@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/__tests__/task-serverfn-queries.test.ts

@@ -0,0 +1,403 @@
+// 任务模块查询 serverFns 测试（listAssignedToMeFn / listAiTasksFn / getAiTaskFn）。
+// 钉死口径：
+// - 三个 serverFn 均 GET method；handler 首行 requireAuth，未登录直接拒绝不触 DB；
+// - listAiTasksFn：where createdById + updatedAt 倒序 + 列表字段 select（含 instruction 供指令搜索）；lastRunAt/updatedAt
+//   转 ISO string；sqlite provider 降级 { items: [], degraded: true } 且不触 prisma.aiTask；
+// - getAiTaskFn：归属过滤放 where（非属主与不存在同样抛「任务不存在」，不泄露存在性）；
+//   runs 按 startedAt 倒序；task 附关联项目名 projectName（projectId null 不查、查询
+//   落空兜底 null）；sourceExists 仅源型任务探测源表（null = 非源型）。
+// mock 惯例照 chat-list-messages.test.ts：伪造 createServerFn（_method 捕获 + validator
+// parse + handler 直调），getPrisma 走 @allbluecn/database/get-prisma（serverFn 纯净红线
+// 禁止顶层 import { prisma }）。
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const mocks = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  fetchAssignedToMe: vi.fn(),
+  getDatabaseProvider: vi.fn(() => "postgresql"),
+  aiTaskFindMany: vi.fn(),
+  aiTaskFindFirst: vi.fn(),
+  aiTaskRunFindMany: vi.fn(),
+  projectFindUnique: vi.fn(),
+  storyFindUnique: vi.fn(),
+  bugFindUnique: vi.fn(),
+  testCaseFindUnique: vi.fn(),
+}))
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    let validator: any = undefined
+    return {
+      _method: config.method,
+      validator(schema: any) {
+        validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        // async：真实 serverFn 调用恒为异步 RPC，validator 抛错也应表现为 rejected promise
+        const fn2 = async (args: any = {}) => {
+          let data = args?.data
+          if (validator && data !== undefined) {
+            data = validator.parse ? validator.parse(data) : data
+          }
+          return fn({ data, request: args?.request })
+        }
+        // method 契约随链式产物保留（.handler() 后 builder 对象已不可达）
+        ;(fn2 as any)._method = config.method
+        return fn2
+      },
+    }
+  },
+}))
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => ({}),
+}))
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.requireAuth,
+}))
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    aiTask: {
+      findMany: mocks.aiTaskFindMany,
+      findFirst: mocks.aiTaskFindFirst,
+    },
+    aiTaskRun: { findMany: mocks.aiTaskRunFindMany },
+    project: { findUnique: mocks.projectFindUnique },
+    story: { findUnique: mocks.storyFindUnique },
+    bug: { findUnique: mocks.bugFindUnique },
+    testCase: { findUnique: mocks.testCaseFindUnique },
+  }),
+}))
+
+vi.mock("@/server/ai-task/assigned-query", () => ({
+  fetchAssignedToMe: mocks.fetchAssignedToMe,
+  getDatabaseProvider: mocks.getDatabaseProvider,
+}))
+
+import {
+  listAiTasksFn,
+  listAssignedToMeFn,
+  getAiTaskFn,
+} from "@/server/serverFns/tasks/task-queries"
+
+function makeTaskRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "t1",
+    createdById: "u1",
+    workspaceId: null,
+    projectId: null,
+    title: "每日站会纪要",
+    instruction: "总结今天的动态",
+    sourceType: "story",
+    sourceId: "story-1",
+    status: "completed",
+    lastRunAt: new Date("2026-10-09T09:00:00.000Z"),
+    lastRunId: "run-2",
+    scheduleCron: null,
+    scheduleTimezone: null,
+    maxRuns: null,
+    runCount: 2,
+    nextRunAt: null,
+    createdAt: new Date("2026-10-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-10-09T09:00:00.000Z"),
+    ...overrides,
+  }
+}
+
+function makeRunRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "run-1",
+    taskId: "t1",
+    trigger: "manual",
+    status: "completed",
+    resultSummary: "完成",
+    error: null,
+    parentRunId: null,
+    startedAt: new Date("2026-10-08T09:00:00.000Z"),
+    finishedAt: new Date("2026-10-08T09:00:05.000Z"),
+    durationMs: 5000,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: "u1" } })
+  mocks.getDatabaseProvider.mockReturnValue("postgresql")
+  mocks.projectFindUnique.mockResolvedValue(null)
+})
+
+describe("task-queries serverFns", () => {
+  it("三个 serverFn 均为 GET method", () => {
+    expect((listAssignedToMeFn as any)._method).toBe("GET")
+    expect((listAiTasksFn as any)._method).toBe("GET")
+    expect((getAiTaskFn as any)._method).toBe("GET")
+  })
+})
+
+describe("listAssignedToMeFn", () => {
+  it("透传 fetchAssignedToMe(userId) 的 AssignedResult", async () => {
+    const assigned = {
+      items: [
+        {
+          source: "story",
+          id: "story-1",
+          identifier: "ALB-S12",
+          title: "登录页重构",
+          projectId: "project-1",
+          projectName: "理想之海",
+          priority: "P1",
+          dueAt: null,
+          href: "/stories/story-1",
+          updatedAt: "2026-10-08T10:00:00.000Z",
+        },
+      ],
+      degraded: [] as string[],
+    }
+    mocks.fetchAssignedToMe.mockResolvedValue(assigned)
+
+    const result = await listAssignedToMeFn()
+
+    expect(mocks.requireAuth).toHaveBeenCalledTimes(1)
+    expect(mocks.fetchAssignedToMe).toHaveBeenCalledWith("u1")
+    expect(result).toBe(assigned)
+  })
+
+  it("未登录（requireAuth 抛错）直接拒绝，不触 fetchAssignedToMe", async () => {
+    mocks.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"))
+
+    await expect(listAssignedToMeFn()).rejects.toThrow("UNAUTHORIZED")
+    expect(mocks.fetchAssignedToMe).not.toHaveBeenCalled()
+  })
+})
+
+describe("listAiTasksFn", () => {
+  it("where createdById + updatedAt 倒序 + 列表字段 select，日期转 ISO string", async () => {
+    mocks.aiTaskFindMany.mockResolvedValue([
+      {
+        id: "t1",
+        title: "任务一",
+        instruction: "总结今天的动态",
+        status: "completed",
+        runCount: 2,
+        lastRunAt: new Date("2026-10-09T10:00:00.000Z"),
+        sourceType: "story",
+        sourceId: "story-1",
+        updatedAt: new Date("2026-10-09T10:00:00.000Z"),
+      },
+      {
+        id: "t2",
+        title: "任务二",
+        instruction: null,
+        status: "backlog",
+        runCount: 0,
+        lastRunAt: null,
+        sourceType: null,
+        sourceId: null,
+        updatedAt: new Date("2026-10-08T10:00:00.000Z"),
+      },
+    ])
+
+    const result = await listAiTasksFn()
+
+    expect(mocks.requireAuth).toHaveBeenCalledTimes(1)
+    expect(mocks.aiTaskFindMany).toHaveBeenCalledWith({
+      where: { createdById: "u1" },
+      orderBy: { updatedAt: "desc" },
+      select: {
+        id: true,
+        title: true,
+        instruction: true,
+        status: true,
+        runCount: true,
+        lastRunAt: true,
+        sourceType: true,
+        sourceId: true,
+        updatedAt: true,
+      },
+    })
+    // 非 sqlite 路径不声明 degraded（degraded?: boolean 可选语义）
+    expect(result).toEqual({
+      items: [
+        {
+          id: "t1",
+          title: "任务一",
+          instruction: "总结今天的动态",
+          status: "completed",
+          runCount: 2,
+          lastRunAt: "2026-10-09T10:00:00.000Z",
+          sourceType: "story",
+          sourceId: "story-1",
+          updatedAt: "2026-10-09T10:00:00.000Z",
+        },
+        {
+          id: "t2",
+          title: "任务二",
+          instruction: null,
+          status: "backlog",
+          runCount: 0,
+          lastRunAt: null,
+          sourceType: null,
+          sourceId: null,
+          updatedAt: "2026-10-08T10:00:00.000Z",
+        },
+      ],
+    })
+  })
+
+  it("sqlite provider 降级：{ items: [], degraded: true } 且不触 prisma.aiTask", async () => {
+    mocks.getDatabaseProvider.mockReturnValue("sqlite")
+
+    const result = await listAiTasksFn()
+
+    expect(result).toEqual({ items: [], degraded: true })
+    expect(mocks.aiTaskFindMany).not.toHaveBeenCalled()
+  })
+
+  it("未登录直接拒绝，不触 DB", async () => {
+    mocks.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"))
+
+    await expect(listAiTasksFn()).rejects.toThrow("UNAUTHORIZED")
+    expect(mocks.aiTaskFindMany).not.toHaveBeenCalled()
+  })
+})
+
+describe("getAiTaskFn", () => {
+  it("归属过滤放 where（id + createdById），非属主抛「任务不存在」", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(null)
+
+    await expect(getAiTaskFn({ data: { id: "t1" } })).rejects.toThrow("任务不存在")
+    expect(mocks.aiTaskFindFirst).toHaveBeenCalledWith({
+      where: { id: "t1", createdById: "u1" },
+    })
+    expect(mocks.aiTaskRunFindMany).not.toHaveBeenCalled()
+  })
+
+  it("validator：id 为空字符串拒绝", async () => {
+    await expect(getAiTaskFn({ data: { id: "" } })).rejects.toThrow()
+    expect(mocks.aiTaskFindFirst).not.toHaveBeenCalled()
+  })
+
+  it("属主命中：返回全字段 task（Date→ISO string）+ runs（startedAt 倒序）", async () => {
+    const runLatest = makeRunRow({
+      id: "run-2",
+      startedAt: new Date("2026-10-09T09:00:00.000Z"),
+      finishedAt: new Date("2026-10-09T09:00:30.000Z"),
+      durationMs: 30000,
+    })
+    mocks.aiTaskFindFirst.mockResolvedValue(makeTaskRow())
+    // DB 侧 orderBy startedAt desc，mock 按该顺序返回
+    mocks.aiTaskRunFindMany.mockResolvedValue([runLatest, makeRunRow()])
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(mocks.aiTaskRunFindMany).toHaveBeenCalledWith({
+      where: { taskId: "t1" },
+      orderBy: { startedAt: "desc" },
+    })
+    expect(result.runs).toEqual([runLatest, makeRunRow()])
+    expect(result.task).toEqual({
+      ...makeTaskRow(),
+      lastRunAt: "2026-10-09T09:00:00.000Z",
+      nextRunAt: null,
+      createdAt: "2026-10-01T00:00:00.000Z",
+      updatedAt: "2026-10-09T09:00:00.000Z",
+      // projectId null（makeTaskRow 默认）→ 不查项目，projectName null
+      projectName: null,
+    })
+    expect(mocks.projectFindUnique).not.toHaveBeenCalled()
+  })
+
+  it("关联项目：projectId 存在时查项目名，task 附 projectName", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(makeTaskRow({ projectId: "project-1" }))
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+    mocks.projectFindUnique.mockResolvedValue({ name: "理想之海" })
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(mocks.projectFindUnique).toHaveBeenCalledWith({
+      where: { id: "project-1" },
+      select: { name: true },
+    })
+    expect(result.task.projectName).toBe("理想之海")
+  })
+
+  it("关联项目已被删除（查询落空）：projectName null 兜底", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(makeTaskRow({ projectId: "project-gone" }))
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+    mocks.projectFindUnique.mockResolvedValue(null)
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(result.task.projectName).toBeNull()
+  })
+
+  it("源型任务：探测源表存在性（story 命中 → true）", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(makeTaskRow())
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+    mocks.storyFindUnique.mockResolvedValue({ id: "story-1" })
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(mocks.storyFindUnique).toHaveBeenCalledWith({
+      where: { id: "story-1" },
+      select: { id: true },
+    })
+    expect(result.sourceExists).toBe(true)
+  })
+
+  it("源条目已被删除：sourceExists false", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(makeTaskRow())
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+    mocks.storyFindUnique.mockResolvedValue(null)
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(result.sourceExists).toBe(false)
+  })
+
+  it("bug / testcase 源型分别探测对应表", async () => {
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+    mocks.bugFindUnique.mockResolvedValue({ id: "bug-1" })
+    mocks.aiTaskFindFirst.mockResolvedValue(
+      makeTaskRow({ id: "t2", sourceType: "bug", sourceId: "bug-1" }),
+    )
+    await expect(getAiTaskFn({ data: { id: "t2" } })).resolves.toMatchObject({
+      sourceExists: true,
+    })
+    expect(mocks.bugFindUnique).toHaveBeenCalledTimes(1)
+
+    mocks.testCaseFindUnique.mockResolvedValue({ id: "case-1" })
+    mocks.aiTaskFindFirst.mockResolvedValue(
+      makeTaskRow({ id: "t3", sourceType: "testcase", sourceId: "case-1" }),
+    )
+    await expect(getAiTaskFn({ data: { id: "t3" } })).resolves.toMatchObject({
+      sourceExists: true,
+    })
+    expect(mocks.testCaseFindUnique).toHaveBeenCalledTimes(1)
+  })
+
+  it("非源型任务（sourceType null）：sourceExists null，不触源表", async () => {
+    mocks.aiTaskFindFirst.mockResolvedValue(
+      makeTaskRow({ sourceType: null, sourceId: null }),
+    )
+    mocks.aiTaskRunFindMany.mockResolvedValue([])
+
+    const result = await getAiTaskFn({ data: { id: "t1" } })
+
+    expect(result.sourceExists).toBeNull()
+    expect(mocks.storyFindUnique).not.toHaveBeenCalled()
+    expect(mocks.bugFindUnique).not.toHaveBeenCalled()
+    expect(mocks.testCaseFindUnique).not.toHaveBeenCalled()
+  })
+
+  it("未登录直接拒绝，不触 DB", async () => {
+    mocks.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"))
+
+    await expect(getAiTaskFn({ data: { id: "t1" } })).rejects.toThrow("UNAUTHORIZED")
+    expect(mocks.aiTaskFindFirst).not.toHaveBeenCalled()
+  })
+})

package/src/server/__tests__/testcase-board.test.ts

@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 用例看板后端测试（UI 对齐二期 PR-7a 任务 25，P0-1 补齐）。三断言钉死：
+// ① listTestCaseBoardColumnsFn 按 state 分组返回各列条目（列序 = 请求序、
+//   列过滤进 where.AND）+ 列级 cursor 翻页（skip:1 + cursor id，照列表
+//   cursor 分页同构；nextCursor 满 take 才给）；
+// ② reorderTestCasesFn 越权 id 静默跳过（可见项目集过滤进 where，SEC-03
+//   同构 reorderStoriesFn）、成员 id 经 $transaction updateMany 更新 boardOrder；
+// ③ listTestCasesFn orderBy=manual 时 SQL 排序走 boardOrder（复审 P1-3 归宿：
+//   field-configs TESTCASE_ORDER_FIELD_MAP 临时映射移除后服务端直连），
+//   缺省保持既有 sequenceId asc + id tiebreaker（boardOrder 大量同值
+//   @default(0)，[主键, id] 全序确定 cursor 翻页不抖动，bug/story 同构）。
+// mock 边界（照 testcase-list-scope.test.ts）：只 mock prisma/鉴权层，
+// resolveStoryScopeProjectIds 与 buildListWhere 走真实现——接线端到端，
+// 断言 prisma findMany/updateMany 实际收到的 where/orderBy/cursor。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const H = vi.hoisted(() => {
+  const fns = {
+    requireAuth: vi.fn(),
+    isUserInTeam: vi.fn(),
+  };
+  const db = {
+    // @allbluecn/database 主入口（scope 解析真实现依赖）
+    memberFindUnique: vi.fn(),
+    memberFindMany: vi.fn(),
+    projectFindFirst: vi.fn(),
+    // getPrisma 面（serverFn handler 依赖）
+    caseFindMany: vi.fn(),
+    caseUpdateMany: vi.fn(),
+    reorderMemberFindMany: vi.fn(),
+    transaction: vi.fn(),
+  };
+  return { fns, db };
+});
+const M = H.fns;
+const DB = H.db;
+
+vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
+  const createServerFn = () => {
+    const capture: { validator?: unknown; handler?: unknown } = {};
+    const api = {
+      validator: (v: unknown) => {
+        capture.validator = v;
+        return api;
+      },
+      handler: (h: unknown) => {
+        capture.handler = h;
+        return async (args?: { data?: unknown }) => {
+          const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
+          const data = v && v.parse ? v.parse(args?.data) : args?.data;
+          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+        };
+      },
+    };
+    return api;
+  };
+  return { createServerFn };
+});
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: H.fns.requireAuth }));
+vi.mock("@/server/team-access", () => ({ isUserInTeam: H.fns.isUserInTeam }));
+
+// 成员关系/项目查询层：resolveStoryScopeProjectIds（真实现）依赖此 mock
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    project: { findFirst: H.db.projectFindFirst },
+    projectMember: {
+      findUnique: H.db.memberFindUnique,
+      findMany: H.db.memberFindMany,
+    },
+  },
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    testCase: { findMany: H.db.caseFindMany, updateMany: H.db.caseUpdateMany },
+    projectMember: { findMany: H.db.reorderMemberFindMany },
+    $transaction: H.db.transaction,
+  }),
+}));
+
+import { listTestCaseBoardColumnsFn } from "@/server/serverFns/testcase/testcase-board";
+import { reorderTestCasesFn } from "@/server/serverFns/testcase/testcase-reorder";
+import { listTestCasesFn } from "@/server/serverFns/testcase/testcase-crud";
+
+const U = "u-1";
+const INDEPENDENT = "pr-independent";
+
+/** castTestCase 输入形态的最小行工厂（Date 字段 + user brief + AvatarConfig null） */
+function makeRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "c1",
+    sequenceId: 1,
+    identifier: "PRJ-TC1",
+    projectId: "p1",
+    folderId: null,
+    storyId: null,
+    title: "登录校验",
+    precondition: null,
+    steps: [],
+    type: "functional",
+    priority: "p2",
+    state: "draft",
+    version: 1,
+    automation: "not_automated",
+    aiGenerated: false,
+    boardOrder: 0,
+    assignee: null,
+    createdBy: {
+      id: "u2",
+      username: "alice",
+      email: "a@x.com",
+      avatarConfig: null,
+      bgShape: "circle",
+      bgColor: "blue",
+    },
+    archived: false,
+    archivedAt: null,
+    createdAt: new Date("2026-01-01T00:00:00Z"),
+    updatedAt: new Date("2026-01-02T00:00:00Z"),
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  DB.caseFindMany.mockResolvedValue([]);
+  DB.caseUpdateMany.mockResolvedValue({ count: 0 });
+  // reorder 的可见项目集（SEC-03）与 scope 解析聚合各自独立 mock
+  DB.reorderMemberFindMany.mockResolvedValue([{ projectId: "p1" }]);
+  DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }]);
+  DB.transaction.mockImplementation(async (arg: unknown) =>
+    Array.isArray(arg) ? Promise.all(arg as unknown[]) : undefined,
+  );
+});
+
+describe("listTestCaseBoardColumnsFn（看板列查询）", () => {
+  it("① 按 state 分组返回各列条目：列序 = 请求序，列过滤进 where.AND", async () => {
+    DB.caseFindMany.mockImplementation(async (args: {
+      where: { AND: Record<string, unknown>[] };
+    }) => {
+      const group = args.where.AND.find((c) => "state" in c) as { state: string };
+      if (group.state === "draft") {
+        return [
+          makeRow({ id: "d1", state: "draft", boardOrder: 3 }),
+          makeRow({ id: "d2", state: "draft" }),
+        ];
+      }
+      return [makeRow({ id: "a1", state: "approved" })];
+    });
+
+    const result = await listTestCaseBoardColumnsFn({
+      data: { groupBy: "state", columns: [{ key: "draft" }, { key: "approved" }], take: 2 },
+    });
+
+    expect(DB.caseFindMany).toHaveBeenCalledTimes(2);
+    const [draftArgs, approvedArgs] = DB.caseFindMany.mock.calls.map(
+      (c) => c[0] as { where: Record<string, unknown> },
+    );
+    expect(draftArgs.where.projectId).toEqual({ in: ["p1"] });
+    expect(draftArgs.where.archived).toBe(false);
+    expect(draftArgs.where.AND).toEqual([{ state: "draft" }]);
+    expect(approvedArgs.where.AND).toEqual([{ state: "approved" }]);
+    expect(result.columns).toEqual([
+      {
+        key: "draft",
+        items: [
+          expect.objectContaining({ id: "d1", boardOrder: 3 }),
+          expect.objectContaining({ id: "d2" }),
+        ],
+        nextCursor: "d2",
+      },
+      { key: "approved", items: [expect.objectContaining({ id: "a1" })], nextCursor: null },
+    ]);
+  });
+
+  it("① 列级 cursor 翻页：cursor 转义为 skip:1 + cursor id（同列表 cursor 分页）", async () => {
+    await listTestCaseBoardColumnsFn({
+      data: { groupBy: "state", columns: [{ key: "draft", cursor: "d2" }] },
+    });
+    expect(DB.caseFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({ skip: 1, cursor: { id: "d2" }, take: 100 }),
+    );
+  });
+
+  it("① 缺省排序 manual：SQL [boardOrder asc, id asc]（tiebreaker 全序确定）", async () => {
+    await listTestCaseBoardColumnsFn({
+      data: { groupBy: "state", columns: [{ key: "draft" }] },
+    });
+    expect(DB.caseFindMany.mock.calls[0][0]).toEqual(
+      expect.objectContaining({ orderBy: [{ boardOrder: "asc" }, { id: "asc" }] }),
+    );
+  });
+
+  it("① scope 与列表同构：缺省聚合成员项目；非成员单项目静默回退独立项目（不泄漏）", async () => {
+    DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p2" }]);
+    await listTestCaseBoardColumnsFn({
+      data: { groupBy: "state", columns: [{ key: "draft" }] },
+    });
+    expect(DB.caseFindMany.mock.calls[0][0].where.projectId).toEqual({ in: ["p1", "p2"] });
+
+    DB.memberFindUnique.mockResolvedValue(null);
+    DB.projectFindFirst.mockResolvedValue({ id: INDEPENDENT });
+    await listTestCaseBoardColumnsFn({
+      data: { projectId: "pr-other", groupBy: "state", columns: [{ key: "draft" }] },
+    });
+    const where = DB.caseFindMany.mock.calls[1][0].where;
+    expect(where.projectId).toEqual({ in: [INDEPENDENT] });
+    expect(JSON.stringify(where)).not.toContain("pr-other");
+  });
+});
+
+describe("reorderTestCasesFn（SEC-03 可见性过滤，同构 reorderStoriesFn）", () => {
+  it("② 成员正常排序：$transaction 内 updateMany 更新 boardOrder（where 带可见项目集）", async () => {
+    await reorderTestCasesFn({ data: { items: [{ id: "c1", boardOrder: 5 }] } });
+    expect(DB.caseUpdateMany).toHaveBeenCalledWith({
+      where: { id: "c1", projectId: { in: ["p1"] } },
+      data: { boardOrder: 5 },
+    });
+    expect(DB.transaction).toHaveBeenCalledTimes(1);
+  });
+
+  it("② 越权 id 静默跳过：混入非成员项目 id 不中断整批，where 全带可见项目集", async () => {
+    await reorderTestCasesFn({
+      data: { items: [{ id: "mine", boardOrder: 1 }, { id: "foreign", boardOrder: 2 }] },
+    });
+    const ids = DB.caseUpdateMany.mock.calls.map((c) => (c[0] as { where: { id: string } }).where.id);
+    expect(ids).toEqual(["mine", "foreign"]);
+    for (const call of DB.caseUpdateMany.mock.calls) {
+      expect((call[0] as { where: { projectId: unknown } }).where.projectId).toEqual({
+        in: ["p1"],
+      });
+    }
+  });
+
+  it("② 非任何项目成员：可见集为空数组（updateMany 零命中语义）", async () => {
+    DB.reorderMemberFindMany.mockResolvedValue([]);
+    await reorderTestCasesFn({ data: { items: [{ id: "c1", boardOrder: 1 }] } });
+    expect(DB.caseUpdateMany).toHaveBeenCalledWith({
+      where: { id: "c1", projectId: { in: [] } },
+      data: { boardOrder: 1 },
+    });
+  });
+
+  it("未登录拒绝且不查询成员关系", async () => {
+    M.requireAuth.mockRejectedValue(new Error("unauthorized"));
+    await expect(
+      reorderTestCasesFn({ data: { items: [{ id: "c1", boardOrder: 1 }] } }),
+    ).rejects.toThrow("unauthorized");
+    expect(DB.reorderMemberFindMany).not.toHaveBeenCalled();
+    expect(DB.caseUpdateMany).not.toHaveBeenCalled();
+  });
+  it("② items 超 500 条：validator 拒绝（zod max），零 updateMany", async () => {
+    const items = Array.from({ length: 501 }, (_, i) => ({ id: `c-${i}`, boardOrder: i }));
+    await expect(reorderTestCasesFn({ data: { items } })).rejects.toThrow();
+    expect(DB.caseUpdateMany).not.toHaveBeenCalled();
+  });
+});
+
+describe("listTestCasesFn orderBy（P1-3 归宿：manual 直连 boardOrder）", () => {
+  it("③ orderBy=manual：SQL 排序走 boardOrder", async () => {
+    await listTestCasesFn({ data: { orderBy: "manual" } });
+    expect(DB.caseFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({ orderBy: [{ boardOrder: "asc" }, { id: "asc" }] }),
+    );
+  });
+
+  it("③ 缺省保持既有行为：sequenceId asc + id tiebreaker", async () => {
+    await listTestCasesFn({ data: {} });
+    expect(DB.caseFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({ orderBy: [{ sequenceId: "asc" }, { id: "asc" }] }),
+    );
+  });
+
+  it("③ orderDir=desc 透传主键方向（id tiebreaker 恒 asc）", async () => {
+    await listTestCasesFn({ data: { orderBy: "updated", orderDir: "desc" } });
+    expect(DB.caseFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({ orderBy: [{ updatedAt: "desc" }, { id: "asc" }] }),
+    );
+  });
+});