@allbluecn/web-app 0.19.2 → 0.19.4

package/src/components/tiptap/__tests__/audit-fixes.test.ts

@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from 'vitest'
+import type { Editor } from '@tiptap/react'
+import { m } from '@/paraglide/messages.js'
+
+import { insertDelta } from '../extensions/ai-extension'
+import { handleImageUpload } from '../lib/utils/url'
+import { MAX_FILE_SIZE } from '../lib/utils/constants'
+import { docGroupRouteSegment, docGroupIconKey } from '../lib/doc-group'
+import { getNodeDisplayName } from '../lib/collab-utils'
+
+describe('insertDelta（审计 🟠：纯文本不得按 HTML 解析）', () => {
+  function makeMockEditor() {
+    const insertCalls: unknown[][] = []
+    const chainMock = {
+      focus: () => chainMock,
+      insertContentAt: (...args: unknown[]) => {
+        insertCalls.push(args)
+        return chainMock
+      },
+      setTextSelection: () => chainMock,
+      setMark: () => chainMock,
+      run: () => true,
+    }
+    const editor = { chain: () => chainMock } as unknown as Editor
+    return { editor, insertCalls }
+  }
+
+  it('以 text 节点插入含 HTML 标记的纯文本（不作为 HTML 字符串传入）', () => {
+    const { editor, insertCalls } = makeMockEditor()
+    const delta = '<b>fake</b> & 1 < 2'
+    const next = insertDelta(editor, 5, delta)
+    expect(insertCalls).toHaveLength(1)
+    expect(insertCalls[0]).toEqual([5, [{ type: 'text', text: delta }]])
+    expect(next).toBe(5 + delta.length)
+  })
+
+  it('空 delta 不触发插入', () => {
+    const { editor, insertCalls } = makeMockEditor()
+    expect(insertDelta(editor, 5, '')).toBe(5)
+    expect(insertCalls).toHaveLength(0)
+  })
+})
+
+describe('handleImageUpload（审计 🟠：演示假实现改真实 dataURL）', () => {
+  it('文件读为 data URL 返回', async () => {
+    const file = new File(['hello'], 'a.png', { type: 'image/png' })
+    const url = await handleImageUpload(file)
+    expect(url).toBe('data:image/png;base64,aGVsbG8=')
+  })
+
+  it('超限抛错', async () => {
+    const big = new File(['x'], 'big.png', { type: 'image/png' })
+    Object.defineProperty(big, 'size', { value: MAX_FILE_SIZE + 1 })
+    await expect(handleImageUpload(big)).rejects.toThrow(/maximum allowed/i)
+  })
+
+  it('abort 后抛 Upload cancelled', async () => {
+    const file = new File(['hello'], 'a.png', { type: 'image/png' })
+    const controller = new AbortController()
+    controller.abort()
+    await expect(handleImageUpload(file, undefined, controller.signal)).rejects.toThrow(
+      'Upload cancelled'
+    )
+  })
+})
+
+describe('doc-group 路由段与图标映射（审计 🟠：law→laws / dictionary→dictionaries）', () => {
+  it('分组标签映射到实际存在的 knowledge 路由段', () => {
+    expect(docGroupRouteSegment(m['editor_laws-regulations']())).toBe('laws')
+    expect(docGroupRouteSegment(m['editor_industry-compliance']())).toBe('compliance')
+    expect(docGroupRouteSegment(m['editor_dictionary-entry']())).toBe('dictionaries')
+    expect(docGroupRouteSegment(m['editor_website-bookmark']())).toBe('bookmarks')
+  })
+
+  it('未知分组返回 null（由调用方回落通用文档页）', () => {
+    expect(docGroupRouteSegment('不存在的分组')).toBeNull()
+    expect(docGroupRouteSegment('')).toBeNull()
+  })
+
+  it('图标稳定 key 映射', () => {
+    expect(docGroupIconKey(m['editor_laws-regulations']())).toBe('scale')
+    expect(docGroupIconKey(m['editor_dictionary-entry']())).toBe('book-marked')
+    expect(docGroupIconKey('nope')).toBeNull()
+  })
+
+  it('不再产出旧的单数错误路由段', () => {
+    const labels = [
+      m['editor_laws-regulations'](),
+      m['editor_industry-compliance'](),
+      m['editor_dictionary-entry'](),
+      m['editor_website-bookmark'](),
+    ]
+    for (const label of labels) {
+      const segment = docGroupRouteSegment(label)
+      expect(segment).not.toBe('law')
+      expect(segment).not.toBe('dictionary')
+    }
+  })
+})
+
+describe('collab-utils getNodeDisplayName（审计 🟡：驼峰节点名键 + i18n）', () => {
+  it('bulletList 等驼峰键命中中文标签（旧小写键 bulletlist 永不命中）', () => {
+    const editor = {
+      state: {
+        selection: {
+          $anchor: { parent: { type: { name: 'bulletList' } } },
+        },
+      },
+    } as unknown as Editor
+    expect(getNodeDisplayName(editor)).toBe(m.editor_bullet_list())
+  })
+
+  it('未知类型回落小写节点名；空 editor 回落「节点」', () => {
+    const editor = {
+      state: {
+        selection: { $anchor: { parent: { type: { name: 'customNode' } } } },
+      },
+    } as unknown as Editor
+    expect(getNodeDisplayName(editor)).toBe('customnode')
+    expect(getNodeDisplayName(null)).toBe(m.editor_node())
+  })
+})
+
+describe('audit-fixes 回归哨兵（🟢/⚪ 汇总）', () => {
+  it('handleImageUpload 不再返回占位图路径', async () => {
+    const file = new File(['x'], 'b.png', { type: 'image/png' })
+    const url = await handleImageUpload(file)
+    expect(url).not.toContain('/images/tiptap-ui-placeholder-image.jpg')
+  })
+})

package/src/components/tiptap/extensions/ai-extension.ts

@@ -15,7 +15,9 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { m } from "@/paraglide/messages.js"
 import { Extension } from "@tiptap/core"
+import type { Editor } from "@tiptap/react"
 import { AiImproveType, TextOptions, AiFormat } from "../lib/ai-types.ts"
 
 export interface AiRejectOptions {
@@ -63,12 +65,16 @@ declare module "@tiptap/core" {
 }
 
 const SSE_DONE = "[DONE]"
+/** AI 流式请求兜底超时（用户 abort 之外的服务端无响应保护） */
+const AI_STREAM_TIMEOUT_MS = 120_000
 
 interface StreamChunk {
   type?: string
   delta?: string
   content?: string
   error?: string
+  /** fallback 机器可读原因（no_key / upstream_error），文案由客户端按 locale 渲染 */
+  code?: string
 }
 
 function parseSseEvent(block: string): StreamChunk | null {
@@ -97,6 +103,8 @@ async function* streamFromServer(
     (typeof window !== "undefined" &&
       localStorage.getItem("chat:selectedModel")) ||
     ""
+  // 用户 abort + 兜底超时合并（AbortSignal.any/timeout 在旧运行时缺失时降级为仅用户 signal）
+  const effectiveSignal = combineWithTimeoutSignal(signal)
   const res = await fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -106,7 +114,7 @@ async function* streamFromServer(
       type: body.type,
       model,
     }),
-    signal,
+    signal: effectiveSignal,
   })
 
   if (!res.ok || !res.body) {
@@ -138,9 +146,31 @@ async function* streamFromServer(
   }
 }
 
-export function insertDelta(editor: any, insertPos: number, delta: string, markName?: string): number {
+/**
+ * 把用户 abort signal 与兜底超时 signal 合并；运行时不支持
+ * AbortSignal.any/timeout（旧 WebView）时原样返回用户 signal。
+ */
+function combineWithTimeoutSignal(userSignal: AbortSignal): AbortSignal {
+  try {
+    if (
+      typeof AbortSignal.timeout === "function" &&
+      typeof AbortSignal.any === "function"
+    ) {
+      return AbortSignal.any([userSignal, AbortSignal.timeout(AI_STREAM_TIMEOUT_MS)])
+    }
+  } catch {
+    // 特性探测异常时降级
+  }
+  return userSignal
+}
+
+/**
+ * 以纯文本节点插入 AI 增量（审计 🟠：insertContentAt 对 string 会按 HTML 解析，
+ * AI 返回的普通文本含 `<`/`&` 时被静默吞掉；这里显式构造 text 节点绕开 HTML 解析）。
+ */
+export function insertDelta(editor: Editor, insertPos: number, delta: string, markName?: string): number {
   if (!delta) return insertPos
-  editor.chain().focus().insertContentAt(insertPos, delta).run()
+  editor.chain().focus().insertContentAt(insertPos, [{ type: "text", text: delta }]).run()
   if (markName) {
     editor.chain()
       .focus()
@@ -151,7 +181,17 @@ export function insertDelta(editor: any, insertPos: number, delta: string, markN
   return insertPos + delta.length
 }
 
-function prepareInsertionRange(editor: any): number {
+/** aiGeneration* 命令由 ui-state-extension 经 Commands 接口合并声明，此处按结构收窄 */
+interface AiCommandContext {
+  editor: Editor
+  commands: {
+    aiGenerationSetIsLoading: (value: boolean) => unknown
+    aiGenerationHasMessage: (value: boolean) => unknown
+    aiGenerationHide: () => unknown
+  }
+}
+
+function prepareInsertionRange(editor: Editor): number {
   const { from, to } = editor.state.selection
   if (from !== to) {
     editor.chain().focus().deleteSelection().run()
@@ -165,8 +205,8 @@ function createAiCommand(
 ) {
   return async (
     options: TextOptions = {},
-    editor: any,
-    commands: any
+    editor: Editor,
+    commands: AiCommandContext["commands"]
   ) => {
     const initialFrom = editor.state.selection.from
     const initialTo = editor.state.selection.to
@@ -233,13 +273,33 @@ function createAiCommand(
         }
         if (chunk.type === "RUN_FINISHED") break
         if (chunk.type === "fallback" && chunk.content) {
-          accumulated = chunk.content
+          // 文案客户端渲染（审计 A5x-5 待决策收口）：服务端 fallback 同时下发机器可读
+          // code，此处优先按 code 取当前语言文案，`content` 仅作未知 code 的兜底
+          const fallbackText =
+            chunk.code === "no_key"
+              ? m.chat_aiFallback_noKey()
+              : chunk.code === "upstream_error"
+                ? m.chat_aiFallback_upstreamError()
+                : chunk.content
+          accumulated = fallbackText
           editor.storage.ai.response = accumulated
           if (shouldInsert && insertPos >= 0) {
-            const content =
-              format === "rich-text" ? `<p>${accumulated}</p>` : accumulated
-            editor.chain().focus().insertContentAt(insertPos, content).run()
-            insertPos += content.length
+            if (format === "rich-text") {
+              // rich-text：AI 响应按富文本插入，经 schema 白名单解析（script/事件属性被丢弃）
+              const html = `<p>${accumulated}</p>`
+              editor.chain().focus().insertContentAt(insertPos, html).run()
+              insertPos += html.length
+            } else {
+              // plain-text：显式 text 节点，杜绝 HTML 解析吞字
+              editor
+                .chain()
+                .focus()
+                .insertContentAt(insertPos, [
+                  { type: "text", text: accumulated },
+                ])
+                .run()
+              insertPos += accumulated.length
+            }
           }
           break
         }
@@ -276,7 +336,7 @@ function createAiCommand(
   }
 }
 
-function promptImproveText(editor: any, action: string): string {
+function promptImproveText(editor: Editor, action: string): string {
   const mapping: Record<string, string> = {
     aiFixSpellingAndGrammar: "Fix all spelling and grammar errors",
     aiExtend: "Expand this text",
@@ -307,20 +367,35 @@ export const AiExtension = Extension.create({
   name: "ai",
 
   addStorage() {
-    return { ...defaultAiStorage } as any
+    return { ...defaultAiStorage }
   },
 
   addCommands() {
     const wrapAsyncCommand = (
       asyncCommand: (
         options: TextOptions,
-        editor: any,
-        commands: any
+        editor: Editor,
+        commands: AiCommandContext["commands"]
       ) => Promise<boolean>
     ) => {
       return (options?: TextOptions) =>
-        ({ editor, commands }: { editor: any; commands: any }) => {
-          asyncCommand(options || {}, editor, commands)
+        ({ editor, commands }: AiCommandContext) => {
+          // 异步命令体自建 try 之外的同步异常不能成为 unhandled rejection
+          try {
+            void asyncCommand(options || {}, editor, commands).catch(
+              (error: unknown) => {
+                console.error(
+                  `[Ai] command error:`,
+                  error instanceof Error ? error.message : "unknown"
+                )
+              }
+            )
+          } catch (error) {
+            console.error(
+              `[Ai] command error:`,
+              error instanceof Error ? error.message : "unknown"
+            )
+          }
           return true
         }
     }
@@ -328,29 +403,39 @@ export const AiExtension = Extension.create({
     const aiTranslateCommand = (
       language: string,
       options?: TextOptions
-    ) => ({ editor, commands }: { editor: any; commands: any }) => {
-      createAiCommand("aiTranslate")(
+    ) => ({ editor, commands }: AiCommandContext) => {
+      void createAiCommand("aiTranslate")(
         { ...(options || {}), language },
         editor,
         commands
-      )
+      ).catch((error: unknown) => {
+        console.error(
+          `[Ai] aiTranslate error:`,
+          error instanceof Error ? error.message : "unknown"
+        )
+      })
       return true
     }
 
     const aiAdjustToneCommand = (
       tone: string,
       options?: TextOptions
-    ) => ({ editor, commands }: { editor: any; commands: any }) => {
-      createAiCommand("aiAdjustTone")(
+    ) => ({ editor, commands }: AiCommandContext) => {
+      void createAiCommand("aiAdjustTone")(
         { ...(options || {}), tone },
         editor,
         commands
-      )
+      ).catch((error: unknown) => {
+        console.error(
+          `[Ai] aiAdjustTone error:`,
+          error instanceof Error ? error.message : "unknown"
+        )
+      })
       return true
     }
 
     const aiRejectHandler = (_options?: AiRejectOptions) =>
-      ({ editor, commands }: { editor: any; commands: any }) => {
+      ({ editor, commands }: AiCommandContext) => {
         const resetListener = editor.storage.ai?.resetListener
         if (typeof resetListener === "function") resetListener()
 
@@ -399,6 +484,6 @@ export const AiExtension = Extension.create({
   },
 
   onCreate() {
-    Object.assign(this.storage, { ...defaultAiStorage } as any)
+    Object.assign(this.storage, { ...defaultAiStorage })
   },
 })

package/src/components/tiptap/extensions/ai-suggestion-mark.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
 import { Mark, markInputRule, markPasteRule } from "@tiptap/core"
 
 export interface AiSuggestionMarkOptions {
@@ -28,7 +32,7 @@ export const AiSuggestionMark = Mark.create<AiSuggestionMarkOptions>({
   addInputRules() {
     return [
       markInputRule({
-        find: new RegExp(/@@(.+?)@@/),
+        find: /@@(.+?)@@/,
         type: this.type,
       }),
     ]
@@ -37,7 +41,7 @@ export const AiSuggestionMark = Mark.create<AiSuggestionMarkOptions>({
   addPasteRules() {
     return [
       markPasteRule({
-        find: new RegExp(/@@(.+?)@@/),
+        find: /@@(.+?)@@/,
         type: this.type,
       }),
     ]

package/src/components/tiptap/extensions/local-file/local-file-node.ts

@@ -1,4 +1,8 @@
-import { Node, mergeAttributes } from '@tiptap/core'
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+import { Node } from '@tiptap/core'
 
 export interface LocalFileOptions {
   HTMLAttributes: Record<string, unknown>
@@ -37,22 +41,22 @@ export const LocalFile = Node.create<LocalFileOptions>({
     return [{ tag: 'local-file' }]
   },
 
-  renderHTML({ HTMLAttributes }) {
-    const isImage = HTMLAttributes.mime?.startsWith('image/')
+  // 审计 🟡：禁止整包 merge HTMLAttributes——base64/mime/path 会被原样输出为
+  // 无效 DOM 属性（<img base64="...">），同一份 base64 在 DOM 出现两份。
+  // 这里显式挑拣输出字段。
+  renderHTML({ node }) {
+    const { path, mime, base64, name } = node.attrs as {
+      path: string | null
+      mime: string | null
+      base64: string | null
+      name: string | null
+    }
+    const isImage = mime?.startsWith('image/')
     if (isImage) {
-      const src = HTMLAttributes.base64
-        ? `data:${HTMLAttributes.mime};base64,${HTMLAttributes.base64}`
-        : HTMLAttributes.path
-      return ['img', mergeAttributes(HTMLAttributes, { src, alt: HTMLAttributes.name })]
+      const src = base64 ? `data:${mime};base64,${base64}` : path
+      return ['img', { src: src ?? undefined, alt: name ?? '' }]
     }
-    return [
-      'a',
-      mergeAttributes(HTMLAttributes, {
-        href: HTMLAttributes.path,
-        download: HTMLAttributes.name,
-      }),
-      `📎 ${HTMLAttributes.name}`,
-    ]
+    return ['a', { href: path ?? undefined, download: name ?? undefined }, `📎 ${name ?? ''}`]
   },
 
   addCommands() {

package/src/components/tiptap/extensions/node-background-extension.ts

@@ -44,6 +44,24 @@ export interface NodeBackgroundOptions {
   useStyle?: boolean
 }
 
+/**
+ * backgroundColor 值域白名单（与 collab-core 服务端镜像 `knowledge-additions.ts`
+ * 的 BG_COLOR_ALLOWED 同口径）：字符集覆盖具名色 / #hex / rgb(a) hsl(a) hwb lab
+ * lch oklab oklch color() color-mix() var(--x)（含空格分隔与 / alpha 语法）；
+ * 显式拒绝 `;` `:` `{` `}` 引号 反斜杠 `*` 换行——值经 renderHTML 拼进 style 属性，
+ * 白名单外按无背景处理（fail-closed），防协作内容夹带额外 CSS 声明注入。
+ */
+const BG_COLOR_ALLOWED = /^[A-Za-z0-9#%().,+\t /-]+$/
+
+function isValidBackgroundColor(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 128 &&
+    BG_COLOR_ALLOWED.test(value)
+  )
+}
+
 /**
  * Determines the target color for toggle operations
  */
@@ -92,15 +110,15 @@ export const NodeBackground = Extension.create<NodeBackgroundOptions>({
 
             parseHTML: (element: HTMLElement) => {
               const styleColor = element.style?.backgroundColor
-              if (styleColor) return styleColor
+              if (styleColor && isValidBackgroundColor(styleColor)) return styleColor
 
               const dataColor = element.getAttribute("data-background-color")
-              return dataColor || null
+              return dataColor && isValidBackgroundColor(dataColor) ? dataColor : null
             },
 
             renderHTML: (attributes) => {
               const color = attributes.backgroundColor as string | null
-              if (!color) return {}
+              if (!color || !isValidBackgroundColor(color)) return {}
 
               if (this.options.useStyle) {
                 return {

package/src/components/tiptap/lib/advanced-utils.ts

@@ -74,18 +74,14 @@ export function getActiveMarkAttrs(
     return mark?.attrs ?? null
   }
 
-  const seen = new Set<string>()
+  // 取范围内首个带目标 mark 的文本属性即可（单一 markName 无需去重集合）
   let foundAttrs: Attrs | null = null
 
   state.doc.nodesBetween(from, to, (node) => {
-    if (!node.isText) return
+    if (foundAttrs || !node.isText) return
 
-    for (const mark of node.marks) {
-      if (mark.type.name === markName && !seen.has(mark.type.name)) {
-        seen.add(mark.type.name)
-        foundAttrs = mark.attrs
-      }
-    }
+    const mark = node.marks.find((mk) => mk.type.name === markName)
+    if (mark) foundAttrs = mark.attrs
   })
 
   return foundAttrs
@@ -114,7 +110,9 @@ export function findSelectionPosition(params: {
   if (!selection.empty) return null
 
   const resolvedPos = selection.$anchor
+  // doc 级边界（depth 0）无块级父节点可定位，node(1)/before(1) 会抛 RangeError
   const nodeDepth = 1
+  if (resolvedPos.depth < nodeDepth) return null
   const selectedNode = resolvedPos.node(nodeDepth)
 
   return selectedNode ? resolvedPos.before(nodeDepth) : null

package/src/components/tiptap/lib/collab-utils.ts

@@ -19,44 +19,48 @@ import { NodeSelection, type Selection } from "@tiptap/pm/state"
 import { CellSelection } from "@tiptap/pm/tables"
 import type { JSONContent, Editor } from "@tiptap/react"
 import { isTextSelection, isNodeSelection, posToDOMRect } from "@tiptap/react"
-
-const NODE_TYPE_LABELS: Record<string, string> = {
-  paragraph: "正文",
-  heading: "标题",
-  blockquote: "引用",
-  listItem: "列表项",
-  codeBlock: "代码块",
-  table: "表格",
-  tocNode: "目录",
-  mindmap: "思维导图",
-  bulletlist: "无序列表",
-  orderedlist: "有序列表",
-  tasklist: "任务列表",
-  image: "图片",
-  video: "视频",
-  audio: "音频",
-  file: "文件",
+import { m } from "@/paraglide/messages.js"
+
+// 节点类型 → i18n 标签（调用时求值，不在模块顶层定格 locale）。
+// 键为 TipTap 节点名（驼峰；旧版 bulletlist/orderedlist/tasklist 全小写键永不命中）
+function nodeTypeLabel(nodeTypeName: string): string | null {
+  const labels: Record<string, string> = {
+    paragraph: m.editor_paragraph(),
+    heading: m.editor_heading(),
+    blockquote: m.editor_quote(),
+    listItem: m.editor_list_item(),
+    codeBlock: m['editor_code-block'](),
+    table: m.editor_table(),
+    tocNode: m['editor_table-of-contents'](),
+    mindmap: m.editor_mindmap(),
+    bulletList: m.editor_bullet_list(),
+    orderedList: m['editor_ordered-list'](),
+    taskList: m['editor_task-list'](),
+    image: m.editor_image(),
+    video: m.editor_video(),
+    audio: m.editor_audio(),
+    file: m.editor_file(),
+  }
+  return labels[nodeTypeName] ?? null
 }
 
 export type OverflowPosition = "none" | "top" | "bottom" | "both"
 
 export const getNodeDisplayName = (editor: Editor | null): string => {
-  if (!editor) return "节点"
+  if (!editor) return m.editor_node()
 
   const { selection } = editor.state
 
   if (selection instanceof NodeSelection) {
-    const nodeType = selection.node.type.name
-    return NODE_TYPE_LABELS[nodeType] || nodeType.toLowerCase()
+    return nodeTypeLabel(selection.node.type.name) ?? selection.node.type.name.toLowerCase()
   }
 
   if (selection instanceof CellSelection) {
-    return "表格"
+    return m.editor_table()
   }
 
   const { $anchor } = selection
-  const nodeType = $anchor.parent.type.name
-  return NODE_TYPE_LABELS[nodeType] || nodeType.toLowerCase()
+  return nodeTypeLabel($anchor.parent.type.name) ?? $anchor.parent.type.name.toLowerCase()
 }
 
 export const removeEmptyParagraphs = (content: JSONContent) => ({