@allbluecn/web-app 0.17.2 → 0.18.1

package/src/server/serverFns/story/story-crud/archive.ts

@@ -20,10 +20,34 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { STORY_LIST_SELECT, castStoryUsers } from "../types";
+import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
 const archiveStorySchema = z.object({ storyId: z.string() });
 
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
+/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
+async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
+  const prisma = await getPrisma();
+  const story = await prisma.story.findUnique({
+    where: { id: storyId },
+    select: { projectId: true },
+  });
+  if (!story) throw new Error("需求不存在");
+  await assertProjectMembership(story.projectId, userId);
+  return story.projectId;
+}
+
 export const archiveStoryFn = createServerFn({ method: "POST" })
   .validator(archiveStorySchema)
   .handler(async ({ data }) => {
@@ -32,6 +56,8 @@ export const archiveStoryFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    await assertStoryProjectMember(data.storyId, userId);
+
     const story = await prisma.story.update({
       where: { id: data.storyId },
       data: { archived: true, archivedAt: new Date() },
@@ -60,6 +86,8 @@ export const unarchiveStoryFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    await assertStoryProjectMember(data.storyId, userId);
+
     const story = await prisma.story.update({
       where: { id: data.storyId },
       data: { archived: false, archivedAt: null },

package/src/server/serverFns/story/story-crud/bulk.ts

@@ -21,11 +21,21 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
-import { toDateOnly } from "../types";
+import { toDateOnly } from "@/server/story/types";
 import type { Prisma } from "@allbluecn/database";
 
 const idListSchema = z.object({ storyIds: z.array(z.string()).min(1).max(500) });
 
+/** 一次取用户可访问（有效成员，suspended 视同无权限）的项目 id 集合，供批量操作做可见性过滤（避免循环查库） */
+async function accessibleProjectIds(userId: string): Promise<string[]> {
+  const prisma = await getPrisma();
+  const rows = await prisma.projectMember.findMany({
+    where: { userId, status: { not: "suspended" } },
+    select: { projectId: true },
+  });
+  return rows.map((r) => r.projectId);
+}
+
 export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
   .validator(idListSchema)
   .handler(async ({ data }) => {
@@ -33,10 +43,11 @@ export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     const userId = session.user!.id!;
+    const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
       const rows = await tx.story.findMany({
-        where: { id: { in: data.storyIds } },
+        where: { id: { in: data.storyIds }, projectId: { in: visibleProjectIds } },
         select: { id: true, state: true, archived: true },
       });
       const toArchive = rows.filter(
@@ -67,8 +78,12 @@ export const bulkDeleteStoriesFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
-    const result = await prisma.story.deleteMany({ where: { id: { in: data.storyIds } } });
+    const session = await requireAuth(request);
+    // 可见性过滤进 where：跨项目 id 静默跳过而非报错（SEC-03/DB-03：单语句消除跨项目删除）
+    const visibleProjectIds = await accessibleProjectIds(session.user!.id!);
+    const result = await prisma.story.deleteMany({
+      where: { id: { in: data.storyIds }, projectId: { in: visibleProjectIds } },
+    });
     return { deleted: result.count };
   });
 
@@ -95,10 +110,11 @@ export const bulkUpdateStoriesFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     const userId = session.user!.id!;
+    const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
       const rows = await tx.story.findMany({
-        where: { id: { in: data.storyIds } },
+        where: { id: { in: data.storyIds }, projectId: { in: visibleProjectIds } },
         select: {
           id: true,
           state: true,

package/src/server/serverFns/story/story-crud/create-story-internal.ts

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 从 story-crud.ts 提取的「发号 + 建单」事务段（任务 6 DRY）：createStoryFn 与
+// convertBugToStoryFn 共用同一段，保证两条入口的需求编号序列一致。
+// ⚠ 发号 scope 是裸 projectId（Story 既有 scope）——不是 BUG 域的 bug:{projectId}，
+// 混用会污染需求编号序列。独立成非 serverFn 模块而非从 story-crud.ts 导出：
+// serverFn 文件禁止非 createServerFn 导出（客户端 split 会保留顶层 import，
+// 跨 serverFn 文件引用普通导出是 P0 反模式，同 bug-permissions.ts 先例）。
+import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
+import type { Prisma } from "@allbluecn/database";
+import { ACTIVITY_SELECT, STORY_LIST_SELECT, castStoryUsers, toActivityItem } from "@/server/story/types";
+
+export interface CreateStoryInternalInput {
+  name: string;
+  description?: string;
+  /** 已解析的目标项目（createStoryFn 兜底 ensureBuiltinIndependentProject 后传入；convert 传 bug.projectId） */
+  projectId: string;
+  parentId?: string;
+  state: "backlog" | "todo" | "in_progress" | "done" | "cancelled";
+  priority: "urgent" | "high" | "medium" | "low" | "none";
+  assigneeId?: string | null;
+  startDate?: string;
+  targetDate?: string;
+  labelIds: string[];
+  isAI: boolean;
+}
+
+/** 事务内发号并建单：identifier 发号（裸 projectId scope）+ story.create + created/child_added 活动 */
+export async function createStoryInternal(
+  tx: Prisma.TransactionClient,
+  input: CreateStoryInternalInput,
+  userId: string,
+) {
+  let parentStory: { id: string; identifier: string; name: string } | null = null;
+  if (input.parentId) {
+    parentStory = await tx.story.findUnique({
+      where: { id: input.parentId },
+      select: { id: true, identifier: true, name: true },
+    });
+    if (!parentStory) throw new Error("父需求不存在");
+  }
+
+  const project = await tx.project.findUnique({
+    where: { id: input.projectId },
+    select: { id: true, name: true, displayId: true },
+  });
+  if (!project) throw new Error("项目不存在");
+
+  const isIndependent = project.displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
+  const pid = input.projectId;
+  let sequenceId: number;
+  let identifier: string;
+  if (isIndependent) {
+    const counter = await tx.sequenceCounter.upsert({
+      where: { scope: pid },
+      create: { scope: pid, seq: 1 },
+      update: { seq: { increment: 1 } },
+    });
+    sequenceId = counter.seq;
+    identifier = `STORY-${counter.seq}`;
+  } else {
+    const prefix =
+      (project.displayId ?? project.name!)
+        .replace(/[^a-zA-Z0-9]/g, "")
+        .toUpperCase() || "PRJ";
+    const counter = await tx.sequenceCounter.upsert({
+      where: { scope: pid },
+      create: { scope: pid, seq: 1 },
+      update: { seq: { increment: 1 } },
+    });
+    sequenceId = counter.seq;
+    identifier = `${prefix}-${counter.seq}`;
+  }
+
+  const story = await tx.story.create({
+    data: {
+      sequenceId,
+      identifier,
+      name: input.name,
+      description: input.description ?? null,
+      projectId: input.projectId,
+      parentId: input.parentId || null,
+      state: input.state,
+      priority: input.priority,
+      assigneeId: input.assigneeId || null,
+      startDate: input.startDate ? new Date(input.startDate) : null,
+      targetDate: input.targetDate ? new Date(input.targetDate) : null,
+      createdById: userId,
+      labels: input.labelIds.length
+        ? { create: input.labelIds.map((labelId) => ({ labelId })) }
+        : undefined,
+    },
+    select: STORY_LIST_SELECT,
+  });
+
+  await tx.storyActivity.create({
+    data: { storyId: story.id, userId, action: "created", isAI: input.isAI },
+  });
+
+  // 创建时带父需求：父需求侧补「添加子需求」活动
+  let parentActivity: ReturnType<typeof toActivityItem> | null = null;
+  if (parentStory) {
+    const pa = await tx.storyActivity.create({
+      data: {
+        storyId: parentStory.id,
+        userId,
+        action: "child_added",
+        newValue: `${story.identifier} ${story.name}`.trim(),
+        isAI: input.isAI,
+      },
+      select: ACTIVITY_SELECT,
+    });
+    parentActivity = toActivityItem(pa);
+  }
+
+  return { ...castStoryUsers(story), activities: parentActivity ? [parentActivity] : [] };
+}

package/src/server/serverFns/story/story-crud/detail.ts

@@ -20,7 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { STORY_LIST_SELECT, castStoryUsers } from "../types";
+import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
 const detailSchema = z.object({ storyId: z.string() });
 

package/src/server/serverFns/story/story-crud/label-suggest.ts

@@ -19,7 +19,7 @@ import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { requireAuth } from "@/server/auth-helpers"
-import { suggestLabelsCore } from "./label-suggest-core"
+import { suggestLabelsCore } from "@/server/story/story-crud/label-suggest-core"
 
 const suggestSchema = z.object({
   name: z.string().min(1).max(200),

package/src/server/serverFns/story/story-crud/labels.ts

@@ -20,8 +20,8 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { USER_BRIEF_SELECT } from "../types";
-import { upsertLabel } from "./label-upsert";
+import { USER_BRIEF_SELECT } from "@/server/story/types";
+import { upsertLabel } from "@/server/story/story-crud/label-upsert";
 
 const labelCreateSchema = z.object({
   name: z.string().min(1).max(30),

package/src/server/serverFns/story/story-crud.ts

@@ -22,13 +22,25 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { isUserInTeam } from "@/server/team-access";
-import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
 import type { ActivityItem } from "@/components/story/types";
 import { diffDescriptionBlocks } from "@/lib/story/description-diff";
-import { USER_BRIEF_SELECT, STORY_LIST_SELECT, castStoryUsers, castUserBrief, toDateOnly, ACTIVITY_SELECT, toActivityItem } from "./types";
+import { USER_BRIEF_SELECT, STORY_LIST_SELECT, castStoryUsers, castUserBrief, toDateOnly } from "@/server/story/types";
 import { buildListWhere } from "./story-list-query";
+import { createStoryInternal } from "./story-crud/create-story-internal";
 import type { Prisma } from "@allbluecn/database";
 
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
 async function validateAssignee(projectId: string, assigneeId: string | null | undefined) {
   if (!assigneeId) return;
   const prisma = await getPrisma();
@@ -112,93 +124,18 @@ export const createStoryFn = createServerFn({ method: "POST" })
     }
 
     const resolvedProjectId = projectId!;
+    // 与 testcase createTestCaseFn 同范式：建入前校验目标项目成员资格（SEC-03 残口收口）；
+    // 回退内置独立项目路径上创建者恒为 owner 成员行，天然放行
+    await assertProjectMembership(resolvedProjectId, userId);
     await validateAssignee(resolvedProjectId, data.assigneeId);
 
     const MAX_RETRIES = 5;
     for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
       try {
-        return await prisma.$transaction(async (tx) => {
-          let parentStory: { id: string; identifier: string; name: string } | null = null;
-          if (data.parentId) {
-            parentStory = await tx.story.findUnique({ where: { id: data.parentId }, select: { id: true, identifier: true, name: true } });
-            if (!parentStory) throw new Error("父需求不存在");
-          }
-          let sequenceId: number;
-          let identifier: string;
-
-          const project = await tx.project.findUnique({
-            where: { id: projectId },
-            select: { id: true, name: true, displayId: true },
-          });
-          if (!project) throw new Error("项目不存在");
-
-          const isIndependent = project.displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
-          const pid = projectId!;
-          if (isIndependent) {
-            const counter = await tx.sequenceCounter.upsert({
-              where: { scope: pid },
-              create: { scope: pid, seq: 1 },
-              update: { seq: { increment: 1 } },
-            });
-            sequenceId = counter.seq;
-            identifier = `STORY-${counter.seq}`;
-          } else {
-            const prefix =
-              (project.displayId ?? project.name!)
-                .replace(/[^a-zA-Z0-9]/g, "")
-                .toUpperCase() || "PRJ";
-            const counter = await tx.sequenceCounter.upsert({
-              where: { scope: pid },
-              create: { scope: pid, seq: 1 },
-              update: { seq: { increment: 1 } },
-            });
-            sequenceId = counter.seq;
-            identifier = `${prefix}-${counter.seq}`;
-          }
-
-          const story = await tx.story.create({
-            data: {
-              sequenceId,
-              identifier,
-              name: data.name,
-              description: data.description ?? null,
-              projectId: projectId!,
-              parentId: data.parentId || null,
-              state: data.state,
-              priority: data.priority,
-              assigneeId: data.assigneeId || null,
-              startDate: data.startDate ? new Date(data.startDate) : null,
-              targetDate: data.targetDate ? new Date(data.targetDate) : null,
-              createdById: userId,
-              labels: data.labelIds.length
-                ? { create: data.labelIds.map((labelId) => ({ labelId })) }
-                : undefined,
-            },
-            select: STORY_LIST_SELECT,
-          });
-
-          await tx.storyActivity.create({
-            data: { storyId: story.id, userId, action: "created", isAI: data.isAI },
-          });
-
-          // 创建时带父需求：父需求侧补「添加子需求」活动
-          let parentActivity: ReturnType<typeof toActivityItem> | null = null;
-          if (parentStory) {
-            const pa = await tx.storyActivity.create({
-              data: {
-                storyId: parentStory.id,
-                userId,
-                action: "child_added",
-                newValue: `${story.identifier} ${story.name}`.trim(),
-                isAI: data.isAI,
-              },
-              select: ACTIVITY_SELECT,
-            });
-            parentActivity = toActivityItem(pa);
-          }
-
-          return { ...castStoryUsers(story), activities: parentActivity ? [parentActivity] : [] } satisfies Awaited<ReturnType<typeof prisma.$transaction>>;
-        });
+        // 发号 + 建单事务段已提取为共享导出（convertBugToStoryFn 复用，任务 6 DRY）
+        return await prisma.$transaction((tx) =>
+          createStoryInternal(tx, { ...data, projectId: resolvedProjectId }, userId),
+        );
       } catch (e: unknown) {
         const isUniqueViolation =
           e instanceof Error &&
@@ -243,6 +180,13 @@ export const updateStoryFn = createServerFn({ method: "POST" })
         select: STORY_LIST_SELECT,
       });
       if (!existing) throw new Error("需求不存在");
+      await assertProjectMembership(existing.projectId, userId);
+
+      // 跨项目移动：目标项目同样须为有效成员（防止借移动向他项目注入数据）
+      const newProjectId = data.projectId ?? existing.projectId;
+      if (data.projectId !== undefined && newProjectId !== existing.projectId) {
+        await assertProjectMembership(newProjectId, userId);
+      }
 
       if (data.assigneeId !== undefined) {
         await validateAssignee(existing.projectId, data.assigneeId);
@@ -282,7 +226,6 @@ export const updateStoryFn = createServerFn({ method: "POST" })
           newValue: newAssigneeName,
         });
       }
-      const newProjectId = data.projectId ?? existing.projectId;
       if (data.projectId !== undefined && newProjectId !== existing.projectId) {
         updates.project = { connect: { id: newProjectId } };
       }
@@ -437,6 +380,14 @@ export const deleteStoryFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    // 先取回目标行校验成员资格，再删（SEC-03：防跨项目删除他人需求）
+    const existing = await prisma.story.findUnique({
+      where: { id: data.storyId },
+      select: { id: true, projectId: true },
+    });
+    if (!existing) throw new Error("需求不存在");
+    await assertProjectMembership(existing.projectId, userId);
+
     await prisma.story.delete({ where: { id: data.storyId } });
     return { success: true };
   });

package/src/server/serverFns/story/story-dependencies.ts

@@ -20,11 +20,41 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { STORY_LIST_SELECT, castStoryUsers, ACTIVITY_SELECT, toActivityItem } from "./types";
+import { STORY_LIST_SELECT, castStoryUsers, ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import type { DependencyRow } from "@/components/story/types";
 
 const edgeTypeSchema = z.enum(["BLOCKS", "STARTS_BEFORE", "FINISHES_BEFORE"]);
 
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
+/** 批量校验一组需求的所属项目成员资格（依赖边可能跨项目，两端都须为有效成员） */
+async function assertStoriesProjectMember(storyIds: string[], userId: string) {
+  const prisma = await getPrisma();
+  const rows = await prisma.story.findMany({
+    where: { id: { in: storyIds } },
+    select: { projectId: true },
+  });
+  const projectIds = [...new Set(rows.map((r) => r.projectId))];
+  for (const projectId of projectIds) {
+    await assertProjectMembership(projectId, userId);
+  }
+}
+
+/** 依赖边无向归一化键（查重口径：双向均视为同一条边） */
+function normalizedEdgeKey(a: string, b: string): string {
+  return a < b ? `${a}|${b}` : `${b}|${a}`;
+}
+
 export const addDependenciesFn = createServerFn({ method: "POST" })
   .validator(
     z.object({
@@ -45,6 +75,12 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    // 本批全部端点需求的项目成员资格（SEC-03：防跨项目建依赖边）
+    await assertStoriesProjectMember(
+      [...new Set(data.items.flatMap((i) => [i.sourceId, i.targetId]))],
+      userId,
+    );
+
     // 一次性取全部出边（3 类型合并；不按 projectId 裁剪——跨项目边同样参与环判定），
     // 构建内存邻接表供本批循环的环检测复用，避免 O(items × 可达节点) 次串行 RTT
     const allEdges = await prisma.storyDependency.findMany({
@@ -81,25 +117,27 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
       return false;
     }
 
-    const created: string[] = [];
     const failed: Array<{ targetId: string; reason: "SELF" | "DUPLICATED" | "CYCLE" }> = [];
-    const batchEdges: Array<{ sourceId: string; targetId: string }> = [];
+    // batchEdges 携带完整 validated item（含 type 枚举）供 createManyAndReturn 直接写入
+    const batchEdges: Array<{
+      sourceId: string;
+      targetId: string;
+      type: "BLOCKS" | "STARTS_BEFORE" | "FINISHES_BEFORE";
+    }> = [];
+
+    // DB-01：查重从逐边 findFirst（N 次 OR 查询）改为复用 allEdges 内存无向键集合（0 次额外查询）；
+    // 批内重复边在插入后加入集合，第 2 次出现同样命中 DUPLICATED（与原 create 后可见语义一致）
+    const existingEdgeKeys = new Set<string>();
+    for (const e of allEdges) {
+      existingEdgeKeys.add(normalizedEdgeKey(e.sourceId, e.targetId));
+    }
 
     for (const item of data.items) {
       if (item.sourceId === item.targetId) {
         failed.push({ targetId: item.targetId, reason: "SELF" });
         continue;
       }
-      const existing = await prisma.storyDependency.findFirst({
-        where: {
-          OR: [
-            { sourceId: item.sourceId, targetId: item.targetId },
-            { sourceId: item.targetId, targetId: item.sourceId },
-          ],
-        },
-        select: { id: true },
-      });
-      if (existing) {
+      if (existingEdgeKeys.has(normalizedEdgeKey(item.sourceId, item.targetId))) {
         failed.push({ targetId: item.targetId, reason: "DUPLICATED" });
         continue;
       }
@@ -108,15 +146,17 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
         failed.push({ targetId: item.targetId, reason: "CYCLE" });
         continue;
       }
-      const dep = await prisma.storyDependency.create({ data: item });
-      created.push(dep.id);
-      batchEdges.push({ sourceId: item.sourceId, targetId: item.targetId });
+      batchEdges.push(item);
+      existingEdgeKeys.add(normalizedEdgeKey(item.sourceId, item.targetId));
     }
 
     // 活动记录：依赖两端各记一条「添加依赖关系」（newValue 为对方需求描述），
     // 返回带 storyId 供 UI 过滤当前需求侧的记录
+    // DB-01/DB-07：批量建边 createManyAndReturn（1 次替代 N 次 create）+ 活动留痕一并包 $transaction
+    // （消除边/活动半批残留）。查询次数 before: N(查重) + N(create) + 2N(activity) + 2 → after: 4（常数）
+    let created: string[] = [];
     let activities: Array<ReturnType<typeof toActivityItem> & { storyId: string }> = [];
-    if (created.length > 0) {
+    if (batchEdges.length > 0) {
       const endpointIds = [...new Set(batchEdges.flatMap((e) => [e.sourceId, e.targetId]))];
       const endpoints = await prisma.story.findMany({
         where: { id: { in: endpointIds } },
@@ -125,21 +165,37 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
       const labelById = new Map(
         endpoints.map((s) => [s.id, `${s.identifier} ${s.name}`.trim()]),
       );
-      const createdActivities = await Promise.all(
-        batchEdges.flatMap(({ sourceId, targetId }) => {
-          const sourceLabel = labelById.get(sourceId) ?? "";
-          const targetLabel = labelById.get(targetId) ?? "";
-          return [
-            prisma.storyActivity.create({
-              data: { storyId: sourceId, userId, action: "dependency_added", newValue: targetLabel },
-              select: { ...ACTIVITY_SELECT, storyId: true },
-            }),
-            prisma.storyActivity.create({
-              data: { storyId: targetId, userId, action: "dependency_added", newValue: sourceLabel },
+      const activityData = batchEdges.flatMap(({ sourceId, targetId }) => {
+        const sourceLabel = labelById.get(sourceId) ?? "";
+        const targetLabel = labelById.get(targetId) ?? "";
+        return [
+          { storyId: sourceId, userId, action: "dependency_added", newValue: targetLabel },
+          { storyId: targetId, userId, action: "dependency_added", newValue: sourceLabel },
+        ];
+      });
+
+      const { insertedEdges, createdActivities } = await prisma.$transaction(async (tx) => {
+        const edges = await tx.storyDependency.createManyAndReturn({
+          data: batchEdges,
+          select: { id: true, sourceId: true, targetId: true },
+        });
+        const acts = await Promise.all(
+          activityData.map((data) =>
+            tx.storyActivity.create({
+              data,
               select: { ...ACTIVITY_SELECT, storyId: true },
             }),
-          ];
-        }),
+          ),
+        );
+        return { insertedEdges: edges, createdActivities: acts };
+      });
+
+      // 按 (sourceId,targetId) 映射回输入序的 id 列表（不依赖返回行顺序假设）
+      const idByPair = new Map(
+        insertedEdges.map((e) => [`${e.sourceId}|${e.targetId}`, e.id] as const),
+      );
+      created = batchEdges.map(
+        ({ sourceId, targetId }) => idByPair.get(`${sourceId}|${targetId}`) ?? "",
       );
       activities = createdActivities.map((a) => ({ ...toActivityItem(a), storyId: a.storyId }));
     }
@@ -169,6 +225,7 @@ export const updateDependencyFn = createServerFn({ method: "POST" })
       (data.sourceId === dep.sourceId && data.targetId === dep.targetId) ||
       (data.sourceId === dep.targetId && data.targetId === dep.sourceId);
     if (!sameSet) throw new Error("依赖关系两端不匹配");
+    await assertStoriesProjectMember([dep.sourceId, dep.targetId], userId);
     if (
       data.sourceId === dep.sourceId &&
       data.targetId === dep.targetId &&
@@ -255,6 +312,8 @@ export const removeDependencyFn = createServerFn({ method: "POST" })
     const dep = await prisma.storyDependency.findUnique({ where: { id: data.depId } });
     if (!dep) return null;
 
+    await assertStoriesProjectMember([dep.sourceId, dep.targetId], userId);
+
     const [sourceStory, targetStory] = await Promise.all([
       prisma.story.findUnique({ where: { id: dep.sourceId }, select: { identifier: true, name: true } }),
       prisma.story.findUnique({ where: { id: dep.targetId }, select: { identifier: true, name: true } }),

package/src/server/serverFns/story/story-groups.ts

@@ -23,7 +23,7 @@ import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { GROUP_KEYS, ORDER_KEYS, ORDER_DIRECTIONS, type GroupKey, type OrderKey } from "@/components/story/display/types";
 import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
-import { STORY_LIST_SELECT_LIGHT, castStoryUsersLight, type StoryListRowLight } from "./types";
+import { STORY_LIST_SELECT_LIGHT, castStoryUsersLight, type StoryListRowLight } from "@/server/story/types";
 import { buildListWhere, buildGroupFilter } from "./story-list-query";
 import type { Prisma } from "@allbluecn/database";