@allbluecn/web-app 0.19.2 → 0.19.4

package/src/lib/{pgvector.ts → anyhub/base-dir.ts}

@@ -15,8 +15,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { pgVectorStore } from "./vector-store/pg-vector-store";
+import { homedir } from "node:os"
 
-export const searchByVector = pgVectorStore.searchByVector.bind(pgVectorStore);
-export const insertEmbedding = pgVectorStore.insertEmbedding.bind(pgVectorStore);
-export const deleteEmbeddings = pgVectorStore.deleteEmbeddings.bind(pgVectorStore);
+/**
+ * AnyHub 本地应用根目录。⚠ server-only（依赖 node:os + process.env）——
+ * 从 types.ts 拆出，保持 types.ts 零运行时依赖，客户端 type-import 不会把
+ * node:os 拉进浏览器 bundle。
+ */
+export function getAnyHubBaseDir(): string {
+  return process.env.ANYHUB_DIR
+    || `${homedir()}/.anyhub`
+}

package/src/lib/anyhub/capabilities.ts

@@ -15,50 +15,64 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+/**
+ * AnyHub 能力目录。label 存 i18n message key（flat JSON，冒号转下划线），
+ * 渲染层经 `t(key)` 解析——能力名会展示在应用权限授予 UI，禁止硬编码中文。
+ */
 export const CAPABILITY_GROUPS = [
+  {
+    id: "prd",
+    labelKey: "anyhub_capability_group_prd",
+    icon: "file-text",
+    capabilities: [
+      { id: "prd:read", labelKey: "anyhub_capability_prd_read" },
+      { id: "prd:write", labelKey: "anyhub_capability_prd_write" },
+      { id: "prd:delete", labelKey: "anyhub_capability_prd_delete" },
+    ],
+  },
   {
     id: "design",
-    label: "设计",
+    labelKey: "anyhub_capability_group_design",
     icon: "clipboard",
     capabilities: [
-      { id: "design:read", label: "读取设计" },
-      { id: "design:write", label: "写入设计" },
-      { id: "design:delete", label: "删除设计" },
+      { id: "design:read", labelKey: "anyhub_capability_design_read" },
+      { id: "design:write", labelKey: "anyhub_capability_design_write" },
+      { id: "design:delete", labelKey: "anyhub_capability_design_delete" },
     ],
   },
   {
     id: "doc",
-    label: "文档",
+    labelKey: "anyhub_capability_group_doc",
     icon: "file-text",
     capabilities: [
-      { id: "doc:read", label: "读取文档" },
-      { id: "doc:write", label: "写入文档" },
+      { id: "doc:read", labelKey: "anyhub_capability_doc_read" },
+      { id: "doc:write", labelKey: "anyhub_capability_doc_write" },
     ],
   },
   {
     id: "ai",
-    label: "AI 配置",
+    labelKey: "anyhub_capability_group_ai",
     icon: "bot",
     capabilities: [
-      { id: "ai:read", label: "读取配置" },
-      { id: "ai:write", label: "修改配置" },
+      { id: "ai:read", labelKey: "anyhub_capability_ai_read" },
+      { id: "ai:write", labelKey: "anyhub_capability_ai_write" },
     ],
   },
   {
     id: "user",
-    label: "用户信息",
+    labelKey: "anyhub_capability_group_user",
     icon: "user",
     capabilities: [
-      { id: "user:read", label: "读取信息" },
+      { id: "user:read", labelKey: "anyhub_capability_user_read" },
     ],
   },
   {
     id: "team",
-    label: "团队",
+    labelKey: "anyhub_capability_group_team",
     icon: "users",
     capabilities: [
-      { id: "team:read", label: "读取团队" },
-      { id: "team:write", label: "写入团队" },
+      { id: "team:read", labelKey: "anyhub_capability_team_read" },
+      { id: "team:write", labelKey: "anyhub_capability_team_write" },
     ],
   },
 ] as const
@@ -70,6 +84,11 @@ export const ALL_CAPABILITIES = CAPABILITY_GROUPS.flatMap((g) =>
 export type CapabilityId = (typeof ALL_CAPABILITIES)[number]
 
 export const CAPABILITY_METHOD_MAP: Record<string, string> = {
+  "prd:list": "prd:read",
+  "prd:get": "prd:read",
+  "prd:create": "prd:write",
+  "prd:update": "prd:write",
+  "prd:delete": "prd:delete",
   "design:list": "design:read",
   "design:get": "design:read",
   "design:create": "design:write",

package/src/lib/anyhub/local-path.ts

@@ -27,7 +27,7 @@
 
 import fs from "node:fs"
 import path from "node:path"
-import { getAnyHubBaseDir } from "./types"
+import { getAnyHubBaseDir } from "./base-dir"
 
 /** 管理员预置白名单根的环境变量名（多根用 path.delimiter 分隔）。 */
 export const ALLOWED_LOCAL_ROOTS_ENV = "ANYHUB_ALLOWED_LOCAL_ROOTS"

package/src/lib/anyhub/permissions.ts

@@ -19,6 +19,9 @@ import { prisma } from "@allbluecn/database"
 import { CAPABILITY_METHOD_MAP, ALL_CAPABILITIES } from "./capabilities"
 import type { CapabilityId } from "./capabilities"
 
+// 本模块为 server 侧模块（含 prisma）：仅可被 serverFn / 服务端代码 import，
+// 客户端权限校验经 `@/server/serverFns/anyhub/permissions` 的 serverFn 走 RPC。
+
 export async function checkPermission(
   appId: string,
   method: string,
@@ -41,6 +44,10 @@ export async function grantPermission(
   userId: string,
   granted: boolean,
 ): Promise<void> {
+  // 与 grantAllFromManifest 白名单对称：拒绝任意 capability 字符串入库
+  if (!ALL_CAPABILITIES.includes(capability as CapabilityId)) {
+    throw new Error(`未知的 capability: ${capability}`)
+  }
   await prisma.anyHubPermission.upsert({
     where: { appId_capability_userId: { appId, capability, userId } },
     update: { granted },
@@ -53,15 +60,20 @@ export async function grantAllFromManifest(
   capabilities: Record<string, boolean>,
   userId: string,
 ): Promise<void> {
-  for (const [cap] of Object.entries(capabilities)) {
-    if (ALL_CAPABILITIES.includes(cap as CapabilityId)) {
-      await prisma.anyHubPermission.upsert({
+  const validCaps = Object.keys(capabilities).filter((cap) =>
+    ALL_CAPABILITIES.includes(cap as CapabilityId),
+  )
+  if (validCaps.length === 0) return
+  // 事务包裹：避免中途失败留下部分授权的中间态
+  await prisma.$transaction(
+    validCaps.map((cap) =>
+      prisma.anyHubPermission.upsert({
         where: { appId_capability_userId: { appId, capability: cap, userId } },
         update: {},
         create: { appId, capability: cap, granted: false, userId },
-      })
-    }
-  }
+      }),
+    ),
+  )
 }
 
 export async function getAppPermissions(appId: string, userId: string) {

package/src/lib/anyhub/proxy.ts

@@ -18,11 +18,14 @@
 import fs from "fs"
 import path from "path"
 import http from "http"
-import { getAnyHubBaseDir } from "./types"
+import { getAnyHubBaseDir } from "./base-dir"
 import { isLocalPathAllowed, isPathAllowed } from "./local-path"
 
 export type ProxyMode = "static" | "dev-server" | "none"
 
+// dev-server 代理响应体上限（20MB）：静态资源远小于此，超限视为异常上游
+const MAX_PROXY_BODY_BYTES = 20 * 1024 * 1024
+
 interface ProxyTarget {
   mode: ProxyMode
   localPath?: string
@@ -56,7 +59,8 @@ export class ProxyAdapter {
     }
 
     try {
-      const content = fs.readFileSync(requestedPath)
+      // 异步读取（原 readFileSync 同步阻塞事件循环）
+      const content = await fs.promises.readFile(requestedPath)
       const body = content instanceof Buffer ? new Uint8Array(content) : content
       const ext = path.extname(requestedPath).toLowerCase()
       const mimeTypes: Record<string, string> = {
@@ -84,18 +88,36 @@ export class ProxyAdapter {
     subpath: string,
   ): Promise<{ body: Uint8Array | string; contentType: string; status: number }> {
     return new Promise((resolve) => {
+      // 逐段编码：`?`/`#`/空格等不再产生畸形请求行（`/` 保留为路径分隔符）
+      const encodedSubpath = subpath.split("/").map(encodeURIComponent).join("/")
       const options = {
         hostname: "localhost",
         port,
-        path: `/${subpath}`,
+        path: `/${encodedSubpath}`,
         method: "GET",
         timeout: 10_000,
       }
 
       const req = http.get(options, (res) => {
         const chunks: Uint8Array[] = []
-        res.on("data", (chunk: Uint8Array) => chunks.push(chunk))
+        // 响应体上限：异常 dev server 无限输出时防 OOM
+        let total = 0
+        let tooLarge = false
+        res.on("data", (chunk: Uint8Array) => {
+          total += chunk.length
+          if (total > MAX_PROXY_BODY_BYTES) {
+            tooLarge = true
+            chunks.length = 0
+            req.destroy()
+            return
+          }
+          chunks.push(chunk)
+        })
         res.on("end", () => {
+          if (tooLarge) {
+            resolve({ body: "Response too large", contentType: "text/plain", status: 502 })
+            return
+          }
           const totalLength = chunks.reduce((sum, c) => sum + c.length, 0)
           const merged = new Uint8Array(totalLength)
           let offset = 0

package/src/lib/anyhub/types.ts

@@ -15,9 +15,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { homedir } from "node:os"
+// ⚠ 纯类型模块（零运行时依赖）：getAnyHubBaseDir 等 Node 运行时逻辑已拆到
+// ./base-dir（server-only），客户端 type-import 本文件不会拉进 node:os。
 
-export type AnyHubAppSource = "market" | "github" | "local"
+export type AnyHubAppSource = "marketplace" | "github" | "local"
 export type AnyHubAppStatus = "installing" | "ready" | "error"
 
 export interface AnyHubAppData {
@@ -69,7 +70,3 @@ export interface AnyHubMarketAppData {
   status: string
 }
 
-export function getAnyHubBaseDir(): string {
-  return process.env.ANYHUB_DIR
-    || `${homedir()}/.anyhub`
-}

package/src/lib/app-version.ts

@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { m } from '@/paraglide/messages.js'
+
 // 版本号由 vite.shared.ts 构建时注入（__APP_VERSION__），无需运行时读取 package.json
 declare const __APP_VERSION__: string
 export const APP_VERSION: string = __APP_VERSION__
@@ -24,4 +26,9 @@ const APP_UPDATE_DATE: string = __APP_UPDATE_DATE__
 
 export const APP_VERSION_DISPLAY = `v${APP_VERSION}`
 export const APP_FULL_VERSION = `AllBlue v${APP_VERSION}`
-export const APP_UPDATE_DATE_DISPLAY = `更新于${APP_UPDATE_DATE}`
+
+// 更新日期文案用户可见（changelog 页侧栏），经 i18n 按 locale 解析（函数形态
+// 而非模块级常量，避免 import 时刻固化 locale）
+export function getAppUpdateDateDisplay(): string {
+  return m.common_app_updatedOn({ date: APP_UPDATE_DATE })
+}

package/src/lib/auth/__tests__/auth-config-profile-cache.test.ts

@@ -10,7 +10,7 @@ vi.mock('@allbluecn/database', () => ({
 
 const { prisma } = await import('@allbluecn/database')
 const { invalidateProfileCache, authConfig } = await import('../auth.config')
-const { defaultAvatarConfig } = await import('@/components/settings/personal-team/account/avatar/avatar-config')
+const { defaultAvatarConfig } = await import('@/lib/avatar/avatar-config')
 
 const userFindUnique = vi.mocked(prisma.user.findUnique)
 const subFindUnique = vi.mocked(prisma.subscription.findUnique)
@@ -28,6 +28,7 @@ function mockUserRow(overrides: Record<string, unknown> = {}) {
     aiApiKey: null,
     locale: null,
     aiSourceMode: null,
+    tokenVersion: 0,
     ...overrides,
   }
 }
@@ -36,11 +37,11 @@ function sessionFn() {
   return (authConfig.callbacks as { session: (args: unknown) => Promise<unknown> }).session
 }
 
-async function callSession(userId: string) {
+async function callSession(userId: string, tokenExtra: Record<string, unknown> = {}) {
   const fn = sessionFn()
   const session = await fn({
     session: { user: { name: 'tester' } },
-    token: { id: userId, role: 'USER' },
+    token: { id: userId, role: 'USER', ...tokenExtra },
   }) as { user: Record<string, unknown> & { planLabel?: string } | null }
   return session.user
 }
@@ -52,7 +53,7 @@ beforeEach(() => {
   userFindUnique.mockResolvedValue(mockUserRow() as never)
   subFindUnique.mockResolvedValue(null)
   providerFindMany.mockResolvedValue([])
-  for (const uid of ['u-pro', 'u-free', 'u-miss', 'u-fail']) invalidateProfileCache(uid)
+  for (const uid of ['u-pro', 'u-free', 'u-miss', 'u-fail', 'u-ver']) invalidateProfileCache(uid)
 })
 
 describe('auth session callback profile 缓存（任务C：订阅查询并入 + in-flight 去重）', () => {
@@ -199,3 +200,30 @@ describe('SEC-13：jwt/session callback prisma 防御降级（callback 不抛错
     expect(user?.planLabel).toBe('free')
   })
 })
+
+describe('tokenVersion 凭据版本吊销（重置密码后旧 JWT 会话失效）', () => {
+  it('版本不匹配 → session.user = null（旧 JWT 被拒）', async () => {
+    userFindUnique.mockResolvedValue(mockUserRow({ tokenVersion: 2 }) as never)
+    const user = await callSession('u-ver', { tokenVersion: 1 })
+    expect(user).toBeNull()
+  })
+
+  it('token 无版本字段（升级前旧 JWT）+ DB 版本 0 → 灰度通过', async () => {
+    const user = await callSession('u-ver')
+    expect(user).not.toBeNull()
+    expect(user?.planLabel).toBe('free')
+  })
+
+  it('版本匹配 → 正常通过', async () => {
+    userFindUnique.mockResolvedValue(mockUserRow({ tokenVersion: 3 }) as never)
+    const user = await callSession('u-ver', { tokenVersion: 3 })
+    expect(user).not.toBeNull()
+    expect(user?.planLabel).toBe('free')
+  })
+
+  it('DB 值缺失（降级路径）→ 跳过比对不误杀', async () => {
+    userFindUnique.mockResolvedValue(mockUserRow({ tokenVersion: null }) as never)
+    const user = await callSession('u-ver', { tokenVersion: 1 })
+    expect(user).not.toBeNull()
+  })
+})