@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/serverFns/bug/__tests__/bug-list-query.test.ts

@@ -31,6 +31,14 @@ describe("buildListWhere 基础矩阵", () => {
     expect(buildListWhere({ userId: "u1" })).toEqual({ archived: false, pendingConfirm: false });
   });
 
+  it("projectIds 聚合（「全部项目」）→ in 过滤，优先于单个 projectId", () => {
+    expect(buildListWhere({ userId: "u1", projectId: "p1", projectIds: ["p1", "p2"] })).toEqual({
+      archived: false,
+      pendingConfirm: false,
+      projectId: { in: ["p1", "p2"] },
+    });
+  });
+
   it("projectId __archived__ 特殊值 → 归档视图（archived: true + 按成员关系圈定可见项目）", () => {
     expect(buildListWhere({ userId: "u1", projectId: "__archived__" })).toEqual({
       archived: true,
@@ -50,6 +58,19 @@ describe("buildListWhere 基础矩阵", () => {
 });
 
 describe("buildListWhere filters 翻译", () => {
+  it("畸形条件混入合法条件：畸形单条跳过，合法条件仍生效（per-condition 守卫）", () => {
+    const where = buildListWhere({
+      userId: "u1",
+      filters: JSON.stringify([
+        null,
+        42,
+        { property: "severity", operator: "is" },
+        { property: "severity", operator: "is", value: "high" },
+      ]),
+    });
+    expect(where.AND).toEqual([{ severity: "high" }]);
+  });
+
   it("severity is_any_of 多值 → AND in", () => {
     const where = buildListWhere({
       userId: "u1",

package/src/server/serverFns/bug/__tests__/bug-reactions.test.ts

@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// BUG 评论表情域：3 个 serverFn（list/add/toggle）照 story-reactions 同构，
+// 权限口径换成评论所属 bug 的项目有效成员（任务 3 谓词，suspended 视同无权）。
+// 核心断言：toggle 幂等（同 emoji 二次删除）、add 走三元组复合唯一 upsert
+// （并发/重复添加不产生重复行）、非项目成员 403 语义拒绝。mock 骨架同
+// bug-access-tokens.test.ts 样板。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+        return wrapped;
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => ({}),
+}));
+
+const mocks = vi.hoisted(() => ({
+  currentSession: vi.fn(),
+  bugCommentFindUnique: vi.fn(),
+  bugCommentReactionFindMany: vi.fn(),
+  bugCommentReactionFindUnique: vi.fn(),
+  bugCommentReactionCreate: vi.fn(),
+  bugCommentReactionUpsert: vi.fn(),
+  bugCommentReactionDelete: vi.fn(),
+  projectMemberFindUnique: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
+    bugComment: { findUnique: mocks.bugCommentFindUnique },
+    bugCommentReaction: {
+      findMany: mocks.bugCommentReactionFindMany,
+      findUnique: mocks.bugCommentReactionFindUnique,
+      create: mocks.bugCommentReactionCreate,
+      upsert: mocks.bugCommentReactionUpsert,
+      delete: mocks.bugCommentReactionDelete,
+    },
+    projectMember: { findUnique: mocks.projectMemberFindUnique },
+  };
+  return { prisma, Prisma: {} };
+});
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.currentSession,
+}));
+
+import {
+  addBugCommentReactionFn,
+  listBugCommentReactionsFn,
+  toggleBugCommentReactionFn,
+} from "../bug-reactions";
+
+const USER = "u-current";
+const OTHER = "u-other";
+const COMMENT_ID = "bc1";
+const EMOJI = "👍";
+
+const reactionRow = (over: Record<string, unknown> = {}) => ({
+  emoji: EMOJI,
+  userId: USER,
+  ...over,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue({ user: { id: USER } });
+  // 成员放行默认桩：评论 → bug → p1，membership → active
+  mocks.bugCommentFindUnique.mockResolvedValue({ bug: { projectId: "p1" } });
+  mocks.projectMemberFindUnique.mockResolvedValue({ status: "active" });
+  mocks.bugCommentReactionFindMany.mockResolvedValue([]);
+  mocks.bugCommentReactionFindUnique.mockResolvedValue(null);
+  mocks.bugCommentReactionCreate.mockResolvedValue({});
+  mocks.bugCommentReactionUpsert.mockResolvedValue({});
+  mocks.bugCommentReactionDelete.mockResolvedValue({});
+});
+
+describe("listBugCommentReactionsFn", () => {
+  it("反查评论所属项目并按 emoji 聚合，标记当前用户已表态", async () => {
+    mocks.bugCommentReactionFindMany.mockResolvedValue([
+      reactionRow({ userId: USER }),
+      reactionRow({ userId: OTHER }),
+      reactionRow({ emoji: "🎉", userId: OTHER }),
+    ]);
+
+    const res = await listBugCommentReactionsFn({ data: { commentId: COMMENT_ID } });
+
+    expect(mocks.bugCommentFindUnique).toHaveBeenCalledWith({
+      where: { id: COMMENT_ID },
+      select: { bug: { select: { projectId: true } } },
+    });
+    expect(mocks.bugCommentReactionFindMany).toHaveBeenCalledWith({
+      where: { commentId: COMMENT_ID },
+      select: { emoji: true, userId: true },
+    });
+    expect(res).toEqual([
+      { emoji: EMOJI, count: 2, userIds: [USER, OTHER], reacted: true },
+      { emoji: "🎉", count: 1, userIds: [OTHER], reacted: false },
+    ]);
+  });
+
+  it("无 reaction 时返回空数组", async () => {
+    const res = await listBugCommentReactionsFn({ data: { commentId: COMMENT_ID } });
+    expect(res).toEqual([]);
+  });
+
+  it("评论不存在拒绝且不查询 reaction", async () => {
+    mocks.bugCommentFindUnique.mockResolvedValue(null);
+    await expect(
+      listBugCommentReactionsFn({ data: { commentId: "missing" } }),
+    ).rejects.toThrow("评论不存在");
+    expect(mocks.bugCommentReactionFindMany).not.toHaveBeenCalled();
+  });
+
+  it("非项目成员拒绝且不查询 reaction（403 语义）", async () => {
+    mocks.projectMemberFindUnique.mockResolvedValue(null);
+    await expect(
+      listBugCommentReactionsFn({ data: { commentId: COMMENT_ID } }),
+    ).rejects.toThrow("无权限操作该项目的 BUG");
+    expect(mocks.bugCommentReactionFindMany).not.toHaveBeenCalled();
+  });
+
+  it("suspended 成员视同无权", async () => {
+    mocks.projectMemberFindUnique.mockResolvedValue({ status: "suspended" });
+    await expect(
+      listBugCommentReactionsFn({ data: { commentId: COMMENT_ID } }),
+    ).rejects.toThrow("无权限操作该项目的 BUG");
+  });
+
+  it("未登录拒绝且不查询评论归属", async () => {
+    mocks.currentSession.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      listBugCommentReactionsFn({ data: { commentId: COMMENT_ID } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(mocks.bugCommentFindUnique).not.toHaveBeenCalled();
+  });
+});
+
+describe("addBugCommentReactionFn", () => {
+  it("upsert 走 commentId_userId_emoji 三元组复合唯一键且 update 置空", async () => {
+    mocks.bugCommentReactionFindMany.mockResolvedValue([reactionRow({ userId: USER })]);
+
+    const res = await addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } });
+
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenCalledWith({
+      where: {
+        commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+      },
+      update: {},
+      create: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    });
+    expect(res).toEqual([
+      { emoji: EMOJI, count: 1, userIds: [USER], reacted: true },
+    ]);
+  });
+
+  it("重复添加同 emoji 不产生重复行（幂等，命中唯一约束走跳过）", async () => {
+    // 模拟 DB 三元组唯一约束：两次 upsert 后该评论仍只有一行
+    mocks.bugCommentReactionFindMany.mockResolvedValue([reactionRow({ userId: USER })]);
+
+    await addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } });
+    await addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } });
+
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenCalledTimes(2);
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenNthCalledWith(1, {
+      where: {
+        commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+      },
+      update: {},
+      create: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    });
+    // 第二次与第一次完全同参——update:{} 语义下已存在即跳过
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenNthCalledWith(2, {
+      where: {
+        commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+      },
+      update: {},
+      create: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    });
+    // 聚合结果仍为 1 人 1 票（findMany 桩模拟唯一约束生效）
+    expect(mocks.bugCommentReactionFindMany).toHaveBeenCalledTimes(2);
+  });
+
+  it("评论不存在拒绝且不写入", async () => {
+    mocks.bugCommentFindUnique.mockResolvedValue(null);
+    await expect(
+      addBugCommentReactionFn({ data: { commentId: "missing", emoji: EMOJI } }),
+    ).rejects.toThrow("评论不存在");
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+  });
+
+  it("非项目成员拒绝且不写入（403 语义）", async () => {
+    mocks.projectMemberFindUnique.mockResolvedValue(null);
+    await expect(
+      addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } }),
+    ).rejects.toThrow("无权限操作该项目的 BUG");
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionFindMany).not.toHaveBeenCalled();
+  });
+
+  it("空 emoji 被 validator 拒绝（不落库）", async () => {
+    await expect(
+      addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: "" } }),
+    ).rejects.toThrow();
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+  });
+
+  it("未登录拒绝且不写库", async () => {
+    mocks.currentSession.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      addBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+  });
+});
+
+describe("toggleBugCommentReactionFn", () => {
+  it("同 emoji 二次 toggle 删除（幂等），聚合随之消长", async () => {
+    // 第一次：无既有表态 → create，聚合为当前用户 1 票
+    mocks.bugCommentReactionFindMany.mockResolvedValueOnce([reactionRow({ userId: USER })]);
+    const first = await toggleBugCommentReactionFn({
+      data: { commentId: COMMENT_ID, emoji: EMOJI },
+    });
+
+    expect(mocks.bugCommentReactionFindUnique).toHaveBeenCalledWith({
+      where: {
+        commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+      },
+    });
+    expect(mocks.bugCommentReactionCreate).toHaveBeenCalledWith({
+      data: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    });
+    expect(first).toEqual([{ emoji: EMOJI, count: 1, userIds: [USER], reacted: true }]);
+
+    // 第二次：已有本人表态 → 按 id 删除，他人表态保留
+    mocks.bugCommentReactionFindUnique.mockResolvedValueOnce({
+      id: "r1",
+      commentId: COMMENT_ID,
+      userId: USER,
+      emoji: EMOJI,
+    });
+    mocks.bugCommentReactionFindMany.mockResolvedValueOnce([reactionRow({ userId: OTHER })]);
+    const second = await toggleBugCommentReactionFn({
+      data: { commentId: COMMENT_ID, emoji: EMOJI },
+    });
+
+    expect(mocks.bugCommentReactionDelete).toHaveBeenCalledWith({ where: { id: "r1" } });
+    expect(second).toEqual([{ emoji: EMOJI, count: 1, userIds: [OTHER], reacted: false }]);
+  });
+
+  it("toggle 不影响他人既有表态的聚合", async () => {
+    // 本人 toggle：既有的是他人表态 → 本人走 create 路径
+    mocks.bugCommentReactionFindUnique.mockResolvedValueOnce(null);
+    mocks.bugCommentReactionFindMany.mockResolvedValueOnce([
+      reactionRow({ userId: OTHER }),
+      reactionRow({ userId: USER }),
+    ]);
+
+    const res = await toggleBugCommentReactionFn({
+      data: { commentId: COMMENT_ID, emoji: EMOJI },
+    });
+
+    expect(mocks.bugCommentReactionCreate).toHaveBeenCalledTimes(1);
+    expect(mocks.bugCommentReactionDelete).not.toHaveBeenCalled();
+    expect(res).toEqual([{ emoji: EMOJI, count: 2, userIds: [OTHER, USER], reacted: true }]);
+  });
+
+  it("评论不存在拒绝且不写入", async () => {
+    mocks.bugCommentFindUnique.mockResolvedValue(null);
+    await expect(
+      toggleBugCommentReactionFn({ data: { commentId: "missing", emoji: EMOJI } }),
+    ).rejects.toThrow("评论不存在");
+    expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionCreate).not.toHaveBeenCalled();
+  });
+
+  it("非项目成员拒绝且不写入（403 语义）", async () => {
+    mocks.projectMemberFindUnique.mockResolvedValue(null);
+    await expect(
+      toggleBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } }),
+    ).rejects.toThrow("无权限操作该项目的 BUG");
+    expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionCreate).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionDelete).not.toHaveBeenCalled();
+  });
+
+  it("空 emoji 被 validator 拒绝（不落库）", async () => {
+    await expect(
+      toggleBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: "" } }),
+    ).rejects.toThrow();
+    expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
+  });
+
+  it("未登录拒绝且不写库", async () => {
+    mocks.currentSession.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      toggleBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/bug/__tests__/bug-reorder.test.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// BUG 手动排序测试（UI 对齐三期 PR-10 任务 32）：
+// 1) BUG_ORDER_FIELD.manual 由 createdAt 改 boardOrder——buildBugOrderBy("manual")
+//    产出 SQL orderBy 参数断言（消费方 bug-groups.ts 两处 findMany 直传）；
+// 2) reorderBugsFn：$transaction 批量 updateMany + 可见项目集进 where
+//    （越权 id 匹配 0 行静默跳过，照 testcase-reorder 任务 25 同构）。
+// harness 照 testcase-board.test.ts 样板。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const H = vi.hoisted(() => {
+  const fns = {
+    requireAuth: vi.fn(),
+  };
+  const db = {
+    memberFindMany: vi.fn(),
+    bugUpdateMany: vi.fn(),
+    transaction: vi.fn(),
+  };
+  const prisma = {
+    projectMember: { findMany: db.memberFindMany },
+    bug: { updateMany: db.bugUpdateMany },
+    $transaction: db.transaction,
+  };
+  return { fns, db, prisma };
+});
+const M = H.fns;
+const DB = H.db;
+
+vi.mock("@tanstack/react-start", () => {
+  const createServerFn = () => {
+    const capture: { validator?: unknown; handler?: unknown } = {};
+    const api = {
+      validator: (v: unknown) => {
+        capture.validator = v;
+        return api;
+      },
+      handler: (h: unknown) => {
+        capture.handler = h;
+        return async (args?: { data?: unknown }) => {
+          const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
+          const data = v && v.parse ? v.parse(args?.data) : args?.data;
+          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+        };
+      },
+    };
+    return api;
+  };
+  return { createServerFn };
+});
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => H.prisma,
+}));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: H.fns.requireAuth }));
+
+import { buildBugOrderBy } from "../bug-group-query";
+import { reorderBugsFn } from "../bug-reorder";
+
+const U = "u-1";
+const VISIBLE = ["pr-1", "pr-2"];
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  DB.memberFindMany.mockResolvedValue(VISIBLE.map((projectId) => ({ projectId })));
+  DB.bugUpdateMany.mockResolvedValue({ count: 1 });
+  DB.transaction.mockImplementation(async (ops: Promise<unknown>[]) => Promise.all(ops));
+});
+
+describe("BUG_ORDER_FIELD.manual → boardOrder（任务 32）", () => {
+  it("manual 首排序键为 boardOrder（SQL orderBy 参数断言），id asc tiebreaker 兜底", () => {
+    expect(buildBugOrderBy("manual", "asc")).toEqual([{ boardOrder: "asc" }, { id: "asc" }]);
+    expect(buildBugOrderBy("manual", "desc")).toEqual([{ boardOrder: "desc" }, { id: "asc" }]);
+  });
+
+  it("created/updated/severity 映射不受 manual 改造影响", () => {
+    expect(buildBugOrderBy("created", "asc")).toEqual([{ createdAt: "asc" }, { id: "asc" }]);
+    expect(buildBugOrderBy("updated", "desc")).toEqual([{ updatedAt: "desc" }, { id: "asc" }]);
+    expect(buildBugOrderBy("severity", "asc")).toEqual([{ id: "asc" }]);
+  });
+});
+
+describe("reorderBugsFn", () => {
+  it("首行鉴权 + $transaction 批量 updateMany：[{id, boardOrder}] 逐项落库，可见项目集进 where", async () => {
+    const res = await reorderBugsFn({
+      data: {
+        items: [
+          { id: "b1", boardOrder: 0 },
+          { id: "b2", boardOrder: 5 },
+        ],
+      },
+    });
+
+    expect(M.requireAuth).toHaveBeenCalled();
+    expect(DB.memberFindMany).toHaveBeenCalledWith({
+      where: { userId: U, status: { not: "suspended" } },
+      select: { projectId: true },
+    });
+    expect(DB.transaction).toHaveBeenCalledTimes(1);
+    expect(DB.bugUpdateMany).toHaveBeenCalledTimes(2);
+    expect(DB.bugUpdateMany).toHaveBeenNthCalledWith(1, {
+      where: { id: "b1", projectId: { in: VISIBLE } },
+      data: { boardOrder: 0 },
+    });
+    expect(DB.bugUpdateMany).toHaveBeenNthCalledWith(2, {
+      where: { id: "b2", projectId: { in: VISIBLE } },
+      data: { boardOrder: 5 },
+    });
+    expect(res).toEqual({ success: true });
+  });
+
+  it("越权 id：projectId 过滤进 where 匹配 0 行静默跳过，不中断整批、仍返回 success", async () => {
+    DB.memberFindMany.mockResolvedValue([{ projectId: "pr-1" }]);
+    DB.bugUpdateMany.mockResolvedValue({ count: 0 });
+
+    const res = await reorderBugsFn({
+      data: {
+        items: [
+          { id: "b-mine", boardOrder: 1 },
+          { id: "b-other-project", boardOrder: 2 },
+        ],
+      },
+    });
+
+    // 每项都发 updateMany（不预筛 id），越权项由 where.projectId 匹配 0 行实现跳过
+    expect(DB.bugUpdateMany).toHaveBeenCalledTimes(2);
+    expect(DB.bugUpdateMany).toHaveBeenNthCalledWith(2, {
+      where: { id: "b-other-project", projectId: { in: ["pr-1"] } },
+      data: { boardOrder: 2 },
+    });
+    expect(res).toEqual({ success: true });
+  });
+
+  it("空 items 数组：零 updateMany，事务空跑仍返回 success", async () => {
+    const res = await reorderBugsFn({ data: { items: [] } });
+
+    expect(DB.bugUpdateMany).not.toHaveBeenCalled();
+    expect(res).toEqual({ success: true });
+  });
+
+  it("items 超 500 条：validator 拒绝（zod max），零 updateMany", async () => {
+    const items = Array.from({ length: 501 }, (_, i) => ({ id: `b-${i}`, boardOrder: i }));
+    await expect(reorderBugsFn({ data: { items } })).rejects.toThrow();
+    expect(DB.bugUpdateMany).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/bug/__tests__/bug-story.test.ts

@@ -51,6 +51,7 @@ const mocks = vi.hoisted(() => ({
   bugUpdate: vi.fn(),
   bugActivityCreate: vi.fn(),
   storyFindUnique: vi.fn(),
+  storyAggregate: vi.fn(),
   storyCreate: vi.fn(),
   storyActivityCreate: vi.fn(),
   projectFindUnique: vi.fn(),
@@ -60,7 +61,7 @@ vi.mock("@allbluecn/database", () => {
   const prisma = {
     bug: { findUnique: mocks.bugFindUnique, update: mocks.bugUpdate },
     bugActivity: { create: mocks.bugActivityCreate },
-    story: { findUnique: mocks.storyFindUnique, create: mocks.storyCreate },
+    story: { findUnique: mocks.storyFindUnique, aggregate: mocks.storyAggregate, create: mocks.storyCreate },
     storyActivity: { create: mocks.storyActivityCreate },
     project: { findUnique: mocks.projectFindUnique },
     sequenceCounter: { upsert: mocks.sequenceCounterUpsert },
@@ -131,6 +132,8 @@ beforeEach(() => {
   // createStoryInternal 发号链（Story 域裸 projectId scope）
   mocks.projectFindUnique.mockResolvedValue({ id: "p1", name: "Alpha", displayId: "ABC" });
   mocks.sequenceCounterUpsert.mockResolvedValue({ scope: "p1", seq: 1 });
+  // 发号自愈（#447）读存量 max：null → maxExisting=0
+  mocks.storyAggregate.mockResolvedValue({ _max: { sequenceId: null } });
 });
 
 describe("reproduceStepsToMarkdown", () => {

package/src/server/serverFns/bug/bug-comments.ts

@@ -23,7 +23,9 @@ import { requireAuth } from "@/server/auth-helpers";
 import type { AvatarConfig } from "@allbluecn/kernel";
 import { BUG_USER_BRIEF_SELECT } from "@/components/bug/types";
 import type { BugCommentWithReplies } from "@/components/bug/types";
+import type { ReactionGroup } from "@/components/story/types";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
+import { aggregateReactions } from "@/server/story/types";
 
 function castCommentUser(u: {
   id: string;
@@ -56,6 +58,7 @@ export const listCommentsFn = createServerFn({ method: "GET" })
         createdAt: true,
         updatedAt: true,
         user: { select: BUG_USER_BRIEF_SELECT },
+        reactions: { select: { emoji: true, userId: true } },
       },
     });
 
@@ -66,6 +69,7 @@ export const listCommentsFn = createServerFn({ method: "GET" })
       createdAt: c.createdAt.toISOString(),
       updatedAt: c.updatedAt.toISOString(),
       user: castCommentUser(c.user),
+      reactions: aggregateReactions(c.reactions, userId),
     }));
 
     // parentId 无效引用（指向不存在的评论）静默丢弃——孤儿不挂任何根，照 story 实际行为
@@ -135,6 +139,7 @@ export const createCommentFn = createServerFn({ method: "POST" })
       createdAt: comment.createdAt.toISOString(),
       updatedAt: comment.updatedAt.toISOString(),
       user: castCommentUser(comment.user),
+      reactions: [] as ReactionGroup[],
       replies: [],
     } satisfies BugCommentWithReplies;
   });