce(null) // d1 不存在
-      .mockResolvedValueOnce({ id: "d2" }); // d2 存在
-    mocks.wqdFindFirst.mockResolvedValue(null); // 无重复
-    mocks.wqdCreate.mockImplementation(async (args: any) => ({ id: "new-" + args.data.docId }));
+    // 存在性改为一次 findMany in 预取（只有 d2 存在）
+    mocks.docFindMany.mockResolvedValue([{ id: "d2" }]);
+    mocks.wqdCreateMany.mockResolvedValue({ count: 1 });
     const res = await addQuickDocsFn({
       data: {
         workspaceId: "ws1",
@@ -259,16 +260,24 @@ describe("addQuickDocsFn", () => {
     });
     expect(res.failed).toEqual([{ key: "d1", reason: "outOfScope" }]);
     expect(res.created).toEqual(["d2"]);
-    // col2/3/4 为空列（0 行）比 col1（1 行）更短，新文档落到第一个空列 col2 末尾
-    expect(mocks.wqdCreate).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({ docId: "d2", columnIndex: 2, sortOrder: 0 }),
-      }),
-    );
+    // 批量形状契约：一次 in 查询预取存在性（全部 docId 参与）+ 一次 createMany（只含有效行，落到 col2）
+    expect(mocks.docFindMany).toHaveBeenCalledWith({
+      where: { id: { in: ["d1", "d2"] }, isDeleted: false },
+      select: { id: true },
+    });
+    expect(mocks.wqdCreateMany).toHaveBeenCalledTimes(1);
+    expect(mocks.wqdCreateMany).toHaveBeenCalledWith({
+      data: [
+        expect.objectContaining({ docId: "d2", workspaceId: "ws1", columnIndex: 2, sortOrder: 0, createdBy: "u1" }),
+      ],
+    });
+    expect(mocks.wqdCreate).not.toHaveBeenCalled();
+    expect(mocks.wqdFindFirst).not.toHaveBeenCalled();
   });
 
   it("summary 组外部条目拒绝（无实体表）", async () => {
     mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wqdFindMany.mockResolvedValue([]);
     const res = await addQuickDocsFn({
       data: { workspaceId: "ws1", items: [{ externalGroup: "summary", externalId: "s1", displayTitle: "周报" }] },
     });

package/src/server/serverFns/activity.ts

@@ -70,8 +70,8 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
       dateMap.set(key, 0)
     }
 
-    const [prds, comments, loginLogs, chatThreads, designProjects, knowledgeDocs] = await Promise.all([
-      prisma.pRD.findMany({
+    const [prds, comments, loginLogs, chatThreads, knowledgeDocs] = await Promise.all([
+      prisma.design.findMany({
         where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
         select: { createdAt: true },
       }),
@@ -87,10 +87,6 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
         where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
         select: { createdAt: true },
       }),
-      prisma.designProject.findMany({
-        where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
-        select: { createdAt: true },
-      }),
       prisma.knowledgeDocument.findMany({
         where: { createdBy: userId, createdAt: { gte: rangeStart, lte: todayStart } },
         select: { createdAt: true },
@@ -102,7 +98,6 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
       ...comments.map((r) => r.createdAt),
       ...loginLogs.map((r) => r.createdAt),
       ...chatThreads.map((r) => r.createdAt),
-      ...designProjects.map((r) => r.createdAt),
       ...knowledgeDocs.map((r) => r.createdAt),
     ]
 

package/src/server/serverFns/agents/agent-crud.ts

@@ -198,19 +198,16 @@ export const updateAgentFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const userId = await requireSessionUser(request)
 
-    const existing = await prisma.userAgent.findFirst({
+    // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
+    const update = buildAgentUpdatePayload(data)
+    const res = await prisma.userAgent.updateMany({
       where: { id: data.id, userId },
+      data: update,
     })
-    if (!existing) {
+    if (res.count === 0) {
       throw new Error("无权限修改此 Agent")
     }
 
-    const update = buildAgentUpdatePayload(data)
-    await prisma.userAgent.update({
-      where: { id: data.id },
-      data: update,
-    })
-
     return { success: true }
   })
 
@@ -223,17 +220,14 @@ export const deleteAgentFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const userId = await requireSessionUser(request)
 
-    const existing = await prisma.userAgent.findFirst({
+    // DB-03：属主校验合并进写入（updateMany 计数判定）
+    const res = await prisma.userAgent.updateMany({
       where: { id: data.id, userId },
+      data: { isDeleted: true },
     })
-    if (!existing) {
+    if (res.count === 0) {
       throw new Error("无权限删除此 Agent")
     }
 
-    await prisma.userAgent.update({
-      where: { id: data.id },
-      data: { isDeleted: true },
-    })
-
     return { success: true }
   })

package/src/server/serverFns/agents/skill-crud.ts

@@ -152,19 +152,16 @@ export const updateSkillFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const userId = await requireSessionUser(request)
 
-    const existing = await prisma.userSkill.findFirst({
+    // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
+    const update = buildSkillUpdatePayload(data)
+    const res = await prisma.userSkill.updateMany({
       where: { id: data.id, userId },
+      data: update,
     })
-    if (!existing) {
+    if (res.count === 0) {
       throw new Error("无权限修改此 Skill")
     }
 
-    const update = buildSkillUpdatePayload(data)
-    await prisma.userSkill.update({
-      where: { id: data.id },
-      data: update,
-    })
-
     return { success: true }
   })
 
@@ -177,17 +174,14 @@ export const deleteSkillFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const userId = await requireSessionUser(request)
 
-    const existing = await prisma.userSkill.findFirst({
+    // DB-03：属主校验合并进写入（updateMany 计数判定）
+    const res = await prisma.userSkill.updateMany({
       where: { id: data.id, userId },
+      data: { isDeleted: true },
     })
-    if (!existing) {
+    if (res.count === 0) {
       throw new Error("无权限删除此 Skill")
     }
 
-    await prisma.userSkill.update({
-      where: { id: data.id },
-      data: { isDeleted: true },
-    })
-
     return { success: true }
   })

package/src/server/serverFns/anyhub/index.ts

@@ -26,9 +26,28 @@ export const listAnyHubAppsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    // DB-05：白名单 select（消费方 AnyHubAppData 覆盖全部标量列，防未来新增敏感列外泄）
     return prisma.anyHubApp.findMany({
       where: { userId: session.user!.id! },
       orderBy: { createdAt: 'desc' },
+      select: {
+        id: true,
+        name: true,
+        displayName: true,
+        description: true,
+        version: true,
+        source: true,
+        url: true,
+        localPath: true,
+        proxyBasePath: true,
+        iconUrl: true,
+        pinned: true,
+        status: true,
+        userId: true,
+        githubUrl: true,
+        createdAt: true,
+        updatedAt: true,
+      },
     })
   })
 

package/src/server/serverFns/anyhub/install.ts

@@ -19,7 +19,9 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
+import path from 'node:path'
 import { requireAuth } from '@/server/auth-helpers'
+import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
 const installSchema = z.object({
   source: z.enum(['marketplace', 'github', 'local']),
@@ -42,6 +44,17 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
     if (data.source === 'github' && !data.githubUrl) throw new Error('缺少 githubUrl')
     if (data.source === 'local' && !data.localPath) throw new Error('缺少 localPath')
 
+    // SEC-02/SEC-11：local source 严格白名单——拒绝任意 localPath 入库，
+    // 仅允许管理员预置根（ANYHUB_ALLOWED_LOCAL_ROOTS / anyhub 基目录）内的
+    // 路径，且入库前 resolve 归一（防 `../` 穿越与符号链接逃逸）。
+    let resolvedLocalPath: string | undefined
+    if (data.source === 'local') {
+      if (!isLocalPathAllowed(data.localPath!)) {
+        throw new Error('localPath 不在允许的本地目录白名单内（ANYHUB_ALLOWED_LOCAL_ROOTS）')
+      }
+      resolvedLocalPath = path.resolve(data.localPath!)
+    }
+
     return prisma.anyHubApp.create({
       data: {
         name: data.name ?? `app-${Date.now()}`,
@@ -50,7 +63,7 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
         source: data.source,
         marketplaceAppId: data.source === 'marketplace' ? data.marketplaceAppId : undefined,
         githubUrl: data.source === 'github' ? data.githubUrl : undefined,
-        localPath: data.source === 'local' ? data.localPath : undefined,
+        localPath: resolvedLocalPath,
         userId: session.user!.id!,
         status: 'installing',
       },

package/src/server/serverFns/anyhub/proxy.ts

@@ -21,8 +21,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { ProxyAdapter } from '@/lib/anyhub/proxy'
-
-const proxy = new ProxyAdapter()
+import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
 const serveFileSchema = z.object({
   appId: z.string(),
@@ -41,5 +40,8 @@ export const serveAnyHubFileFn = createServerFn({ method: 'POST' })
     })
     if (!app) throw new Error('应用不存在')
     if (!app.localPath) throw new Error('应用无本地路径')
+    // SEC-02/SEC-11：serve 时对 DB 中的 localPath 二次校验白名单（不信任入库值）。
+    if (!isLocalPathAllowed(app.localPath)) throw new Error('应用本地路径不在允许的目录白名单内')
+    const proxy = new ProxyAdapter()
     return proxy.serveStatic(app.localPath, data.filePath)
   })

package/src/server/serverFns/auth/register.ts

@@ -32,6 +32,9 @@ const registerServerSchema = z.object({
   invitationCode: z.string().optional().default(''),
 })
 
+/** 面向用户的业务错误：message 可直接展示给客户端（区别于需脱敏的内部错误） */
+class UserFacingError extends Error {}
+
 export const registerFn = createServerFn({ method: 'POST' })
   .validator(registerServerSchema)
   .handler(async ({ data }) => {
@@ -53,9 +56,9 @@ export const registerFn = createServerFn({ method: 'POST' })
       const user = await prisma.$transaction(async (tx) => {
         let codeId: string | null = null
         if (mode === 'invite') {
-          if (!data.invitationCode) throw new Error('请输入邀请码')
+          if (!data.invitationCode) throw new UserFacingError('请输入邀请码')
           const consumed = await consumeInvitationCode(tx, data.invitationCode)
-          if (!consumed.ok) throw new Error(consumed.error)
+          if (!consumed.ok) throw new UserFacingError(consumed.error)
           codeId = consumed.codeId
         }
         const created = await tx.user.create({
@@ -99,6 +102,10 @@ export const registerFn = createServerFn({ method: 'POST' })
       if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2002') {
         throw new Error('用户名或邮箱已存在')
       }
-      throw new Error(err instanceof Error ? err.message : '注册失败')
+      // 业务校验错误原样透传（邀请码话术等，用户需要看到）
+      if (err instanceof UserFacingError) throw err
+      // 错误透传治理：其余内部错误细节（Prisma/DB 信息）只进服务端日志，客户端收通用文案
+      console.error('[register] 注册失败', err)
+      throw new Error('注册失败，请稍后重试')
     }
   })

package/src/server/serverFns/billing.ts

@@ -24,7 +24,6 @@ import { requireAuth } from '@/server/auth-helpers'
 import { BillingUnavailableError } from '@allbluecn/kernel'
 import { getEntitlements } from '@/server/entitlements'
 import { getResourceSnapshots } from '@/server/resources'
-import type { ResourceSnapshots } from '@allbluecn/kernel'
 
 const requireBilling = () => {
   const billing = getProService('billing')