@allbluecn/web-app 0.19.2 → 0.19.4

package/src/lib/vector-store/sqlite-vec-store.ts

@@ -18,21 +18,20 @@
 import Database from "better-sqlite3";
 import * as sqliteVec from "sqlite-vec";
 import type { VectorStore, VectorSearchResult } from "./types";
-
-const ALLOWED_TABLES = [
-  "design_pages",
-  "components",
-  "blocks",
-  "design_embeddings",
-  "knowledge_embeddings",
-] as const;
-const ALLOWED_DELETE_COLUMNS = ["kbId", "documentId", "designPageId"];
+import {
+  ALLOWED_TABLES,
+  ALLOWED_FILTER_COLUMNS,
+  ALLOWED_INSERT_COLUMNS,
+} from "./allowlist";
 
 let db: Database.Database | null = null;
 
 function getDb(): Database.Database {
   if (db) return db;
-  const url = process.env.DATABASE_URL!;
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("[sqlite-vec-store] DATABASE_URL 未配置，无法打开 SQLite 向量库");
+  }
   const path = url.replace(/^file:/, "");
   db = new Database(path);
   db.pragma("journal_mode = WAL");
@@ -55,12 +54,35 @@ function toBuffer(embedding: number[]): Buffer {
   return Buffer.from(new Float32Array(embedding).buffer);
 }
 
-/** 建表（首次或测试初始化时调用；桌面端正式建表在 B.5） */
+/** 建表（首次或测试初始化时调用；桌面端正式建表在 desktop-init.ts）。
+ *  base 表必须带齐 searchByVector/insertEmbedding 消费的过滤列（kbId/documentId/
+ *  designPageId/chunkIndex）——旧 2 列 schema 与查询 schema 不符，误用即运行时
+ *  "no such column"（审计 ⚪）。对已存在的旧表逐列幂等补齐。 */
 export function ensureVecTables(d: Database.Database) {
   for (const t of ALLOWED_TABLES) {
     d.exec(
-      `CREATE TABLE IF NOT EXISTS ${t} (id TEXT PRIMARY KEY, content TEXT);`
+      `CREATE TABLE IF NOT EXISTS ${t} (
+        id TEXT PRIMARY KEY,
+        content TEXT,
+        kbId TEXT,
+        documentId TEXT,
+        designPageId TEXT,
+        chunkIndex INTEGER
+      );`
     );
+    // 旧库（仅 id/content 两列）逐列幂等补齐：duplicate column 错误即已存在
+    for (const [col, ddl] of [
+      ["kbId", "TEXT"],
+      ["documentId", "TEXT"],
+      ["designPageId", "TEXT"],
+      ["chunkIndex", "INTEGER"],
+    ] as const) {
+      try {
+        d.exec(`ALTER TABLE ${t} ADD COLUMN ${col} ${ddl};`);
+      } catch {
+        // 列已存在：忽略
+      }
+    }
     // spike 0.3：cosine 必须列级语法（无逗号无引号），table-level 会报错
     d.exec(
       `CREATE VIRTUAL TABLE IF NOT EXISTS vec_${t} USING vec0(embedding float[1536] distance_metric=cosine);`
@@ -77,6 +99,13 @@ export const sqliteVecStore: VectorStore = {
     whereValue
   ): Promise<VectorSearchResult[]> {
     validateTable(table);
+    if (
+      whereColumn &&
+      !(ALLOWED_FILTER_COLUMNS as readonly string[]).includes(whereColumn)
+    ) {
+      // 与 pg 版防护对齐：列名直接内插进 SQL，必须白名单（双后端行为一致性）
+      throw new Error(`非法过滤列: ${whereColumn}`);
+    }
     const d = getDb();
     const blob = toBuffer(embedding);
     let rows: Array<{ id: string; content: string; distance: number }>;
@@ -135,45 +164,61 @@ export const sqliteVecStore: VectorStore = {
   async insertEmbedding(table, id, content, embedding, extraFields) {
     validateTable(table);
     const d = getDb();
-    if (!extraFields || Object.keys(extraFields).length === 0) {
-      d.prepare(
-        `INSERT INTO ${table} (id, content) VALUES (?, ?)`
-      ).run(id, content);
-    } else {
-      const keys = Object.keys(extraFields);
-      const vals = Object.values(extraFields);
-      const cols = keys.map((k) => `"${k}"`).join(", ");
-      const ph = keys.map(() => "?").join(", ");
-      d.prepare(
-        `INSERT INTO ${table} (${cols}, id, content) VALUES (${ph}, ?, ?)`
-      ).run(...vals, id, content);
+    if (extraFields && Object.keys(extraFields).length > 0) {
+      // 键名直接拼进 SQL 列名：不在白名单即拒绝（与 pg 版同款注入面）
+      for (const k of Object.keys(extraFields)) {
+        if (!(ALLOWED_INSERT_COLUMNS as readonly string[]).includes(k)) {
+          throw new Error(`非法插入列: ${k}`);
+        }
+      }
     }
-    const row = d.prepare(`SELECT rowid AS rid FROM ${table} WHERE id = ?`).get(
-      id
-    ) as { rid: number };
-    // spike 0.1：better-sqlite3 13 绑定 vec0 rowid 必须 BigInt，JS number 会绑成 REAL 报错
-    d.prepare(
-      `INSERT INTO vec_${table} (rowid, embedding) VALUES (?, ?)`
-    ).run(BigInt(row.rid), toBuffer(embedding));
+    // 事务包裹两段写：vec 插入失败（如维度不匹配）时 base 行不得残留成孤儿
+    const insertTx = d.transaction(() => {
+      if (!extraFields || Object.keys(extraFields).length === 0) {
+        d.prepare(
+          `INSERT INTO ${table} (id, content) VALUES (?, ?)`
+        ).run(id, content);
+      } else {
+        const keys = Object.keys(extraFields);
+        const vals = Object.values(extraFields);
+        const cols = keys.map((k) => `"${k}"`).join(", ");
+        const ph = keys.map(() => "?").join(", ");
+        d.prepare(
+          `INSERT INTO ${table} (${cols}, id, content) VALUES (${ph}, ?, ?)`
+        ).run(...vals, id, content);
+      }
+      const row = d
+        .prepare(`SELECT rowid AS rid FROM ${table} WHERE id = ?`)
+        .get(id) as { rid: number };
+      // spike 0.1：better-sqlite3 13 绑定 vec0 rowid 必须 BigInt，JS number 会绑成 REAL 报错
+      d.prepare(
+        `INSERT INTO vec_${table} (rowid, embedding) VALUES (?, ?)`
+      ).run(BigInt(row.rid), toBuffer(embedding));
+    });
+    insertTx();
   },
 
   async deleteEmbeddings(table, whereColumn, whereValue) {
     validateTable(table);
     if (
-      !(ALLOWED_DELETE_COLUMNS as readonly string[]).includes(whereColumn)
+      !(ALLOWED_FILTER_COLUMNS as readonly string[]).includes(whereColumn)
     ) {
       throw new Error(`非法删除过滤列: ${whereColumn}`);
     }
     const d = getDb();
-    const rows = d.prepare(
-      `SELECT rowid AS rid FROM ${table} WHERE ${whereColumn} = ?`
-    ).all(whereValue) as Array<{ rid: number }>;
-    if (rows.length === 0) return;
-    const rids = rows.map((r) => BigInt(r.rid));
-    const vecPh = rids.map(() => "?").join(",");
-    d.prepare(`DELETE FROM vec_${table} WHERE rowid IN (${vecPh})`).run(
-      ...rids
-    );
-    d.prepare(`DELETE FROM ${table} WHERE ${whereColumn} = ?`).run(whereValue);
+    // 事务包裹两段删：中断时两表不得出现不一致
+    const deleteTx = d.transaction(() => {
+      const rows = d.prepare(
+        `SELECT rowid AS rid FROM ${table} WHERE ${whereColumn} = ?`
+      ).all(whereValue) as Array<{ rid: number }>;
+      if (rows.length === 0) return;
+      const rids = rows.map((r) => BigInt(r.rid));
+      const vecPh = rids.map(() => "?").join(",");
+      d.prepare(`DELETE FROM vec_${table} WHERE rowid IN (${vecPh})`).run(
+        ...rids
+      );
+      d.prepare(`DELETE FROM ${table} WHERE ${whereColumn} = ?`).run(whereValue);
+    });
+    deleteTx();
   },
 };

package/src/providers/index.tsx

@@ -32,9 +32,17 @@ import { errorMessage } from "@/lib/toast-error";
 // 宿主注入图标选择器实现，供 plugins-core 的 PRD 弹窗等使用（模块级单例）
 registerIconPicker(LucideIconPicker);
 
+// Tauri 全局注入标志（window.__TAURI_INTERNALS__ / __TAURI__）——集中声明避免散落 as any
+interface TauriWindow {
+  __TAURI_INTERNALS__?: unknown
+  __TAURI__?: unknown
+}
+
 function DesktopDeepLinkListener() {
   useEffect(() => {
-    if (typeof window === 'undefined' || !(window as any).__TAURI_INTERNALS__ && !(window as any).__TAURI__) return
+    const tauriWindow = window as unknown as TauriWindow
+    if (typeof window === 'undefined' || !tauriWindow.__TAURI_INTERNALS__ && !tauriWindow.__TAURI__) return
+    let disposed = false
     let unlisten: (() => void) | undefined
     import('@tauri-apps/api/event').then(({ listen }) => {
       return listen<string>('remote-login-callback', async (event) => {
@@ -48,11 +56,18 @@ function DesktopDeepLinkListener() {
           toast.error(m.common_auth_loginFailed({ message: errorMessage(e, m.common_auth_unknownError()) }))
         }
       }).then((fn) => {
+        // 卸载竞态守卫：listen resolve 前组件已卸载时立即注销，
+        // 否则该全局监听器永不清理（路由切换反复挂载即累积）
+        if (disposed) {
+          fn()
+          return
+        }
         unlisten = fn
       })
     }).catch(() => {})
 
     return () => {
+      disposed = true
       unlisten?.()
     }
   }, [])

package/src/providers/theme-mode-provider.tsx

@@ -82,12 +82,13 @@ export function ThemeModeProvider({ children }: { children: ReactNode }) {
     setTheme(resolveTheme(mode, systemPrefersDark, new Date()));
   }, [mode, mounted, systemPrefersDark, setTheme]);
 
-  // auto 模式：每分钟 + 窗口回到前台时重算（跨过时段边界自动翻转）
+  // auto 模式：每分钟 + 窗口回到前台时重算（跨过时段边界自动翻转）。
+  // 挂载/切回 auto 那一次的 setTheme 由上方主 effect 完成，此处不再立即
+  // tick（原实现每周期首帧重复应用一次，幂等但多余）
   useEffect(() => {
     if (!mounted || mode !== "auto") return;
     const tick = () =>
       setTheme(resolveTheme("auto", systemPrefersDark, new Date()));
-    tick();
     const id = window.setInterval(tick, 60_000);
     const onVisible = () => {
       if (document.visibilityState === "visible") tick();

package/src/routes/-tests/attachments-content.test.ts

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 附件内容路由（审计 2026-10-25 🔴 存储型 XSS + 🟠 IDOR）回归哨兵：
+// - 响应 Content-Type 不再直用库内 mimeType：白名单外一律 octet-stream + attachment；
+// - 全部响应带 X-Content-Type-Options: nosniff；
+// - 查询必须联查 story.project.members 校验当前用户成员关系（无权限与不存在同为 404）；
+// - 异常不回传原始 message。
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  prisma: {
+    storyAttachment: { findFirst: vi.fn() },
+  },
+  requireAuth: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database', () => ({ prisma: mocks.prisma }))
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: mocks.requireAuth,
+  UnauthorizedError: class UnauthorizedError extends Error {
+    constructor() {
+      super('UNAUTHORIZED')
+    }
+  },
+}))
+
+import { Route } from '../api/attachments/$id/content'
+
+type Handler = (ctx: { request: Request; params: { id: string } }) => Promise<Response>
+const GET = (Route.options.server as { handlers?: { GET?: Handler } } | undefined)?.handlers?.GET
+if (!GET) throw new Error('GET handler missing')
+
+const call = (id = 'att-1') =>
+  GET({ request: new Request(`https://allblue.test/api/attachments/${id}/content`), params: { id } })
+
+const bytes = Buffer.from('<script>alert(1)</script>')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requireAuth.mockResolvedValue({ user: { id: 'u1' } })
+})
+
+describe('/api/attachments/$id/content', () => {
+  it('未登录 → 401，不查库', async () => {
+    mocks.requireAuth.mockRejectedValue(new Error('UNAUTHORIZED'))
+    const res = await call()
+    expect(res.status).toBe(401)
+    expect(mocks.prisma.storyAttachment.findFirst).not.toHaveBeenCalled()
+  })
+
+  it('查询联查项目成员关系；未命中 → 404', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockResolvedValue(null)
+    const res = await call('att-foreign')
+    expect(res.status).toBe(404)
+    expect(mocks.prisma.storyAttachment.findFirst).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          id: 'att-foreign',
+          story: { project: { members: { some: { userId: 'u1', status: { not: 'suspended' } } } } },
+        },
+      }),
+    )
+  })
+
+  it('text/html 附件：Content-Type 降为 octet-stream + attachment 下载 + nosniff', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockResolvedValue({
+      fileName: 'evil.html',
+      mimeType: 'text/html; charset=utf-8',
+      bytes,
+    })
+    const res = await call()
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Content-Type')).toBe('application/octet-stream')
+    expect(res.headers.get('Content-Disposition')).toMatch(/^attachment; filename\*=UTF-8''evil\.html$/)
+    expect(res.headers.get('X-Content-Type-Options')).toBe('nosniff')
+    expect(res.headers.get('Content-Security-Policy')).toBe("default-src 'none'")
+  })
+
+  it('image/svg+xml 同样不允许 inline（可承载脚本）', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockResolvedValue({ fileName: 'a.svg', mimeType: 'image/svg+xml', bytes })
+    const res = await call()
+    expect(res.headers.get('Content-Type')).toBe('application/octet-stream')
+    expect(res.headers.get('Content-Disposition')).toMatch(/^attachment;/)
+  })
+
+  it('白名单类型（image/png）保持 inline 且大小写/参数归一', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockResolvedValue({ fileName: '图.png', mimeType: 'IMAGE/PNG', bytes })
+    const res = await call()
+    expect(res.headers.get('Content-Type')).toBe('image/png')
+    expect(res.headers.get('Content-Disposition')).toBe(`inline; filename*=UTF-8''${encodeURIComponent('图.png')}`)
+    expect(res.headers.get('X-Content-Type-Options')).toBe('nosniff')
+    expect(res.headers.get('Content-Length')).toBe(String(bytes.byteLength))
+  })
+
+  it('空/缺失 mimeType → octet-stream 下载', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockResolvedValue({ fileName: 'x.bin', mimeType: '', bytes })
+    const res = await call()
+    expect(res.headers.get('Content-Type')).toBe('application/octet-stream')
+  })
+
+  it('内部异常 → 500 通用文案，不外泄 error.message', async () => {
+    mocks.prisma.storyAttachment.findFirst.mockRejectedValue(new Error('relation "story_attachments" does not exist'))
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const res = await call()
+    expect(res.status).toBe(500)
+    expect(await res.text()).toBe('Internal Server Error')
+    expect(errorSpy).toHaveBeenCalled()
+    errorSpy.mockRestore()
+  })
+})

package/src/routes/__desktop/onboarding/route.lazy.tsx

@@ -1,5 +1,5 @@
 import { createLazyFileRoute, useNavigate } from '@tanstack/react-router'
-import { useState } from 'react'
+import { useState, type KeyboardEvent } from 'react'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
 import {
@@ -22,6 +22,9 @@ export const Route = createLazyFileRoute('/__desktop/onboarding')({
   component: OnboardingPage,
 })
 
+// SaaS 入口地址（桌面端默认云端模式落点，环境切换只需改这里）
+const SAAS_URL = 'https://allblue.litsex.cn'
+
 function OnboardingPage() {
   const { switchMode } = useConnection()
   const navigate = useNavigate()
@@ -32,7 +35,7 @@ function OnboardingPage() {
 
   const handleSelectSaas = async () => {
     try {
-      await switchMode({ mode: 'saas', url: 'https://allblue.litsex.cn' })
+      await switchMode({ mode: 'saas', url: SAAS_URL })
     } catch (e) {
       toast.error(m.desktop_onboarding_errors_switchFailed({ message: errorMessage(e, m.desktop_onboarding_errors_unknownError()) }))
     }
@@ -41,7 +44,7 @@ function OnboardingPage() {
   const handleSelectLocal = async () => {
     try {
       await switchMode({ mode: 'local' })
-      navigate({ to: '/workspace' })
+      await navigate({ to: '/workspace' })
     } catch (e) {
       toast.error(m.desktop_onboarding_errors_localFailed({ message: errorMessage(e, m.desktop_onboarding_errors_unknownError()) }))
     }
@@ -49,16 +52,25 @@ function OnboardingPage() {
 
   const handleConfirmSelfHosted = async () => {
     setTesting(true)
-    const result = await connectionTest(selfHostedUrl)
-    setTesting(false)
-    if (!result.ok) {
-      toast.error(m.desktop_onboarding_errors_connectFailed({ message: result.error ?? m.desktop_onboarding_errors_timeout() }))
-      return
-    }
     try {
+      const result = await connectionTest(selfHostedUrl)
+      if (!result.ok) {
+        toast.error(m.desktop_onboarding_errors_connectFailed({ message: result.error ?? m.desktop_onboarding_errors_timeout() }))
+        return
+      }
       await switchMode({ mode: 'self-hosted', url: selfHostedUrl, label: selfHostedLabel })
     } catch (e) {
       toast.error(m.desktop_onboarding_errors_switchFailed({ message: errorMessage(e, m.desktop_onboarding_errors_unknownError()) }))
+    } finally {
+      setTesting(false)
+    }
+  }
+
+  // 键盘可达性：Card 为 div+onClick，补 role/tabIndex/Enter·Space 激活
+  const handleCardKeyDown = (handler: () => void) => (e: KeyboardEvent) => {
+    if (e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault()
+      handler()
     }
   }
 
@@ -71,36 +83,54 @@ function OnboardingPage() {
         </div>
 
         <div className="grid gap-4 md:grid-cols-3">
-          <Card className="cursor-pointer hover:border-primary transition-colors" onClick={handleSelectSaas}>
+          <Card
+            className="cursor-pointer hover:border-primary transition-colors"
+            onClick={handleSelectSaas}
+            role="button"
+            tabIndex={0}
+            onKeyDown={handleCardKeyDown(handleSelectSaas)}
+          >
             <CardHeader>
               <Cloud className="size-10 text-primary mb-2" />
               <CardTitle>{m.desktop_onboarding_saas_title()}</CardTitle>
               <CardDescription>{m.desktop_onboarding_saas_desc()}</CardDescription>
             </CardHeader>
             <CardContent>
-              <Button className="w-full" variant="default">{m.desktop_onboarding_saas_button()}</Button>
+              <Button className="w-full" variant="default" tabIndex={-1}>{m.desktop_onboarding_saas_button()}</Button>
             </CardContent>
           </Card>
 
-          <Card className="cursor-pointer hover:border-primary transition-colors" onClick={() => setSelfHostedDialogOpen(true)} >
+          <Card
+            className="cursor-pointer hover:border-primary transition-colors"
+            onClick={() => setSelfHostedDialogOpen(true)}
+            role="button"
+            tabIndex={0}
+            onKeyDown={handleCardKeyDown(() => setSelfHostedDialogOpen(true))}
+          >
             <CardHeader>
               <Server className="size-10 text-primary mb-2" />
               <CardTitle>{m.desktop_onboarding_selfHosted_title()}</CardTitle>
               <CardDescription>{m.desktop_onboarding_selfHosted_desc()}</CardDescription>
             </CardHeader>
             <CardContent>
-              <Button className="w-full" variant="outline">{m.desktop_onboarding_selfHosted_button()}</Button>
+              <Button className="w-full" variant="outline" tabIndex={-1}>{m.desktop_onboarding_selfHosted_button()}</Button>
             </CardContent>
           </Card>
 
-          <Card className="cursor-pointer hover:border-primary transition-colors" onClick={handleSelectLocal}>
+          <Card
+            className="cursor-pointer hover:border-primary transition-colors"
+            onClick={handleSelectLocal}
+            role="button"
+            tabIndex={0}
+            onKeyDown={handleCardKeyDown(handleSelectLocal)}
+          >
             <CardHeader>
               <HardDrive className="size-10 text-primary mb-2" />
               <CardTitle>{m.desktop_onboarding_local_title()}</CardTitle>
               <CardDescription>{m.desktop_onboarding_local_desc()}</CardDescription>
             </CardHeader>
             <CardContent>
-              <Button className="w-full" variant="outline">{m.desktop_onboarding_local_button()}</Button>
+              <Button className="w-full" variant="outline" tabIndex={-1}>{m.desktop_onboarding_local_button()}</Button>
             </CardContent>
           </Card>
         </div>

package/src/routes/__root.tsx

@@ -66,7 +66,7 @@ export const Route = createRootRouteWithContext<RouterContext>()({
 
 function RootComponent() {
   const session = Route.useRouteContext({ select: (c) => c.session }) as Session | null
-  const { lang } = useParams({ strict: false }) as { lang?: string | undefined }
+  const { lang } = useParams({ strict: false })
 
   useEffect(() => {
     const media = window.matchMedia('(prefers-color-scheme: dark)')
@@ -106,10 +106,6 @@ function RootComponent() {
 }
 
 function NotFoundPage() {
-  return <NotFoundPageInner />
-}
-
-function NotFoundPageInner() {
   return (
     <div className="flex h-screen w-full items-center justify-center">
       <Empty>
@@ -130,11 +126,17 @@ function NotFoundPageInner() {
 
 function ErrorBoundary({ error }: { error: unknown }) {
   const message = error instanceof Error ? error.message : String(error)
+  // 生产环境不向用户外泄内部异常原文（可能含 SQL/路径/URL），仅留日志；
+  // dev 保留原文便于排障。
+  if (import.meta.env.PROD) {
+    console.error('[ErrorBoundary]', message)
+  }
+  const displayMessage = import.meta.env.PROD ? m.common_errorPage_errorGeneric() : message
   return (
     <div className="flex h-screen w-full items-center justify-center">
       <div className="text-center">
         <h1 className="text-4xl font-bold text-destructive">{m.common_errorPage_error()}</h1>
-        <p className="mt-4 text-muted-foreground">{message}</p>
+        <p className="mt-4 text-muted-foreground">{displayMessage}</p>
         <Link to="/" className="mt-6 inline-block text-primary hover:underline">{m.common_errorPage_goHome()}</Link>
       </div>
     </div>

package/src/routes/_login/changelog/confirm/route.tsx

@@ -16,10 +16,11 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
 import { confirmChangelogSubscriptionFn } from '@/server/serverFns/changelog/subscribe'
 
 export const Route = createFileRoute('/_login/changelog/confirm')({
-  validateSearch: (s: { token?: string }) => ({ token: s.token ?? '' }),
+  validateSearch: z.object({ token: z.string().optional() }),
   beforeLoad: async ({ search }) => {
     if (!search.token) return { ok: false }
     const r = await confirmChangelogSubscriptionFn({ data: { token: search.token } })

package/src/routes/_login/email-unsubscribe/route.tsx

@@ -16,10 +16,11 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
 import { unsubscribeByEmailTokenFn } from '@/server/serverFns/email-unsubscribe'
 
 export const Route = createFileRoute('/_login/email-unsubscribe')({
-  validateSearch: (s: { token?: string }) => ({ token: s.token ?? '' }),
+  validateSearch: z.object({ token: z.string().optional() }),
   beforeLoad: async ({ search }) => {
     if (!search.token) return { ok: false }
     const r = await unsubscribeByEmailTokenFn({ data: { token: search.token } })

package/src/routes/_login/forgot-password/route.lazy.tsx

@@ -20,11 +20,12 @@ import { useForm } from '@tanstack/react-form'
 import { toast } from '@/components/ui/toast'
 import { RainbowButton } from '@/components/magicui/rainbow-button'
 import { AppField } from '@/components/forms'
-import { ArrowRight, Mail, Users, BarChart3, MessageSquare, TrendingUp } from 'lucide-react'
+import { ArrowRight, Mail } from 'lucide-react'
 import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
 import { AuthHeader } from '@/components/auth/auth-header'
 import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
 import { IconInput } from '@/components/auth/icon-input'
+import { buildAuthFeatures } from '@/components/auth/auth-features'
 import { forgotPasswordFn } from '@/server/serverFns/auth/forgot-password'
 import { forgotPasswordSchema } from '@/routes/_login/schemas/-auth'
 import { m } from "@/paraglide/messages.js";
@@ -35,16 +36,11 @@ export const Route = createLazyFileRoute('/_login/forgot-password')({
 })
 
 function ForgotPasswordPage() {
-  const loginFeatures = [
-    { icon: Users, label: m.auth_features_userResearch(), desc: m.auth_features_userResearchDesc() },
-    { icon: BarChart3, label: m.auth_features_dataAnalysis(), desc: m.auth_features_dataAnalysisDesc() },
-    { icon: MessageSquare, label: m.auth_features_teamCollaboration(), desc: m.auth_features_teamCollaborationDesc() },
-    { icon: TrendingUp, label: m.auth_features_roadmap(), desc: m.auth_features_roadmapDesc() },
-  ]
+  const loginFeatures = buildAuthFeatures()
 
   const form = useForm({
     defaultValues: { email: '' },
-    validators: [{ run: forgotPasswordSchema as any, triggers: ['change'] }],
+    validators: [{ run: forgotPasswordSchema, triggers: ['change'] }],
     onSubmit: async ({ value }) => {
       try {
         await forgotPasswordFn({ data: value })