@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/serverFns/story/story-list-query.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { Prisma } from "@allbluecn/database";
-import type { GroupKey } from "@/components/story/display/types";
+import type { GroupKey } from "@/components/shared-kit/list-kit/display/types";
 import { toValidDate } from "@/server/story/types";
 
 export function buildListWhere(data: {
@@ -25,6 +25,8 @@ export function buildListWhere(data: {
   priority?: string;
   assigneeId?: string;
   projectId?: string;
+  /** 「全部项目」聚合：优先于 projectId，命中多项目范围（成员关系内） */
+  projectIds?: string[];
   labelId?: string;
   search?: string;
   filters?: string;
@@ -60,7 +62,9 @@ export function buildListWhere(data: {
       }
     }
   }
-  if (data.projectId) {
+  if (data.projectIds && data.projectIds.length > 0) {
+    where.projectId = { in: data.projectIds };
+  } else if (data.projectId) {
     where.projectId = data.projectId;
   }
   if (data.labelId) {
@@ -83,6 +87,9 @@ export function buildListWhere(data: {
       const filterConditions = JSON.parse(data.filters) as Array<{ property: string; operator: string; value: string }>;
       if (Array.isArray(filterConditions)) {
         for (const fc of filterConditions) {
+          // 畸形单条守卫：fc 非对象 / value 非 string 时跳过该条（.split 会抛错），
+          // 不连坐丢弃后续合法条件（外层 catch 只兜 JSON.parse 级错误）
+          if (typeof fc?.value !== "string") continue;
           if (fc.property === "state") {
             const vals = fc.value.split(",").filter(Boolean);
             if (vals.length > 0) {
@@ -204,7 +211,12 @@ export function buildListWhere(data: {
   return where;
 }
 
-const GROUP_FILTERS: Record<Exclude<GroupKey, "none">, (key: string) => Prisma.StoryWhereInput> = {
+// iteration 为甘特专属维度（GROUP_KEYS 数组之外）：服务端分组查询的
+// zod 校验拦在入口，类型面排除 + 守卫返回空 filter 防索引 undefined
+const GROUP_FILTERS: Record<
+  Exclude<GroupKey, "none" | "iteration">,
+  (key: string) => Prisma.StoryWhereInput
+> = {
   state: (key) => ({ state: key }),
   priority: (key) => ({ priority: key }),
   assignee: (key) => (key === "unassigned" ? { assigneeId: null } : { assigneeId: key }),
@@ -217,6 +229,6 @@ const GROUP_FILTERS: Record<Exclude<GroupKey, "none">, (key: string) => Prisma.S
 };
 
 export function buildGroupFilter(groupBy: GroupKey, key: string): Prisma.StoryWhereInput {
-  if (groupBy === "none") return {};
+  if (groupBy === "none" || groupBy === "iteration") return {};
   return GROUP_FILTERS[groupBy](key);
 }

package/src/server/serverFns/story/story-search.ts

@@ -57,12 +57,15 @@ export const searchStoriesFn = createServerFn({ method: "GET" })
   });
 
 const reorderStoriesSchema = z.object({
-  items: z.array(
-    z.object({
-      id: z.string(),
-      boardOrder: z.number().int().min(0),
-    }),
-  ),
+  // 批量上限 500（story-crud/bulk idListSchema 同款）：防误用超大拖垮 $transaction
+  items: z
+    .array(
+      z.object({
+        id: z.string(),
+        boardOrder: z.number().int().min(0),
+      }),
+    )
+    .max(500),
 });
 
 export const reorderStoriesFn = createServerFn({ method: "POST" })

package/src/server/serverFns/story/story-transfer.ts

@@ -19,11 +19,14 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
+import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import type { Prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
 import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
+import { withCollabGuard } from "@/server/collab/write-guard";
 import { STORY_LIST_SELECT, castStoryUsers, castUserBrief, USER_BRIEF_SELECT, checkDescendant } from "@/server/story/types";
+import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
 
 type StoryTx = Parameters<Parameters<typeof import("@allbluecn/database").prisma.$transaction>[0]>[0];
 
@@ -85,48 +88,55 @@ async function allocateStoryIdentifier(
   });
   if (!project) throw new Error("项目不存在");
 
-  const isIndependent = project.displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
-  if (isIndependent) {
-    const counter = await tx.sequenceCounter.upsert({
-      where: { scope: projectId },
-      create: { scope: projectId, seq: 1 },
-      update: { seq: { increment: 1 } },
-    });
-    return { sequenceId: counter.seq, identifier: `STORY-${counter.seq}` };
-  }
-
-  const prefix =
-    (project.displayId ?? project.name)
-      .replace(/[^a-zA-Z0-9]/g, "")
-      .toUpperCase() || "PRJ";
+  // 计数器回滚使重试对「落后存量」类冲突无效（重试每轮重发同一个号）——目标项目
+  // 计数器落后存量（SQL/seed 等合法路径绕过计数器直写 story）时照发即 identifier
+  // 撞唯一键、5 次重试耗尽后用户拿到「请重试」但重试结构性不可能成功。自愈（与
+  // 需求域 #447 / create-story-internal、BUG 域 bug-crud 同方案）：以同事务存量
+  // 最大 sequenceId 为下界，seq <= max 时跳到 max+1 并回写计数器。并发安全：计数
+  // 器行（事务内 UPDATE）串行化同项目并发转移，max 读取发生在拿锁之后，无重复号
+  // 窗口。scope 与 upsert 一致为裸 projectId。
   const counter = await tx.sequenceCounter.upsert({
     where: { scope: projectId },
     create: { scope: projectId, seq: 1 },
     update: { seq: { increment: 1 } },
   });
-  return { sequenceId: counter.seq, identifier: `${prefix}-${counter.seq}` };
+  const maxExisting =
+    (
+      await tx.story.aggregate({
+        where: { projectId },
+        _max: { sequenceId: true },
+      })
+    )._max.sequenceId ?? 0;
+  let seq = counter.seq;
+  if (seq <= maxExisting) {
+    seq = maxExisting + 1;
+    await tx.sequenceCounter.update({
+      where: { scope: projectId },
+      data: { seq },
+    });
+  }
+
+  // 先 upsert 发号后算前缀：两分支计数器逻辑相同，仅前缀不同（原两份重复 upsert 收敛于此）
+  const isIndependent = project.displayId === BUILTIN_INDEPENDENT_DISPLAY_ID;
+  const prefix = isIndependent
+    ? "STORY"
+    : (project.displayId ?? project.name)
+        .replace(/[^a-zA-Z0-9]/g, "")
+        .toUpperCase() || "PRJ";
+  return { sequenceId: seq, identifier: `${prefix}-${seq}` };
 }
 
-async function runTransferWithIdentifierRetry<T>(
+/** 事务执行 + 编号冲突重试（scope 首创竞态 + identifier 撞号，泛化助手）；耗尽抛转移专属文案 */
+function runTransferWithIdentifierRetry<T>(
   handler: (tx: StoryTx) => Promise<T>
 ): Promise<T> {
-  const MAX_RETRIES = 5;
-  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-    try {
+  return withSequenceNumberRetry(
+    async () => {
       const prisma = await getPrisma();
-      return await prisma.$transaction(handler);
-    } catch (e: unknown) {
-      const isUniqueViolation =
-        e instanceof Error &&
-        "code" in e &&
-        (e as { code: string }).code === "P2002" &&
-        "meta" in e &&
-        Array.isArray((e as { meta?: { target?: string[] } }).meta?.target) &&
-        (e as { meta: { target: string[] } }).meta.target.includes("identifier");
-      if (!isUniqueViolation || attempt === MAX_RETRIES - 1) throw e;
-    }
-  }
-  throw new Error("转移失败：编号冲突，请重试");
+      return prisma.$transaction(handler);
+    },
+    { exhaustedMessage: "转移失败：编号冲突，请重试" },
+  );
 }
 
 const transferToProjectSchema = z.object({
@@ -238,6 +248,39 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
       throw new Error("不能将需求移动到其后代节点下（循环依赖）");
     }
 
+    // ── Yjs 多人协作 §5.3 写入门卫（任务 21；审查修正：提至标识符重试循环
+    // 之外——门卫转发含网络 I/O，事务内等待会击穿 Prisma 事务超时（P2028）
+    // 且编号冲突重试会让门卫 HTTP 重复执行；T17 knowledge.ts 先例同此序）。
+    // parentId 是 entity room 的 Y 属主字段——T20 实测的父需求弹窗旁路
+    // （story-select-dialog 确认路径直调本 serverFn，不经协同短路）。快照
+    // 存在 → 转发 collab（在线应用 Y 广播给协同者 / 离线 collab 直落）；
+    // 成员预检前置（与 updateStoryFn 同口径）。转发时剥离 parentId 直写与
+    // parent_changed 活动（collab 落库侧产出自己的流水）；项目转移部分
+    // （非 Y 属主）照旧。
+    const guard = await withCollabGuard({
+      roomName: buildRoomName({ kind: "entity-story", storyId: data.storyId }),
+      docId: data.storyId,
+      actor: userId,
+      patch: { fields: { parentId: data.parentStoryId } },
+      assertWriteAllowed: async () => {
+        const prisma = await getPrisma();
+        const row = await prisma.story.findUnique({
+          where: { id: data.storyId },
+          select: { projectId: true },
+        });
+        if (!row) throw new Error("需求不存在");
+        if (row.projectId) await assertProjectMembership(row.projectId, userId);
+        const parentForCheck = await prisma.story.findUnique({
+          where: { id: data.parentStoryId },
+          select: { projectId: true },
+        });
+        if (parentForCheck?.projectId) {
+          await assertProjectMembership(parentForCheck.projectId, userId);
+        }
+      },
+    });
+    const forwarded = guard.kind === "forwarded";
+
     return runTransferWithIdentifierRetry(async (tx) => {
       const [existing, parent] = await Promise.all([
         tx.story.findUnique({
@@ -278,15 +321,28 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
         alloc = await allocateStoryIdentifier(tx, parent.projectId);
       }
 
-      const updated = await tx.story.update({
-        where: { id: data.storyId },
-        data: {
-          ...(isIndependent ? { projectId: parent.projectId } : {}),
-          parentId: data.parentStoryId,
-          ...(alloc ? { sequenceId: alloc.sequenceId, identifier: alloc.identifier } : {}),
-        },
-        select: STORY_LIST_SELECT,
-      });
+      // forwarded：parentId 归 collab 接管（Y 广播或离线直落）——直写数据与
+      // parent_changed 活动剥离，防双写互吞/重复流水
+      const storyUpdateData: Prisma.StoryUpdateInput = {
+        ...(isIndependent ? { project: { connect: { id: parent.projectId } } } : {}),
+        ...(alloc ? { sequenceId: alloc.sequenceId, identifier: alloc.identifier } : {}),
+      };
+      if (!forwarded) {
+        storyUpdateData.parent = { connect: { id: data.parentStoryId } };
+      }
+
+      const hasDirectUpdates = Object.keys(storyUpdateData).length > 0;
+      const updated = hasDirectUpdates
+        ? await tx.story.update({
+            where: { id: data.storyId },
+            data: storyUpdateData,
+            select: STORY_LIST_SELECT,
+          })
+        : await tx.story.findUnique({
+            where: { id: data.storyId },
+            select: STORY_LIST_SELECT,
+          });
+      if (!updated) throw new Error("需求不存在");
 
       const activitySelect = {
         id: true, action: true, field: true, oldValue: true, newValue: true, isAI: true, createdAt: true,
@@ -339,7 +395,8 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
           }));
         }
       }
-      if (existing.parentId !== data.parentStoryId) {
+      // forwarded 时 parent_changed 活动由 collab 落库侧产出（防重复流水）
+      if (!forwarded && existing.parentId !== data.parentStoryId) {
         createdActivities.push(await tx.storyActivity.create({
           data: {
             storyId: data.storyId,

package/src/server/serverFns/story/story-tree.ts

@@ -19,7 +19,9 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
+import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { requireAuth } from "@/server/auth-helpers";
+import { withCollabGuard } from "@/server/collab/write-guard";
 import { buildStoryTree, checkDescendant } from "@/server/story/types";
 
 /** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
@@ -91,12 +93,42 @@ export const addChildFn = createServerFn({ method: "POST" })
     });
     if (parent) await assertProjectMembership(parent.projectId, userId);
 
-    const child = await prisma.story.update({
-      where: { id: data.childId },
-      data: { parentId: data.parentId },
+    // ── Yjs 多人协作 §5.3 写入门卫（任务 21 审查修正补接）：parentId 是
+    // entity room 的 Y 属主字段——直写后 (a) bump updatedAt 触发重种子化
+    // （fields 不回种 → 快照字段清空）；(b) Y 已持 parentId 时下次 flush
+    // 的 exporter diff 会用 Y 旧值静默回滚本次树操作（collab 吞 web 直写
+    // = 真实丢写）。快照存在 → 转发 collab；门卫在写路径之前、事务之外
+    // （网络 I/O 不进事务——审查修正①同口径）。成员预检在上方已完成，
+    // 回调内复查覆盖预检到转发之间的 TOCTOU 窗口。
+    const guard = await withCollabGuard({
+      roomName: buildRoomName({ kind: "entity-story", storyId: data.childId }),
+      docId: data.childId,
+      actor: userId,
+      patch: { fields: { parentId: data.parentId } },
+      assertWriteAllowed: async () => {
+        const [child, parentRow] = await Promise.all([
+          prisma.story.findUnique({ where: { id: data.childId }, select: { projectId: true } }),
+          prisma.story.findUnique({ where: { id: data.parentId }, select: { projectId: true } }),
+        ]);
+        if (child) await assertProjectMembership(child.projectId, userId);
+        if (parentRow) await assertProjectMembership(parentRow.projectId, userId);
+      },
     });
-
-    // 活动记录：父需求记「添加子需求」，子需求记「变更父需求」（与 updateStoryFn 格式一致）
+    const forwarded = guard.kind === "forwarded";
+
+    // forwarded：子需求行的 parentId 直写剥离（update 仅此一列 → 整体跳过，
+    // 不 bump updatedAt）；回读现行行供响应。parent_changed 活动由 collab
+    // 落库侧产出，此处剥离防重复流水。
+    const child = forwarded
+      ? await prisma.story.findUnique({ where: { id: data.childId } })
+      : await prisma.story.update({
+          where: { id: data.childId },
+          data: { parentId: data.parentId },
+        });
+
+    // 活动记录：父需求记「添加子需求」（非 Y 属主面——描述父子关系事件，
+    // collab 侧不产此活动，照旧写入）；子需求「变更父需求」forwarded 剥离
+    // （与 updateStoryFn 格式一致）
     if (parent) {
       const childLabel = `${existingChild?.identifier ?? ""} ${existingChild?.name ?? ""}`.trim();
       const parentLabel = `${parent.identifier} ${parent.name}`.trim();
@@ -104,16 +136,20 @@ export const addChildFn = createServerFn({ method: "POST" })
         prisma.storyActivity.create({
           data: { storyId: parent.id, userId, action: "child_added", newValue: childLabel },
         }),
-        prisma.storyActivity.create({
-          data: {
-            storyId: child.id,
-            userId,
-            action: "parent_changed",
-            field: "parentId",
-            oldValue: "",
-            newValue: parentLabel,
-          },
-        }),
+        ...(forwarded
+          ? []
+          : [
+              prisma.storyActivity.create({
+                data: {
+                  storyId: child!.id,
+                  userId,
+                  action: "parent_changed",
+                  field: "parentId",
+                  oldValue: "",
+                  newValue: parentLabel,
+                },
+              }),
+            ]),
       ]);
     }
 
@@ -135,45 +171,31 @@ export const removeChildFn = createServerFn({ method: "POST" })
     if (!existing) throw new Error("需求不存在");
     await assertProjectMembership(existing.projectId, userId);
 
-    const child = await prisma.story.update({
-      where: { id: data.childId },
-      data: { parentId: null },
+    // §5.3 写入门卫（任务 21 审查修正补接，动机同 addChildFn）：快照存在 →
+    // parentId: null 转 collab（在线广播 / 离线直落）；门卫在写路径之前。
+    const guard = await withCollabGuard({
+      roomName: buildRoomName({ kind: "entity-story", storyId: data.childId }),
+      docId: data.childId,
+      actor: userId,
+      patch: { fields: { parentId: null } },
+      assertWriteAllowed: async () => {
+        const row = await prisma.story.findUnique({
+          where: { id: data.childId },
+          select: { projectId: true },
+        });
+        if (row) await assertProjectMembership(row.projectId, userId);
+      },
     });
 
-    return child;
-  });
-
-export const moveChildFn = createServerFn({ method: "POST" })
-  .validator(z.object({ childId: z.string(), newParentId: z.string() }))
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const userId = session.user!.id!;
-
-    const isDescendant = await checkDescendant(data.childId, data.newParentId);
-    if (isDescendant) {
-      throw new Error("不能将子需求移动到其后代节点（循环依赖）");
+    if (guard.kind === "forwarded") {
+      // parentId 直写剥离（update 仅此一列 → 整体跳过，不 bump updatedAt）；
+      // 回读现行行供响应
+      return prisma.story.findUnique({ where: { id: data.childId } });
     }
 
-    const [existing, newParent] = await Promise.all([
-      prisma.story.findUnique({
-        where: { id: data.childId },
-        select: { id: true, projectId: true },
-      }),
-      prisma.story.findUnique({
-        where: { id: data.newParentId },
-        select: { id: true, projectId: true },
-      }),
-    ]);
-    if (!existing) throw new Error("需求不存在");
-    if (!newParent) throw new Error("父需求不存在");
-    await assertProjectMembership(existing.projectId, userId);
-    await assertProjectMembership(newParent.projectId, userId);
-
     const child = await prisma.story.update({
       where: { id: data.childId },
-      data: { parentId: data.newParentId },
+      data: { parentId: null },
     });
 
     return child;

package/src/server/serverFns/story-display-options.ts

@@ -31,13 +31,15 @@ import {
   ORDER_DIRECTIONS,
   ALL_DISPLAY_PROPERTIES,
   PAGE_SIZE_OPTIONS,
-  type DisplayOptions,
-  type DisplayProperty,
-  type GroupKey,
-  type OrderKey,
-  type OrderDirection,
-  type PageSize,
-} from "@/components/story/display/types"
+} from "@/components/shared-kit/list-kit/display/values"
+import type {
+  DisplayOptions,
+  DisplayProperty,
+  GroupKey,
+  OrderKey,
+  OrderDirection,
+  PageSize,
+} from "@/components/shared-kit/list-kit/display/types"
 
 /** Prisma Json 字段不接受强类型对象（缺 index signature），统一 cast */
 function toJson<T>(value: T): Prisma.InputJsonValue {
@@ -49,8 +51,12 @@ function parseStoredOptions(raw: unknown): DisplayOptions {
   if (typeof raw !== "object" || raw === null) return { ...DEFAULT_DISPLAY_OPTIONS }
   const o = raw as Record<string, unknown>
 
+  // iteration 为甘特专属维度（GROUP_KEYS 数组之外、timeline clamp 白名单
+  // 放行）：groupBy 持久化放行，跨布局合法性由 filterDisplayOptionsForLayout
+  // 按布局 clamp；subGroupBy 无此维度，维持 GROUP_KEYS 严格集
   const groupBy =
-    typeof o.groupBy === "string" && (GROUP_KEYS as readonly string[]).includes(o.groupBy)
+    typeof o.groupBy === "string" &&
+    ((GROUP_KEYS as readonly string[]).includes(o.groupBy) || o.groupBy === "iteration")
       ? (o.groupBy as GroupKey)
       : DEFAULT_DISPLAY_OPTIONS.groupBy
   const subGroupBy =
@@ -91,10 +97,14 @@ function parseStoredOptions(raw: unknown): DisplayOptions {
       typeof o.pageSize === "number" && (PAGE_SIZE_OPTIONS as readonly number[]).includes(o.pageSize)
         ? (o.pageSize as PageSize)
         : DEFAULT_DISPLAY_OPTIONS.pageSize,
+    columnOrder: Array.isArray(o.columnOrder)
+      ? (o.columnOrder.filter((k): k is string => typeof k === "string" && k.length > 0))
+      : undefined,
   }
 }
 
-const groupBySchema = z.enum(GROUP_KEYS)
+const groupBySchema = z.enum([...GROUP_KEYS, "iteration"] as const)
+const subGroupBySchema = z.enum(GROUP_KEYS)
 const orderBySchema = z.enum(ORDER_KEYS)
 const orderDirSchema = z.enum(ORDER_DIRECTIONS)
 const propertySchema = z.enum(ALL_DISPLAY_PROPERTIES)
@@ -104,13 +114,14 @@ const pageSizeSchema = z.union([z.literal(100), z.literal(200), z.literal(500),
 // 与本文件顶层 @/server/* import 叠加会把服务端依赖拉进浏览器 bundle）
 const displayOptionsSchema = z.object({
   groupBy: groupBySchema,
-  subGroupBy: groupBySchema,
+  subGroupBy: subGroupBySchema,
   orderBy: orderBySchema,
   orderDir: orderDirSchema,
   properties: z.array(propertySchema),
   showEmptyGroups: z.boolean(),
   showSubItems: z.boolean(),
   pageSize: pageSizeSchema,
+  columnOrder: z.array(z.string().min(1)).optional(),
 })
 
 /** 获取当前用户持久化的 Display Options（非法/缺失字段已回退默认值） */

package/src/server/serverFns/story-view.ts

@@ -21,8 +21,8 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { toSavedView, type SavedView } from "@/components/story/views/view-types";
-import type { FilterCondition } from "@/components/story/filters/filter-types";
-import type { DisplayOptions } from "@/components/story/display/types";
+import type { FilterCondition } from "@/components/story/filters/field-configs";
+import type { DisplayOptions } from "@/components/shared-kit/list-kit/display/types";
 import type { Prisma } from "@allbluecn/database";
 
 function toJson<T>(value: T): Prisma.InputJsonValue {