@allbluecn/web-app 0.17.2 → 0.18.1

package/src/server/serverFns/story/story-links.ts

@@ -20,7 +20,32 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { ACTIVITY_SELECT, toActivityItem } from "./types";
+import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
+
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
+/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
+async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
+  const prisma = await getPrisma();
+  const story = await prisma.story.findUnique({
+    where: { id: storyId },
+    select: { projectId: true },
+  });
+  if (!story) throw new Error("需求不存在");
+  await assertProjectMembership(story.projectId, userId);
+  return story.projectId;
+}
+
 export const addLinkFn = createServerFn({ method: "POST" })
   .validator(z.object({ storyId: z.string(), url: z.string().url(), title: z.string().optional(), description: z.string().optional() }))
   .handler(async ({ data }) => {
@@ -29,6 +54,8 @@ export const addLinkFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    await assertStoryProjectMember(data.storyId, userId);
+
     const link = await prisma.storyLink.create({
       data: {
         storyId: data.storyId,
@@ -59,6 +86,14 @@ export const updateLinkFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    // 反查链接所属需求的项目成员资格（SEC-03：防改他人需求的链接）
+    const existing = await prisma.storyLink.findUnique({
+      where: { id: data.linkId },
+      select: { story: { select: { projectId: true } } },
+    });
+    if (!existing) throw new Error("链接不存在");
+    await assertProjectMembership(existing.story.projectId, userId);
+
     const link = await prisma.storyLink.update({
       where: { id: data.linkId },
       data: {
@@ -89,14 +124,20 @@ export const removeLinkFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
-    const link = await prisma.storyLink.findUnique({ where: { id: data.linkId } });
+    const link = await prisma.storyLink.findUnique({
+      where: { id: data.linkId },
+      select: { id: true, title: true, url: true, story: { select: { id: true, projectId: true } } },
+    });
+    if (!link) throw new Error("链接不存在");
+    await assertProjectMembership(link.story.projectId, userId);
+
     await prisma.storyLink.delete({ where: { id: data.linkId } });
 
     let activity = null;
     if (link) {
       const created = await prisma.storyActivity.create({
         data: {
-          storyId: link.storyId,
+          storyId: link.story.id,
           userId,
           action: "link_removed",
           newValue: link.title || link.url,

package/src/server/serverFns/story/story-list-query.ts

@@ -17,7 +17,7 @@
 
 import { Prisma } from "@allbluecn/database";
 import type { GroupKey } from "@/components/story/display/types";
-import { toValidDate } from "./types";
+import { toValidDate } from "@/server/story/types";
 
 export function buildListWhere(data: {
   archived: boolean;

package/src/server/serverFns/story/story-reactions.ts

@@ -20,7 +20,31 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { aggregateReactions } from "./types";
+import { aggregateReactions } from "@/server/story/types";
+
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
+/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
+async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
+  const prisma = await getPrisma();
+  const story = await prisma.story.findUnique({
+    where: { id: storyId },
+    select: { projectId: true },
+  });
+  if (!story) throw new Error("需求不存在");
+  await assertProjectMembership(story.projectId, userId);
+  return story.projectId;
+}
 
 export const listStoryReactionsFn = createServerFn({ method: "GET" })
   .validator(z.object({ storyId: z.string() }))
@@ -46,7 +70,11 @@ export const addStoryReactionFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
-    const existing = await prisma.storyReaction.findUnique({
+    await assertStoryProjectMember(data.storyId, userId);
+
+    // DB-03：查后写（findUnique→无则 create）合并为单次 upsert（where 走复合唯一键）；
+    // update:{} 保持原「已存在则跳过」的幂等语义，并消除并发双写竞态
+    await prisma.storyReaction.upsert({
       where: {
         storyId_userId_emoji: {
           storyId: data.storyId,
@@ -54,14 +82,10 @@ export const addStoryReactionFn = createServerFn({ method: "POST" })
           emoji: data.emoji,
         },
       },
+      update: {},
+      create: { storyId: data.storyId, userId, emoji: data.emoji },
     });
 
-    if (!existing) {
-      await prisma.storyReaction.create({
-        data: { storyId: data.storyId, userId, emoji: data.emoji },
-      });
-    }
-
     const reactions = await prisma.storyReaction.findMany({
       where: { storyId: data.storyId },
       select: { emoji: true, userId: true },
@@ -78,6 +102,8 @@ export const toggleStoryReactionFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    await assertStoryProjectMember(data.storyId, userId);
+
     const existing = await prisma.storyReaction.findUnique({
       where: {
         storyId_userId_emoji: {
@@ -112,6 +138,14 @@ export const toggleCommentReactionFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     const userId = session.user!.id!;
 
+    // 反查评论所属需求的项目成员资格（SEC-03：防对他人需求评论表态）
+    const comment = await prisma.storyComment.findUnique({
+      where: { id: data.commentId },
+      select: { story: { select: { projectId: true } } },
+    });
+    if (!comment) throw new Error("评论不存在");
+    await assertProjectMembership(comment.story.projectId, userId);
+
     const existing = await prisma.commentReaction.findUnique({
       where: {
         commentId_userId_emoji: {

package/src/server/serverFns/story/story-search.ts

@@ -20,16 +20,21 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { ensureBuiltinIndependentProject } from "@/server/builtin-project";
+import { ensureBuiltinIndependentProject, resolveStoryScopeProjectId } from "@/server/builtin-project";
 
 export const searchStoriesFn = createServerFn({ method: "GET" })
-  .validator(z.object({ query: z.string(), excludeIds: z.array(z.string()).optional() }))
+  .validator(z.object({ query: z.string(), excludeIds: z.array(z.string()).optional(), projectId: z.string().optional() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
     const userId = session.user!.id!;
-    const projectId = await ensureBuiltinIndependentProject(userId);
+    // R11：可选 projectId scope（BUG 详情关联需求选择器按 bug 所属项目搜索）。
+    // 不传保持既有行为（用户独立项目）；传无效/非成员项目时
+    // resolveStoryScopeProjectId 静默回退独立项目，与列表 scope 解析同口径。
+    const projectId = data.projectId
+      ? await resolveStoryScopeProjectId(data.projectId, userId)
+      : await ensureBuiltinIndependentProject(userId);
 
     const stories = await prisma.story.findMany({
       where: {
@@ -65,12 +70,19 @@ export const reorderStoriesFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 可见性过滤进 where（SEC-03：防跨项目改他人需求排序）；updateMany 对
+    // 越权/不存在 id 静默跳过，不中断整批合法排序
+    const memberships = await prisma.projectMember.findMany({
+      where: { userId: session.user!.id!, status: { not: "suspended" } },
+      select: { projectId: true },
+    });
+    const visibleProjectIds = memberships.map((m) => m.projectId);
 
     await prisma.$transaction(
       data.items.map((item) =>
-        prisma.story.update({
-          where: { id: item.id },
+        prisma.story.updateMany({
+          where: { id: item.id, projectId: { in: visibleProjectIds } },
           data: { boardOrder: item.boardOrder },
         }),
       ),

package/src/server/serverFns/story/story-transfer.ts

@@ -22,10 +22,23 @@ import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
 import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
-import { STORY_LIST_SELECT, castStoryUsers, castUserBrief, USER_BRIEF_SELECT, checkDescendant } from "./types";
+import { resolveStoryScopeProjectId } from "@/server/builtin-project";
+import { STORY_LIST_SELECT, castStoryUsers, castUserBrief, USER_BRIEF_SELECT, checkDescendant } from "@/server/story/types";
 
 type StoryTx = Parameters<Parameters<typeof import("@allbluecn/database").prisma.$transaction>[0]>[0];
 
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
+
 async function collectDescendantIds(storyId: string): Promise<Set<string>> {
   const prisma = await getPrisma();
   const ids = new Set<string>();
@@ -136,6 +149,10 @@ export const transferStoryToProjectFn = createServerFn({ method: "POST" })
       });
       if (!existing) throw new Error("需求不存在");
 
+      // 源/目标项目都须为有效成员（SEC-03：防移走他人需求或向他项目注入）
+      await assertProjectMembership(existing.projectId, userId);
+      await assertProjectMembership(data.targetProjectId, userId);
+
       const projectChanged = existing.projectId !== data.targetProjectId;
       let alloc: { sequenceId: number; identifier: string } | undefined;
       if (projectChanged) {
@@ -236,6 +253,10 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
       if (!parent) throw new Error("父需求不存在");
       if (!parent.projectId) throw new Error("父需求未归属任何项目");
 
+      // 子需求现属项目与目标父需求项目都须为有效成员（SEC-03）
+      if (existing.projectId) await assertProjectMembership(existing.projectId, userId);
+      await assertProjectMembership(parent.projectId, userId);
+
       const existingProject = existing.projectId
         ? await tx.project.findUnique({
             where: { id: existing.projectId },
@@ -364,7 +385,21 @@ export const listProjectStoriesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+
+    // 读门槛与列表 scope 同口径（SEC-03）：传 projectId 走 resolveStoryScopeProjectId
+    // （非成员静默回退独立项目）；不传（「全部项目」选择器）只返回用户为有效成员的项目
+    let projectFilter: Prisma.StoryWhereInput["projectId"];
+    if (data.projectId) {
+      projectFilter = await resolveStoryScopeProjectId(data.projectId, userId);
+    } else {
+      const memberships = await prisma.projectMember.findMany({
+        where: { userId, status: { not: "suspended" } },
+        select: { projectId: true },
+      });
+      projectFilter = { in: memberships.map((m) => m.projectId) };
+    }
 
     const excludeIds = new Set<string>();
     if (data.excludeStoryId) {
@@ -381,7 +416,7 @@ export const listProjectStoriesFn = createServerFn({ method: "GET" })
 
     const stories = await prisma.story.findMany({
       where: {
-        ...(data.projectId ? { projectId: data.projectId } : {}),
+        projectId: projectFilter,
         ...(data.mode === "dependency" || data.mode === "iteration" ? {} : { parentId: null }),
         archived: false,
         ...(excludeIds.size > 0

package/src/server/serverFns/story/story-tree.ts

@@ -20,7 +20,19 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { buildStoryTree, checkDescendant } from "./types";
+import { buildStoryTree, checkDescendant } from "@/server/story/types";
+
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+async function assertProjectMembership(projectId: string, userId: string) {
+  const prisma = await getPrisma();
+  const membership = await prisma.projectMember.findUnique({
+    where: { projectId_userId: { projectId, userId } },
+    select: { status: true },
+  });
+  if (!membership || membership.status === "suspended") {
+    throw new Error("无权限操作该项目的需求");
+  }
+}
 
 export const getStoryTreeFn = createServerFn({ method: "GET" })
   .validator(z.object({ rootId: z.string().optional() }))
@@ -71,10 +83,13 @@ export const addChildFn = createServerFn({ method: "POST" })
       throw new Error("不能将子需求设为其父需求的子需求（循环依赖）");
     }
 
+    // 子/父两端项目都须为有效成员（SEC-03：防跨项目挂载他人需求）
+    if (existingChild) await assertProjectMembership(existingChild.projectId, userId);
     const parent = await prisma.story.findUnique({
       where: { id: data.parentId },
-      select: { id: true, identifier: true, name: true },
+      select: { id: true, projectId: true, identifier: true, name: true },
     });
+    if (parent) await assertProjectMembership(parent.projectId, userId);
 
     const child = await prisma.story.update({
       where: { id: data.childId },
@@ -110,7 +125,15 @@ export const removeChildFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
+
+    const existing = await prisma.story.findUnique({
+      where: { id: data.childId },
+      select: { id: true, projectId: true },
+    });
+    if (!existing) throw new Error("需求不存在");
+    await assertProjectMembership(existing.projectId, userId);
 
     const child = await prisma.story.update({
       where: { id: data.childId },
@@ -125,13 +148,29 @@ export const moveChildFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    const userId = session.user!.id!;
 
     const isDescendant = await checkDescendant(data.childId, data.newParentId);
     if (isDescendant) {
       throw new Error("不能将子需求移动到其后代节点（循环依赖）");
     }
 
+    const [existing, newParent] = await Promise.all([
+      prisma.story.findUnique({
+        where: { id: data.childId },
+        select: { id: true, projectId: true },
+      }),
+      prisma.story.findUnique({
+        where: { id: data.newParentId },
+        select: { id: true, projectId: true },
+      }),
+    ]);
+    if (!existing) throw new Error("需求不存在");
+    if (!newParent) throw new Error("父需求不存在");
+    await assertProjectMembership(existing.projectId, userId);
+    await assertProjectMembership(newParent.projectId, userId);
+
     const child = await prisma.story.update({
       where: { id: data.childId },
       data: { parentId: data.newParentId },

package/src/server/serverFns/story-display-options.ts

@@ -100,7 +100,9 @@ const orderDirSchema = z.enum(ORDER_DIRECTIONS)
 const propertySchema = z.enum(ALL_DISPLAY_PROPERTIES)
 const pageSizeSchema = z.union([z.literal(100), z.literal(200), z.literal(500), z.literal(1000)])
 
-export const displayOptionsSchema = z.object({
+// 模块私有：serverFn 文件只准导出 createServerFn（客户端 split 会保留普通导出，
+// 与本文件顶层 @/server/* import 叠加会把服务端依赖拉进浏览器 bundle）
+const displayOptionsSchema = z.object({
   groupBy: groupBySchema,
   subGroupBy: groupBySchema,
   orderBy: orderBySchema,

package/src/server/serverFns/tags.ts

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+import { z } from 'zod'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { getServerSeam } from '@allbluecn/kernel'
+import { hashColorIndex } from '@/lib/tag-colors'
+
+export const listTagsFn = createServerFn({ method: 'GET' })
+  .handler(async () => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    return prisma.tag.findMany({
+      where: { userId: session.user!.id!, isHidden: false },
+      orderBy: { sortOrder: 'asc' },
+    })
+  })
+
+const createTagSchema = z.object({ name: z.string().min(1).trim() })
+
+export const createTagFn = createServerFn({ method: 'POST' })
+  .validator(createTagSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+
+    const existing = await prisma.tag.findFirst({ where: { name: data.name, userId } })
+    if (existing) return existing
+
+    return prisma.tag.create({
+      data: { name: data.name, color: hashColorIndex(data.name), userId },
+    })
+  })
+
+const updateTagSchema = z.object({
+  id: z.string(),
+  name: z.string().min(1).trim().optional(),
+  color: z.number().int().min(0).max(7).optional(),
+})
+
+export const updateTagFn = createServerFn({ method: 'POST' })
+  .validator(updateTagSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+
+    const tag = await prisma.tag.findFirst({ where: { id: data.id, userId } })
+    if (!tag) throw new Error('FORBIDDEN')
+
+    if (data.name && data.name !== tag.name) {
+      const conflict = await prisma.tag.findFirst({
+        where: { name: data.name, userId },
+      })
+      if (conflict) {
+        throw new Error('TAG_NAME_CONFLICT')
+      }
+    }
+
+    return prisma.tag.update({
+      where: { id: data.id },
+      data: {
+        ...(data.name !== undefined ? { name: data.name } : {}),
+        ...(data.color !== undefined ? { color: data.color } : {}),
+      },
+    })
+  })
+
+const reorderTagsSchema = z.object({ orderedIds: z.array(z.string()).min(1) })
+
+export const reorderTagsFn = createServerFn({ method: 'POST' })
+  .validator(reorderTagsSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+
+    // DB-01：原逐标签 findFirst 鉴权 + update（2N 次查询）。改一次 findMany in 鉴权 + 事务内
+    // 批量 updateMany（N 次写并行、原子提交，鉴权 where 保留 userId 防 TOCTOU）。
+    // 查询次数 before: 2N → after: 1 + N（事务内并行）
+    const owned = await prisma.tag.findMany({
+      where: { id: { in: data.orderedIds }, userId },
+      select: { id: true },
+    })
+    const ownedIds = new Set(owned.map((t) => t.id))
+
+    await prisma.$transaction(async (tx) => {
+      await Promise.all(
+        data.orderedIds.map((id, index) => {
+          // 未授权/不存在的 id 静默跳过（与原 findFirst 失败 return null 行为一致）
+          if (!ownedIds.has(id)) return Promise.resolve()
+          return tx.tag.updateMany({ where: { id, userId }, data: { sortOrder: index * 1000 } })
+        }),
+      )
+    })
+    return { success: true }
+  })
+
+const deleteTagSchema = z.object({ id: z.string() })
+
+export const deleteTagFn = createServerFn({ method: 'POST' })
+  .validator(deleteTagSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+
+    const tag = await prisma.tag.findFirst({ where: { id: data.id, userId } })
+    if (!tag) throw new Error('FORBIDDEN')
+
+    await prisma.tag.update({
+      where: { id: data.id },
+      data: { isHidden: true },
+    })
+    return { success: true }
+  })

package/src/server/serverFns/team.ts

@@ -4,6 +4,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import crypto from 'node:crypto'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { assertOwned } from '@/server/lib/ownership'
 import { requireTeamSeats } from '@/server/resources'
 import { auditLog } from '@/server/audit'
 import { sendTemplateEmail } from '@/server/email'
@@ -211,8 +212,8 @@ export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
-    const inv = await prisma.teamInvitation.findUnique({ where: { id: data.invitationId } })
-    if (!inv || inv.ownerId !== ownerId) throw new Error('邀请不存在')
+    // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
+    const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'pending_approval') throw new Error('仅待处理/待批准邀请可撤销')
     if (inv.channel === 'link') {
       await prisma.teamJoinRequest.updateMany({
@@ -241,8 +242,8 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
-    const inv = await prisma.teamInvitation.findUnique({ where: { id: data.invitationId } })
-    if (!inv || inv.ownerId !== ownerId) throw new Error('邀请不存在')
+    // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
+    const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'expired') {
       throw new Error('仅待处理/已过期邀请可重发')
     }
@@ -434,11 +435,14 @@ export const approveTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const reqRow = await prisma.teamJoinRequest.findUnique({
-      where: { id: data.requestId },
+    // DB-03：属主校验并入单次 findFirst（include 关系一并取回）。
+    // 此处内联 findFirst 而非 assertOwned：include 投影类型（reqRow.invitation）需走
+    // Prisma 原生泛型推断，assertOwned 的结构化约束会退化为整行类型
+    const reqRow = await prisma.teamJoinRequest.findFirst({
+      where: { id: data.requestId, ownerId },
       include: { invitation: { select: { id: true, status: true, channel: true, expiresAt: true } } },
     })
-    if (!reqRow || reqRow.ownerId !== ownerId) throw new Error('申请不存在')
+    if (!reqRow) throw new Error('申请不存在')
     if (reqRow.status !== 'pending') throw new Error('仅待审批申请可操作')
 
     if (reqRow.invitation.status !== 'pending' || reqRow.invitation.expiresAt < new Date()) {
@@ -500,8 +504,8 @@ export const rejectTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const reqRow = await prisma.teamJoinRequest.findUnique({ where: { id: data.requestId } })
-    if (!reqRow || reqRow.ownerId !== ownerId) throw new Error('申请不存在')
+    // DB-03：属主校验并入单次 findFirst
+    const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
     if (reqRow.status !== 'pending') throw new Error('仅待审批申请可操作')
 
     await prisma.teamJoinRequest.update({
@@ -528,8 +532,8 @@ export const deleteTeamInvitationFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const invRow = await prisma.teamInvitation.findUnique({ where: { id: data.invitationId } })
-    if (!invRow || invRow.ownerId !== ownerId) throw new Error('邀请不存在')
+    // DB-03：属主校验并入单次 findFirst
+    const invRow = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     // link 渠道行下挂 joinRequest（级联删除），禁止单独删除
     if (invRow.channel === 'link') throw new Error('链接邀请记录不可删除')
 
@@ -554,8 +558,8 @@ export const deleteTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const reqRow = await prisma.teamJoinRequest.findUnique({ where: { id: data.requestId } })
-    if (!reqRow || reqRow.ownerId !== ownerId) throw new Error('申请不存在')
+    // DB-03：属主校验并入单次 findFirst
+    const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
 
     await prisma.teamJoinRequest.delete({ where: { id: reqRow.id } })
 
@@ -843,10 +847,8 @@ export const approveTeamInvitationFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const inv = await prisma.teamInvitation.findUnique({
-      where: { id: data.invitationId },
-    })
-    if (!inv || inv.ownerId !== ownerId) throw new Error('邀请不存在')
+    // DB-03：属主校验并入单次 findFirst
+    const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending_approval') throw new Error('仅待批准邀请可操作')
     if (inv.expiresAt < new Date()) throw new Error('邀请已过期，无法批准')
     if (inv.channel !== 'email') throw new Error('链接渠道申请请使用 approveTeamJoinRequestFn')