@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/serverFns/story/__tests__/story-list-query.test.ts

@@ -64,6 +64,13 @@ describe("buildListWhere", () => {
     });
   });
 
+  it("projectIds 聚合（「全部项目」）优先于单个 projectId", () => {
+    expect(buildListWhere({ archived: false, projectId: "p1", projectIds: ["p1", "p2"] })).toEqual({
+      archived: false,
+      projectId: { in: ["p1", "p2"] },
+    });
+  });
+
   it("labelId 单值/多值映射到 labels some", () => {
     expect(buildListWhere({ archived: false, labelId: "l1" })).toEqual({
       archived: false,
@@ -85,6 +92,19 @@ describe("buildListWhere", () => {
 });
 
 describe("buildListWhere filters 解析", () => {
+  it("畸形条件混入合法条件：畸形单条跳过，合法条件仍生效（per-condition 守卫）", () => {
+    const where = buildListWhere({
+      archived: false,
+      filters: JSON.stringify([
+        null,
+        42,
+        { property: "state", operator: "is" },
+        { property: "state", operator: "is_not", value: "done,cancelled" },
+      ]),
+    });
+    expect(where.AND).toEqual([{ state: { notIn: ["done", "cancelled"] } }]);
+  });
+
   it("filters state is_not → AND notIn", () => {
     const where = buildListWhere({
       archived: false,

package/src/server/serverFns/story/__tests__/story-search.test.ts

@@ -166,4 +166,9 @@ describe("reorderStoriesFn（SEC-03 可见性过滤）", () => {
     expect(mocks.memberFindMany).not.toHaveBeenCalled();
     expect(mocks.storyUpdateMany).not.toHaveBeenCalled();
   });
+  it("items 超 500 条：validator 拒绝（zod max），零 updateMany", async () => {
+    const items = Array.from({ length: 501 }, (_, i) => ({ id: `s-${i}`, boardOrder: i }));
+    await expect(reorderStoriesFn({ data: { items } })).rejects.toThrow();
+    expect(mocks.storyUpdateMany).not.toHaveBeenCalled();
+  });
 });

package/src/server/serverFns/story/__tests__/story-transfer.test.ts

@@ -49,12 +49,16 @@ vi.mock("@tanstack/react-start/server", () => ({
 const mocks = vi.hoisted(() => ({
   storyFindUnique: vi.fn(),
   storyFindMany: vi.fn(),
+  storyAggregate: vi.fn(),
   storyUpdate: vi.fn(),
   projectFindUnique: vi.fn(),
   sequenceCounterUpsert: vi.fn(),
+  sequenceCounterUpdate: vi.fn(),
   activityCreate: vi.fn(),
   memberFindUnique: vi.fn(),
   memberFindMany: vi.fn(),
+  collabDocumentDeleteMany: vi.fn(),
+  withCollabGuard: vi.fn(),
   currentSession: vi.fn(),
   resolveStoryScopeProjectId: vi.fn(),
   ensureBuiltinIndependentProject: vi.fn(),
@@ -65,15 +69,17 @@ vi.mock("@allbluecn/database", () => {
     story: {
       findUnique: mocks.storyFindUnique,
       findMany: mocks.storyFindMany,
+      aggregate: mocks.storyAggregate,
       update: mocks.storyUpdate,
     },
     project: { findUnique: mocks.projectFindUnique },
-    sequenceCounter: { upsert: mocks.sequenceCounterUpsert },
+    sequenceCounter: { upsert: mocks.sequenceCounterUpsert, update: mocks.sequenceCounterUpdate },
     storyActivity: { create: mocks.activityCreate },
     projectMember: {
       findUnique: mocks.memberFindUnique,
       findMany: mocks.memberFindMany,
     },
+    collabDocument: { deleteMany: mocks.collabDocumentDeleteMany },
     // $transaction(fn) 直接以 prisma 本身作为 tx 执行（tx.* 调用落到同一组 mock 上）
     $transaction: (cb: any) => cb(prisma),
   };
@@ -89,6 +95,13 @@ vi.mock("@/server/builtin-project", () => ({
   ensureBuiltinIndependentProject: mocks.ensureBuiltinIndependentProject,
 }));
 
+// §5.3 写入门卫（任务 21）mock 缺省 pass-through——本文件专注直写路径的
+// SEC-03/编号重分配行为；门卫三态语义在 update-story-guard.test.ts 专测
+vi.mock("@/server/collab/write-guard", () => ({
+  withCollabGuard: mocks.withCollabGuard,
+  COLLAB_GUARD_TTL_MS: 3000,
+}));
+
 import {
   transferStoryToProjectFn,
   transferStoryAsChildFn,
@@ -128,6 +141,9 @@ const storyRow = (over: Record<string, unknown> = {}) => ({
 beforeEach(() => {
   vi.clearAllMocks();
   mocks.currentSession.mockResolvedValue({ user: { id: USER } });
+  // 门卫缺省无快照 pass-through（非协同态零行为变化）
+  mocks.withCollabGuard.mockResolvedValue({ kind: "pass-through", reason: "no-snapshot" });
+  mocks.collabDocumentDeleteMany.mockResolvedValue({ count: 0 });
   // 成员关系默认：USER 属于 p-src，其余项目非成员
   mocks.memberFindUnique.mockImplementation(async (args: any) =>
     args.where.projectId_userId.projectId === P_SRC ? { status: "active" } : null,
@@ -140,6 +156,8 @@ beforeEach(() => {
   mocks.ensureBuiltinIndependentProject.mockResolvedValue(INDEPENDENT);
   mocks.storyFindMany.mockResolvedValue([]);
   mocks.activityCreate.mockResolvedValue({});
+  // 转移发号自愈（对齐需求域 #447）读目标项目存量 max：默认 null → maxExisting=0，走非自愈路径
+  mocks.storyAggregate.mockResolvedValue({ _max: { sequenceId: null } });
 });
 
 describe("transferStoryToProjectFn", () => {
@@ -161,6 +179,51 @@ describe("transferStoryToProjectFn", () => {
     expect(res.projectId).toBe(P_TARGET);
   });
 
+  it("转移发号自愈：目标项目计数器落后存量（seq=3/max=9）时跳到 max+1 并回写计数器，identifier 用自愈后序号", async () => {
+    mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    mocks.projectFindUnique.mockResolvedValue({ id: P_TARGET, name: "目标项目", displayId: "TGT" });
+    mocks.sequenceCounterUpsert.mockResolvedValue({ scope: P_TARGET, seq: 3 });
+    mocks.storyAggregate.mockResolvedValue({ _max: { sequenceId: 9 } });
+    mocks.storyUpdate.mockResolvedValue(storyRow({ projectId: P_TARGET, identifier: "TGT-10" }));
+
+    const res = await transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_TARGET } });
+
+    expect(mocks.storyAggregate).toHaveBeenCalledWith({
+      where: { projectId: P_TARGET },
+      _max: { sequenceId: true },
+    });
+    expect(mocks.sequenceCounterUpdate).toHaveBeenCalledWith({
+      where: { scope: P_TARGET },
+      data: { seq: 10 },
+    });
+    expect(mocks.storyUpdate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ sequenceId: 10, identifier: "TGT-10" }),
+      }),
+    );
+    expect(res.identifier).toBe("TGT-10");
+  });
+
+  it("转移发号正常领先（seq=3/max=1）时不自愈：不回写计数器，序号照用 3", async () => {
+    mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    mocks.projectFindUnique.mockResolvedValue({ id: P_TARGET, name: "目标项目", displayId: "TGT" });
+    mocks.sequenceCounterUpsert.mockResolvedValue({ scope: P_TARGET, seq: 3 });
+    mocks.storyAggregate.mockResolvedValue({ _max: { sequenceId: 1 } });
+    mocks.storyUpdate.mockResolvedValue(storyRow({ projectId: P_TARGET, identifier: "TGT-3" }));
+
+    const res = await transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_TARGET } });
+
+    expect(mocks.sequenceCounterUpdate).not.toHaveBeenCalled();
+    expect(mocks.storyUpdate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ sequenceId: 3, identifier: "TGT-3" }),
+      }),
+    );
+    expect(res.identifier).toBe("TGT-3");
+  });
+
   it("SEC-03：对目标项目非成员时拒绝且零写入", async () => {
     // 源项目 p-src 成员（默认 mock），目标 p-target 非成员
     mocks.storyFindUnique.mockResolvedValue(storyRow());

package/src/server/serverFns/story/index.ts

@@ -74,7 +74,6 @@ export {
   getStoryTreeFn,
   addChildFn,
   removeChildFn,
-  moveChildFn,
   getChildrenCountFn,
 } from "./story-tree";
 
@@ -87,6 +86,7 @@ export {
   updateDependencyFn,
   removeDependencyFn,
   getDependenciesFn,
+  listStoryDependenciesFn,
 } from "./story-dependencies";
 
 export {
@@ -104,7 +104,7 @@ export {
 } from "./story-attachments";
 
 export {
-  linkDesignFn,
+  linkDesignsFn,
   unlinkDesignFn,
   getLinkedDesignsFn,
   searchDesignsFn,

package/src/server/serverFns/story/story-assoc.ts

@@ -66,8 +66,10 @@ import {
   type SearchDocRow as SearchDocRow_,
 } from "@/server/knowledge/kb-doc-search";
 
-export const linkDesignFn = createServerFn({ method: "POST" })
-  .validator(z.object({ storyId: z.string(), designId: z.string() }))
+// 批量关联设计（PRD 文档与 UI 画板同源 Design 表，链接统一落 storyDesignLink）。
+// 设计单属主：仅本人未删除设计可关联（口径同 searchDesignsFn），越界 id 归 failed。
+export const linkDesignsFn = createServerFn({ method: "POST" })
+  .validator(z.object({ storyId: z.string(), designIds: z.array(z.string()).min(1) }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
@@ -76,21 +78,45 @@ export const linkDesignFn = createServerFn({ method: "POST" })
 
     await assertStoryProjectMember(data.storyId, userId);
 
-    const existing = await prisma.storyDesignLink.findUnique({
-      where: { storyId_designId: { storyId: data.storyId, designId: data.designId } },
+    const designs = await prisma.design.findMany({
+      where: { id: { in: data.designIds }, userId, isDeleted: false },
+      select: { id: true },
     });
-    if (existing) {
-      throw new Error("已关联此 PRD");
+    const foundIds = new Set(designs.map((d) => d.id));
+    const failed = data.designIds
+      .filter((id) => !foundIds.has(id))
+      .map((designId) => ({ designId, reason: "outOfScope" as const }));
+
+    const existing = await prisma.storyDesignLink.findMany({
+      where: { storyId: data.storyId, designId: { in: [...foundIds] } },
+      select: { designId: true },
+    });
+    const existingIds = new Set(existing.map((l) => l.designId));
+    const toLink = designs.map((d) => d.id).filter((id) => !existingIds.has(id));
+
+    if (toLink.length > 0) {
+      await prisma.storyDesignLink.createMany({
+        data: toLink.map((designId) => ({ storyId: data.storyId, designId })),
+        skipDuplicates: true,
+      });
     }
 
-    const link = await prisma.storyDesignLink.create({
-      data: {
-        storyId: data.storyId,
-        designId: data.designId,
-      },
-    });
+    // 活动记录：成功关联设计时记一条（newValue 为数量，口径同 kb_linked）
+    let activity: ReturnType<typeof toActivityItem> | null = null;
+    if (toLink.length > 0) {
+      const created = await prisma.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "prd_linked",
+          newValue: String(toLink.length),
+        },
+        select: ACTIVITY_SELECT,
+      });
+      activity = toActivityItem(created);
+    }
 
-    return link;
+    return { linked: toLink, failed, activity };
   });
 
 export const unlinkDesignFn = createServerFn({ method: "POST" })
@@ -134,12 +160,13 @@ export const getLinkedDesignsFn = createServerFn({ method: "GET" })
     const session = await requireAuth(request);
 
     const links = await prisma.storyDesignLink.findMany({
-      where: { storyId: data.storyId },
+      where: { storyId: data.storyId, design: { isDeleted: false } },
       include: {
         design: {
           select: {
             id: true,
             name: true,
+            icon: true,
           },
         },
       },
@@ -148,6 +175,7 @@ export const getLinkedDesignsFn = createServerFn({ method: "GET" })
     return links.map((link) => ({
       id: link.design.id,
       title: link.design.name,
+      icon: link.design.icon,
     }));
   });
 
@@ -169,12 +197,14 @@ export const searchDesignsFn = createServerFn({ method: "GET" })
           mode: "insensitive",
         },
       },
+      select: { id: true, name: true, icon: true },
       take: 10,
     });
 
     return prds.map((prd) => ({
       id: prd.id,
       title: prd.name,
+      icon: prd.icon,
     }));
   });
 

package/src/server/serverFns/story/story-crud/archive.ts

@@ -21,6 +21,8 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
+import { buildRoomName } from "@allbluecn/collab-core/rooms";
+import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
 
 const archiveStorySchema = z.object({ storyId: z.string() });
 
@@ -58,21 +60,33 @@ export const archiveStoryFn = createServerFn({ method: "POST" })
 
     await assertStoryProjectMember(data.storyId, userId);
 
-    const story = await prisma.story.update({
-      where: { id: data.storyId },
-      data: { archived: true, archivedAt: new Date() },
-      select: STORY_LIST_SELECT,
-    });
+    const story = await prisma.$transaction(async (tx) => {
+      const updated = await tx.story.update({
+        where: { id: data.storyId },
+        data: { archived: true, archivedAt: new Date() },
+        select: STORY_LIST_SELECT,
+      });
+
+      // R11 touch：archive bump updatedAt 但不含 Y 属主面——不同步快照会让
+      // 协同打开误判旁路写触发重种子化（story-crud.ts 同不变式）
+      await touchCollabSnapshot(
+        tx,
+        buildRoomName({ kind: "entity-story", storyId: data.storyId }),
+        updated.updatedAt,
+      );
+
+      await tx.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "archived",
+          field: "archived",
+          oldValue: "false",
+          newValue: "true",
+        },
+      });
 
-    await prisma.storyActivity.create({
-      data: {
-        storyId: data.storyId,
-        userId,
-        action: "archived",
-        field: "archived",
-        oldValue: "false",
-        newValue: "true",
-      },
+      return updated;
     });
 
     return castStoryUsers(story);
@@ -88,21 +102,31 @@ export const unarchiveStoryFn = createServerFn({ method: "POST" })
 
     await assertStoryProjectMember(data.storyId, userId);
 
-    const story = await prisma.story.update({
-      where: { id: data.storyId },
-      data: { archived: false, archivedAt: null },
-      select: STORY_LIST_SELECT,
-    });
+    const story = await prisma.$transaction(async (tx) => {
+      const updated = await tx.story.update({
+        where: { id: data.storyId },
+        data: { archived: false, archivedAt: null },
+        select: STORY_LIST_SELECT,
+      });
+
+      await touchCollabSnapshot(
+        tx,
+        buildRoomName({ kind: "entity-story", storyId: data.storyId }),
+        updated.updatedAt,
+      );
+
+      await tx.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "unarchived",
+          field: "archived",
+          oldValue: "true",
+          newValue: "false",
+        },
+      });
 
-    await prisma.storyActivity.create({
-      data: {
-        storyId: data.storyId,
-        userId,
-        action: "unarchived",
-        field: "archived",
-        oldValue: "true",
-        newValue: "false",
-      },
+      return updated;
     });
 
     return castStoryUsers(story);

package/src/server/serverFns/story/story-crud/bulk.ts

@@ -21,8 +21,10 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
-import { toDateOnly } from "@/server/story/types";
+import { toDateKeyUtc } from "@/server/story/date-key";
 import type { Prisma } from "@allbluecn/database";
+import { buildRoomName } from "@allbluecn/collab-core/rooms";
+import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
 
 const idListSchema = z.object({ storyIds: z.array(z.string()).min(1).max(500) });
 
@@ -54,10 +56,16 @@ export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
         (r) => !r.archived && (r.state === "done" || r.state === "cancelled"),
       );
       for (const r of toArchive) {
-        await tx.story.update({
+        const updated = await tx.story.update({
           where: { id: r.id },
           data: { archived: true, archivedAt: new Date() },
         });
+        // R11 touch：批量归档同不变式（同 bug bulkArchive；口径④绊线补捞）
+        await touchCollabSnapshot(
+          tx,
+          buildRoomName({ kind: "entity-story", storyId: r.id }),
+          updated.updatedAt,
+        );
         await tx.storyActivity.create({
           data: {
             storyId: r.id,
@@ -168,7 +176,9 @@ export const bulkUpdateStoriesFn = createServerFn({ method: "POST" })
         }
         if (data.patch.startDate !== undefined) {
           const newDate = data.patch.startDate ? new Date(data.patch.startDate) : null;
-          const oldValue = story.startDate ? toDateOnly(story.startDate) : "";
+          // 日键同域（task-8 根因 B）：旧值键用 UTC 日切片（与客户端键同源），
+          // 本地日键对带时刻的历史数据 +1 天错位，+1 天改期会被静默丢写
+          const oldValue = story.startDate ? toDateKeyUtc(story.startDate) : "";
           const newValue = data.patch.startDate ? data.patch.startDate.slice(0, 10) : "";
           if (newValue !== oldValue) {
             activities.push({ action: "startDate_changed", field: "startDate", oldValue, newValue });
@@ -177,7 +187,7 @@ export const bulkUpdateStoriesFn = createServerFn({ method: "POST" })
         }
         if (data.patch.targetDate !== undefined) {
           const newDate = data.patch.targetDate ? new Date(data.patch.targetDate) : null;
-          const oldValue = story.targetDate ? toDateOnly(story.targetDate) : "";
+          const oldValue = story.targetDate ? toDateKeyUtc(story.targetDate) : "";
           const newValue = data.patch.targetDate ? data.patch.targetDate.slice(0, 10) : "";
           if (newValue !== oldValue) {
             activities.push({

package/src/server/serverFns/story/story-crud/create-story-internal.ts

@@ -40,6 +40,38 @@ export interface CreateStoryInternalInput {
   isAI: boolean;
 }
 
+/**
+ * 事务内发号（含落后自愈）：upsert 计数器拿 seq 后，以同事务内存量最大 sequenceId
+ * 为下界。自愈理由：计数器 increment 与建单同一事务，identifier 撞唯一键即整体
+ * 回滚——story-crud.ts 的重试循环每轮重发同一个号，对「计数器落后存量」类冲突
+ * 结构性无效；而 SQL/seed 导入等合法路径绕过计数器直写 story，计数器可能落后。
+ * 故 seq <= max 时跳到 max+1 并回写计数器。并发安全：计数器行（事务内 UPDATE）
+ * 串行化同项目并发创建，max 读取发生在拿锁之后，无重复号窗口。
+ */
+async function allocateStorySequence(tx: Prisma.TransactionClient, projectId: string): Promise<number> {
+  const counter = await tx.sequenceCounter.upsert({
+    where: { scope: projectId },
+    create: { scope: projectId, seq: 1 },
+    update: { seq: { increment: 1 } },
+  });
+  const maxExisting =
+    (
+      await tx.story.aggregate({
+        where: { projectId },
+        _max: { sequenceId: true },
+      })
+    )._max.sequenceId ?? 0;
+  if (counter.seq <= maxExisting) {
+    const healed = maxExisting + 1;
+    await tx.sequenceCounter.update({
+      where: { scope: projectId },
+      data: { seq: healed },
+    });
+    return healed;
+  }
+  return counter.seq;
+}
+
 /** 事务内发号并建单：identifier 发号（裸 projectId scope）+ story.create + created/child_added 活动 */
 export async function createStoryInternal(
   tx: Prisma.TransactionClient,
@@ -63,29 +95,15 @@ export async function createStoryInternal(
 
   const isIndependent = project.displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
   const pid = input.projectId;
-  let sequenceId: number;
-  let identifier: string;
-  if (isIndependent) {
-    const counter = await tx.sequenceCounter.upsert({
-      where: { scope: pid },
-      create: { scope: pid, seq: 1 },
-      update: { seq: { increment: 1 } },
-    });
-    sequenceId = counter.seq;
-    identifier = `STORY-${counter.seq}`;
-  } else {
-    const prefix =
-      (project.displayId ?? project.name!)
+  // 先 upsert 发号后算前缀：两分支计数器逻辑相同，仅前缀不同（原两份重复 upsert 收敛于此）
+  const seq = await allocateStorySequence(tx, pid);
+  const prefix = isIndependent
+    ? "STORY"
+    : (project.displayId ?? project.name!)
         .replace(/[^a-zA-Z0-9]/g, "")
         .toUpperCase() || "PRJ";
-    const counter = await tx.sequenceCounter.upsert({
-      where: { scope: pid },
-      create: { scope: pid, seq: 1 },
-      update: { seq: { increment: 1 } },
-    });
-    sequenceId = counter.seq;
-    identifier = `${prefix}-${counter.seq}`;
-  }
+  const sequenceId = seq;
+  const identifier = `${prefix}-${seq}`;
 
   const story = await tx.story.create({
     data: {