@allbluecn/web-app 0.19.2 → 0.19.4

package/src/routes/_nav/settings/team/route.lazy.tsx

@@ -17,6 +17,7 @@
 
 import { createLazyFileRoute } from '@tanstack/react-router'
 import TeamClient from '@/components/settings/personal-team/team/team-client'
+import { m } from '@/paraglide/messages.js'
 
 export const Route = createLazyFileRoute('/_nav/settings/team')({
   pendingComponent: () => (
@@ -28,9 +29,17 @@ export const Route = createLazyFileRoute('/_nav/settings/team')({
 })
 
 function TeamPage() {
-  const ctx = Route.useRouteContext() as any
+  // context 类型由 route.tsx beforeLoad 返回值推断（error: 'error' | undefined），
+  // 无需 as any；unauthorized 已在 beforeLoad redirect，不再静默空白
+  const ctx = Route.useRouteContext()
 
-  if (ctx.error === 'unauthorized' || ctx.error === 'error') return null
+  if (ctx.error === 'error') {
+    return (
+      <div className="flex h-64 items-center justify-center text-sm text-muted-foreground">
+        {m.common_loadFailed()}
+      </div>
+    )
+  }
 
   return <TeamClient user={ctx.user} />
 }

package/src/routes/_nav/settings/team/route.tsx

@@ -15,19 +15,25 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute, redirect } from '@tanstack/react-router'
 import { getAccountTeamFn } from '@/server/serverFns/settings/account-team'
 
 export const Route = createFileRoute('/_nav/settings/team')({
   beforeLoad: async () => {
+    let result: Awaited<ReturnType<typeof getAccountTeamFn>>
     try {
-      const result = await getAccountTeamFn()
-      if (result.error === 'unauthorized') return { error: 'unauthorized' as const }
-      return {
-        user: result.user,
-      }
-    } catch {
+      result = await getAccountTeamFn()
+    } catch (e) {
+      console.error('[settings/team] getAccountTeamFn failed:', e instanceof Error ? e.message : String(e))
       return { error: 'error' as const }
     }
+    // 未登录走框架跳转（beforeLoad + redirect），不再下发错误状态由组件二次判断
+    if (result.error === 'unauthorized') {
+      throw redirect({ to: '/login' })
+    }
+    return {
+      error: undefined,
+      user: result.user,
+    }
   },
 })

package/src/routes/_nav/stories/$storyId/route.lazy.tsx

@@ -18,6 +18,7 @@
 import { createLazyFileRoute, useNavigate, useRouter } from "@tanstack/react-router";
 import { useCallback, useState, type UIEvent } from "react";
 import type { StoryDetail, UserBrief, CommentWithReplies, ActivityItem, RelationsData } from "@/components/story/types";
+import type { IterationSummary } from "@/server/serverFns/iteration/schemas";
 import type { StoryState } from "@/components/story/constants";
 import { StoryDetailBody } from "@/components/story/detail/story-detail-body";
 import { StoryPanelHeader } from "@/components/story/story-panel-header";
@@ -77,7 +78,7 @@ function StoryDetailContent({
   labels: { id: string; name: string; color: string }[];
   stories: { id: string; identifier: string; name: string; state: StoryState }[];
   relationsData: RelationsData;
-  iterations: import("@/server/serverFns/iteration/schemas").IterationSummary[];
+  iterations: IterationSummary[];
 }) {
   const navigate = useNavigate({ from: "/stories/$storyId" });
   const router = useRouter();

package/src/routes/_nav/stories/$storyId/route.tsx

@@ -38,6 +38,10 @@ import { isCollabEnabled } from "@/lib/collab/env";
 import type { RelationsData } from "@/components/story/types";
 import { StoryDetailSkeleton } from "../-components/story-detail-skeleton";
 
+// 「关联需求」选择源拉取上限：超过该数的需求会被静默截断（组件端无搜索补拉），
+// 后续可改按需搜索（审计 ⚪ 常量化并留痕）
+const RELATED_STORIES_TAKE = 200;
+
 export const Route = createFileRoute("/_nav/stories/$storyId")({
   loader: async ({ params }) => {
     // 协同快照并行取（规格 §6 SSR 初始快照链路，任务 20 Story 行）：未开协同
@@ -71,7 +75,7 @@ export const Route = createFileRoute("/_nav/stories/$storyId")({
       getStoryNeighborsFn({ data: { storyId: params.storyId } }),
       listProjectsBriefFn(),
       listLabelsFn(),
-      listStoriesFn({ data: { archived: false, take: 200 } }),
+      listStoriesFn({ data: { archived: false, take: RELATED_STORIES_TAKE } }),
       listChildStoriesFn({ data: { parentId: params.storyId } }),
       getDependenciesFn({ data: { storyId: params.storyId } }),
       getLinksFn({ data: { storyId: params.storyId } }),

package/src/routes/_nav/tasks/-components/ai-task-detail.tsx

@@ -37,6 +37,7 @@ import {
 import { ConfirmDialog } from "@/components/confirm-dialog";
 import { MarkdownContent } from "@/components/harness/ai-message/components/markdown-content";
 import { AiTaskStatusBadge } from "./ai-task-status-badge";
+import { TASK_SOURCE_HREF } from "./task-constants";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { formatTimestamp } from "@/lib/datetime";
@@ -76,13 +77,6 @@ export interface AiTaskDetailRun {
   durationMs: number | null;
 }
 
-/** sourceType → 源路由（与 assigned-query.ts 的 href 拼接口径一致） */
-const SOURCE_HREF: Record<string, (id: string) => string> = {
-  story: (id) => `/stories/${id}`,
-  bug: (id) => `/bugs/${id}`,
-  testcase: (id) => `/test-cases/${id}`,
-};
-
 /** trigger → 徽章文案 */
 const TRIGGER_LABEL: Record<string, () => string> = {
   manual: m.tasks_trigger_manual,
@@ -140,7 +134,7 @@ export function AiTaskDetail({
   const running = task.status === "running";
   const sourceHref =
     task.sourceType && task.sourceId
-      ? SOURCE_HREF[task.sourceType]?.(task.sourceId)
+      ? TASK_SOURCE_HREF[task.sourceType]?.(task.sourceId)
       : undefined;
 
   return (

package/src/routes/_nav/tasks/-components/ai-task-list.tsx

@@ -27,6 +27,7 @@ import { useMutation } from "@tanstack/react-query";
 import { Loader2, Play, Plus, Trash2 } from "lucide-react";
 import { ConfirmDialog } from "@/components/confirm-dialog";
 import { AiTaskStatusBadge } from "./ai-task-status-badge";
+import { TASK_SOURCE_LABEL } from "./task-constants";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { formatTimestamp } from "@/lib/datetime";
@@ -51,13 +52,6 @@ export interface AiTaskListItem {
   updatedAt: string;
 }
 
-/** sourceType → 徽章文案（与分配列表组标题共用 key） */
-const SOURCE_LABEL: Record<string, () => string> = {
-  story: m.tasks_group_story,
-  bug: m.tasks_group_bug,
-  testcase: m.tasks_group_testcase,
-};
-
 /** 详情路由拼接（返回类型标注 string 拓宽模板字面量，同 ai-task-detail.tsx SOURCE_HREF 先例） */
 const taskDetailHref = (id: string): string => `/tasks/${id}`;
 
@@ -135,8 +129,8 @@ export function AiTaskList({
                     {item.title}
                   </Link>
                   <AiTaskStatusBadge status={item.status} />
-                  {item.sourceType && SOURCE_LABEL[item.sourceType] ? (
-                    <Badge variant="outline">{SOURCE_LABEL[item.sourceType]()}</Badge>
+                  {item.sourceType && TASK_SOURCE_LABEL[item.sourceType] ? (
+                    <Badge variant="outline">{TASK_SOURCE_LABEL[item.sourceType]()}</Badge>
                   ) : null}
                 </div>
                 <div className="flex items-center gap-2 text-xs text-muted-foreground">

package/src/routes/_nav/tasks/-components/source-ai-exec-dialog.tsx

@@ -44,13 +44,7 @@ import { toastError } from "@/lib/toast-error";
 import { m } from "@/paraglide/messages.js";
 import type { TaskSource } from "@/server/ai-task/types";
 import { createAiTaskFn } from "@/server/serverFns/tasks/task-crud";
-
-/** sourceType → 徽章文案（与分配列表组标题共用 key） */
-const SOURCE_LABEL: Record<TaskSource, () => string> = {
-  story: m.tasks_group_story,
-  bug: m.tasks_group_bug,
-  testcase: m.tasks_group_testcase,
-};
+import { TASK_SOURCE_LABEL } from "./task-constants";
 
 export function SourceAiExecDialog({
   sourceType,
@@ -123,7 +117,7 @@ export function SourceAiExecDialog({
           <div className="grid gap-4">
             <div className="flex items-center gap-2 rounded-lg border bg-muted/50 px-3 py-2">
               <Badge variant="outline" className="shrink-0">
-                {SOURCE_LABEL[sourceType]()}
+                {TASK_SOURCE_LABEL[sourceType]()}
               </Badge>
               <span className="truncate text-sm font-medium">{sourceTitle}</span>
             </div>

package/src/routes/_nav/tasks/-components/task-constants.ts

@@ -113,3 +113,18 @@ export const TASK_PRIORITY_META: Record<TaskPriority, LevelBadgeMeta> = {
     color: "bg-muted text-muted-foreground",
   },
 };
+
+/** sourceType → 徽章文案（审计 2026-10-25 🔵：原 ai-task-list / source-ai-exec-dialog
+ *  各持一份逐字副本；与分配列表组标题共用 tasks_group_* key，新增 source 单点维护） */
+export const TASK_SOURCE_LABEL: Record<string, () => string> = {
+  story: m.tasks_group_story,
+  bug: m.tasks_group_bug,
+  testcase: m.tasks_group_testcase,
+};
+
+/** sourceType → 源路由（ai-task-detail 消费，与 assigned-query.ts 的 href 拼接口径一致） */
+export const TASK_SOURCE_HREF: Record<string, (id: string) => string> = {
+  story: (id) => `/stories/${id}`,
+  bug: (id) => `/bugs/${id}`,
+  testcase: (id) => `/test-cases/${id}`,
+};

package/src/routes/_nav/test-cases/runs/$runId/route.lazy.tsx

@@ -1,4 +1,3 @@
-import { createLazyFileRoute } from '@tanstack/react-router'
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // AllBlue - 理想之海
 // Copyright (C) 2026 AllBlue Contributors
@@ -16,6 +15,8 @@ import { createLazyFileRoute } from '@tanstack/react-router'
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { createLazyFileRoute } from '@tanstack/react-router'
+
 // 执行批次详情页（lazy：客户端壳 + 页面组合）。左侧执行矩阵行（状态徽章，点击选中
 // 切换 checklist），右侧当前用例执行清单（快照渲染 + 键盘流 + 五态判定）。执行负载
 // stepResults 经 getRunCaseFn 按选中用例拉取（useServerFn 直调 + 本地状态，无 react-query）；

package/src/routes/_nav/workspaces/$workspaceId/activities/route.lazy.tsx

@@ -21,28 +21,14 @@ import { Button } from "@/components/ui/button";
 import { ProjectActivityList } from "@/components/project/project-activity-list";
 import { m } from "@/paraglide/messages.js";
 
-type LoaderData = {
-  activities: {
-    id: string;
-    projectId: string;
-    userId: string;
-    action: string;
-    targetType: string | null;
-    targetId: string | null;
-    metadata: unknown;
-    createdAt: Date;
-    user?: { id: string; username: string; email: string; avatarConfig?: unknown; bgShape?: string | null; bgColor?: string | null };
-    project?: { id: string; name: string };
-  }[];
-};
-
 function WorkspaceActivitiesPage() {
-  const { activities } = Route.useLoaderData() as LoaderData;
+  const { activities } = Route.useLoaderData();
+  const { workspaceId } = Route.useParams();
 
   return (
     <div className="mx-auto max-w-2xl px-6 py-6">
       <div className="mb-4">
-        <Button render={<Link to="/workspaces/$workspaceId" params={{ workspaceId: activities[0]?.projectId ? "" : "" }} />} nativeButton={false} variant="ghost" size="sm">
+        <Button render={<Link to="/workspaces/$workspaceId" params={{ workspaceId }} />} nativeButton={false} variant="ghost" size="sm">
           <ArrowLeft className="size-4" />
           {m.workspace_detail_back()}
         </Button>

package/src/routes/_nav/workspaces/$workspaceId/route.lazy.tsx

@@ -19,6 +19,7 @@ import { createLazyFileRoute, useRouter } from "@tanstack/react-router";
 import { useEffect, useState } from "react";
 import { useTheme } from "next-themes";
 import { GlyphMatrix } from "@/components/magicui/glyph-matrix";
+import { Skeleton } from "@/components/ui/skeleton";
 import { CreateProjectDialog } from "@/components/project/create-project-dialog";
 import { EditWorkspaceDialog } from "@/components/workspace/dialogs/edit-workspace-dialog";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
@@ -34,53 +35,12 @@ import { WorkspaceContributionCard } from "@/components/workspace/contribution/w
 import { WorkspaceProjectList } from "@/components/workspace/projects/workspace-project-list";
 import { WorkspaceActivityCard } from "@/components/workspace/activity/workspace-activity-card";
 import { WorkspaceMembersManager } from "@/components/workspace/members/workspace-members-manager";
-import type { WorkspaceKbCardData } from "@/server/serverFns/workspace-kb-utils";
 import { m } from "@/paraglide/messages.js";
 import { emitEvent, AppEvents } from "@/lib/events";
-
-type DetailData = {
-  workspace: {
-    id: string;
-    name: string;
-    description: string | null;
-    icon: string;
-    ownerId: string;
-    _count: { projects: number };
-  };
-  projects: {
-    id: string;
-    name: string;
-    description: string | null;
-    icon: string;
-    updatedAt: Date;
-    _count: { members: number };
-  }[];
-  activities: {
-    id: string;
-    projectId: string;
-    userId: string;
-    action: string;
-    targetType: string | null;
-    targetId: string | null;
-    metadata: unknown;
-    createdAt: Date;
-    user?: { id: string; username: string; email: string; avatarConfig?: unknown; bgShape?: string | null; bgColor?: string | null };
-    project?: { id: string; name: string };
-  }[];
-  contributionData: { date: string; count: number; level: number }[];
-  members: {
-    id: string;
-    userId: string;
-    role: string;
-    status: string;
-    joinedAt: Date;
-    user?: { id: string; username: string; email: string; avatarConfig?: unknown; bgShape?: string | null; bgColor?: string | null };
-  }[];
-  kbCard: WorkspaceKbCardData;
-};
+import { toastError } from "@/lib/toast-error";
 
 function WorkspaceDetailPage() {
-  const { workspace, projects, activities, contributionData, members, kbCard } = Route.useLoaderData() as DetailData;
+  const { workspace, projects, activities, contributionData, members, kbCard } = Route.useLoaderData();
   const [editOpen, setEditOpen] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
   const [projectEditOpen, setProjectEditOpen] = useState(false);
@@ -135,9 +95,11 @@ function WorkspaceDetailPage() {
     try {
       await deleteProjectFn({ data: { projectId: selectedProject.id } });
       emitEvent(AppEvents.project.deleted);
-    } finally {
+      // 成功才关弹窗清选中：失败保持弹窗打开，由 NameConfirmDialog 行内错误或 toast 反馈
       setProjectDeleteOpen(false);
       setSelectedProject(null);
+    } catch (err) {
+      toastError(err, m.projects_settings_deleteFailed());
     }
   };
 
@@ -235,5 +197,16 @@ function WorkspaceDetailPage() {
 }
 
 export const Route = createLazyFileRoute("/_nav/workspaces/$workspaceId")({
+  pendingComponent: () => (
+    <div className="relative h-full overflow-y-auto overflow-x-hidden">
+      <div className="relative z-10 mx-auto max-w-2xl space-y-6 px-6 py-6">
+        <Skeleton className="h-24 w-full" />
+        <div className="grid gap-6 lg:grid-cols-3">
+          <Skeleton className="h-64 lg:col-span-2" />
+          <Skeleton className="h-40" />
+        </div>
+      </div>
+    </div>
+  ),
   component: WorkspaceDetailPage,
 });

package/src/routes/_nav/workspaces/$workspaceId/route.tsx

@@ -37,5 +37,4 @@ export const Route = createFileRoute("/_nav/workspaces/$workspaceId")({
     ]);
     return { workspace, projects, activities, contributionData, members, kbCard };
   },
-  pendingComponent: () => null,
 });

package/src/routes/_nav/workspaces/$workspaceId/settings/route.lazy.tsx

@@ -42,8 +42,7 @@ function WorkspaceSettingsPage() {
   const { workspace } = Route.useLoaderData();
   const session = Route.useRouteContext({ select: (c) => c.session });
   const currentUserId = session?.user?.id;
-  const canEdit = workspace.ownerId === currentUserId;
-  const canDelete = workspace.ownerId === currentUserId;
+  const isOwner = workspace.ownerId === currentUserId;
 
   const [icon, setIcon] = useState(workspace.icon);
   const [name, setName] = useState(workspace.name);
@@ -111,18 +110,11 @@ function WorkspaceSettingsPage() {
         ...(deleteMode === "transfer" && targetWorkspaceId ? { targetWorkspaceId } : {}),
       },
     });
-    if ((result as { needsChoice?: boolean }).needsChoice) return;
+    if ("needsChoice" in result && result.needsChoice) return;
     toast.success(m.workspace_settings_workspaceDeleted());
     await router.navigate({ to: "/workspaces" });
   };
 
-  const ROLE_BADGE: Record<string, { label: string; variant: "default" | "secondary" | "outline" }> = {
-    owner: { label: m.workspace_settings_roles_owner(), variant: "default" },
-    admin: { label: m.workspace_settings_roles_admin(), variant: "secondary" },
-    member: { label: m.workspace_settings_roles_member(), variant: "outline" },
-    viewer: { label: m.workspace_settings_roles_viewer(), variant: "outline" },
-  };
-
   return (
     <div className="h-full overflow-y-auto">
       <div className="mx-auto max-w-3xl px-6 py-6">
@@ -135,7 +127,7 @@ function WorkspaceSettingsPage() {
 
         <h1 className="mb-6 text-2xl font-semibold">{m.workspace_settings_title()}</h1>
 
-        {canEdit && (
+        {isOwner && (
           <Card className="mb-6">
             <CardHeader>
               <CardTitle>{m.workspace_settings_basicInfo()}</CardTitle>
@@ -174,9 +166,7 @@ function WorkspaceSettingsPage() {
           </Card>
         )}
 
-        
-
-        {canDelete && (
+        {isOwner && (
           <Card className="border-destructive/40">
             <CardHeader>
               <CardTitle className="text-destructive">{m.workspace_settings_dangerZone()}</CardTitle>
@@ -205,9 +195,9 @@ function WorkspaceSettingsPage() {
                       variant="outline"
                       className="text-destructive border-destructive/40"
                       onClick={() => {
-                      setDeleteMode("transfer");
-                      setStoryMode("transfer");
-                      setDeleteOpen(true);
+                        setDeleteMode("transfer");
+                        setStoryMode("transfer");
+                        setDeleteOpen(true);
                       }}
                     >
                       {m.workspace_settings_deleteTransfer()}

package/src/routes/_nav/workspaces/index.lazy.tsx

@@ -37,14 +37,13 @@ import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-
 import { toggleWorkspacePinFn, deleteWorkspaceFn } from "@/server/serverFns/workspace";
 import { toast } from "@/components/ui/toast";
 import { m } from "@/paraglide/messages.js";
+import { getLocale } from "@/paraglide/runtime.js";
 import workspaceEmptyIllustration from "@/assets/illustrations/empty-states/workspace-empty.svg?url";
 import { toastError } from "@/lib/toast-error";
 import { onEvent, emitEvent, AppEvents } from "@/lib/events";
 
-type WorkspaceList = ReturnType<typeof import("@/server/serverFns/workspace")["listWorkspacesFn"]> extends Promise<infer T> ? T : never;
-
 function WorkspacesIndexPage() {
-  const workspaces = Route.useLoaderData() as WorkspaceList;
+  const workspaces = Route.useLoaderData();
   const [createOpen, setCreateOpen] = useState(false);
   const [editOpen, setEditOpen] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
@@ -69,8 +68,10 @@ function WorkspacesIndexPage() {
     try {
       await toggleWorkspacePinFn({ data: { workspaceId, pinned } });
       emitEvent(AppEvents.workspace.pinned, { workspaceId, pinned });
-    } catch {
+    } catch (err) {
+      // 失败回滚本地态并给出反馈（原静默回滚用户只看到「点了没反应」）
       setPinState((prev) => ({ ...prev, [workspaceId]: !pinned }));
+      toastError(err, m.workspace_card_pinFailed());
     }
   };
 
@@ -95,9 +96,9 @@ function WorkspacesIndexPage() {
         },
       });
       setDeleteOpen(false);
-      if ((result as { needsChoice?: boolean }).needsChoice) {
+      if ("needsChoice" in result && result.needsChoice) {
         toast.info(m.workspace_list_deleteHasProjects());
-        router.navigate({
+        await router.navigate({
           to: "/workspaces/$workspaceId/settings",
           params: { workspaceId: selectedWorkspace.id },
         });
@@ -118,14 +119,14 @@ function WorkspacesIndexPage() {
         <GlyphMatrix className="absolute inset-0 h-full w-full" color={glyphColor} fadeBottom={0.9} glyphs="01·•+*/\\<>=" />
       </div>
       <div className="relative z-10 mx-auto max-w-6xl px-6 py-6">
-          <div className="relative mb-10 mt-2 flex flex-col items-center py-10 text-center">
-            <div className="flex size-14 items-center justify-center rounded-xl bg-primary/10 mb-4">
-              <LucideIconByName name="folder-kanban" size={28} className="text-primary" />
-            </div>
-            <h1 className="text-2xl font-semibold">{m.workspace_list_title()}</h1>
-            <p className="mt-2 max-w-2xl text-sm text-muted-foreground">
-              {m.workspace_list_subtitle()}
-            </p>
+        <div className="relative mb-10 mt-2 flex flex-col items-center py-10 text-center">
+          <div className="flex size-14 items-center justify-center rounded-xl bg-primary/10 mb-4">
+            <LucideIconByName name="folder-kanban" size={28} className="text-primary" />
+          </div>
+          <h1 className="text-2xl font-semibold">{m.workspace_list_title()}</h1>
+          <p className="mt-2 max-w-2xl text-sm text-muted-foreground">
+            {m.workspace_list_subtitle()}
+          </p>
           <Button onClick={() => setCreateOpen(true)} className="mt-6">
             <Plus className="size-4" />
             {m.workspace_list_create()}
@@ -175,7 +176,7 @@ function WorkspacesIndexPage() {
                     </span>
                     <span className="flex items-center gap-1">
                       <Calendar className="size-3.5" />
-                      {new Intl.DateTimeFormat("zh-CN", { month: "short", day: "numeric" }).format(new Date(workspace.updatedAt))}
+                      {new Intl.DateTimeFormat(getLocale(), { month: "short", day: "numeric" }).format(new Date(workspace.updatedAt))}
                     </span>
                   </div>
                   <DropdownMenu>
@@ -192,7 +193,6 @@ function WorkspacesIndexPage() {
                         <Pencil className="mr-2 size-4" />
                         {m.workspace_card_edit()}
                       </DropdownMenuItem>
-                      
                       <DropdownMenuItem
                         onClick={(e) => {
                           e.stopPropagation();

package/src/routes/_public/pricing/route.tsx

@@ -22,9 +22,11 @@ export const Route = createFileRoute('/_public/pricing')({
   loader: async () => {
     try {
       const plans = await listPublicPlansFn({ data: { currency: 'usd' } })
-      return { plans, currency: 'usd' as const }
-    } catch {
-      return { plans: [], currency: 'usd' as const }
+      return { plans, currency: 'usd' as 'usd' | 'cny' }
+    } catch (err) {
+      // 公开页降级（OSS 无 billing）属刻意设计，但需留日志以便线上排障
+      console.error('[pricing] 套餐加载失败:', err instanceof Error ? err.message : err)
+      return { plans: [], currency: 'usd' as 'usd' | 'cny' }
     }
   },
 })

package/src/routes/api/attachments/$id/content.ts

@@ -17,12 +17,39 @@
 
 import { createFileRoute } from "@tanstack/react-router";
 import { prisma } from "@allbluecn/database";
-import { requireAuth } from "@/server/auth-helpers";
+import { requireAuth, UnauthorizedError } from "@/server/auth-helpers";
+
+// 库内 mimeType 来自上传侧客户端声明（无白名单），不能直接作为同源 inline 响应的
+// Content-Type：声明为 text/html / image/svg+xml 的附件会在登录态同源下执行脚本
+// （存储型 XSS，审计 2026-10-25 🔴）。只有不可能承载活动内容的类型允许 inline，
+// 其余一律 application/octet-stream + attachment 强制下载；全部响应带 nosniff 与
+// 最小 CSP 兜底。
+const INLINE_SAFE_MIME_TYPES = new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "image/bmp",
+  "application/pdf",
+  "video/mp4",
+  "video/webm",
+  "audio/mpeg",
+  "audio/wav",
+  "audio/ogg",
+  "text/plain",
+  "text/csv",
+]);
+
+function normalizeMimeType(raw: string | null | undefined): string {
+  const base = (raw ?? "").split(";")[0].trim().toLowerCase();
+  return base || "application/octet-stream";
+}
 
 // URL 路径中的文件名不可信，Content-Disposition 用 RFC 5987 filename* 编码
-function contentDisposition(fileName: string): string {
+function contentDisposition(kind: "inline" | "attachment", fileName: string): string {
   const encoded = encodeURIComponent(fileName);
-  return `inline; filename*=UTF-8''${encoded}`;
+  return `${kind}; filename*=UTF-8''${encoded}`;
 }
 
 export const Route = createFileRoute("/api/attachments/$id/content")({
@@ -30,29 +57,46 @@ export const Route = createFileRoute("/api/attachments/$id/content")({
     handlers: {
       GET: async ({ request, params }) => {
         try {
-          await requireAuth(request);
+          const session = await requireAuth(request);
+          const userId = session.user!.id!;
 
-          const attachment = await prisma.storyAttachment.findUnique({
-            where: { id: params.id },
+          // 属主校验与读取合并为单查询：附件 → 需求 → 项目须有当前用户的有效成员关系，
+          // 否则一律 404（不区分不存在/无权限，避免探测附件 id 是否存在）
+          const attachment = await prisma.storyAttachment.findFirst({
+            where: {
+              id: params.id,
+              story: {
+                project: { members: { some: { userId, status: { not: "suspended" } } } },
+              },
+            },
             select: { fileName: true, mimeType: true, bytes: true },
           });
           if (!attachment || !attachment.bytes) {
             return new Response("Not found", { status: 404 });
           }
 
+          const mimeType = normalizeMimeType(attachment.mimeType);
+          const inlineSafe = INLINE_SAFE_MIME_TYPES.has(mimeType);
           const body = new Uint8Array(attachment.bytes);
           return new Response(body, {
             headers: {
-              "Content-Type": attachment.mimeType || "application/octet-stream",
+              "Content-Type": inlineSafe ? mimeType : "application/octet-stream",
               "Content-Length": String(body.byteLength),
-              "Content-Disposition": contentDisposition(attachment.fileName),
+              "Content-Disposition": contentDisposition(
+                inlineSafe ? "inline" : "attachment",
+                attachment.fileName,
+              ),
+              "X-Content-Type-Options": "nosniff",
+              "Content-Security-Policy": "default-src 'none'",
               "Cache-Control": "private, max-age=31536000, immutable",
             },
           });
         } catch (e) {
-          const message = e instanceof Error ? e.message : "读取失败";
-          const status = message === "UNAUTHORIZED" ? 401 : 500;
-          return new Response(message, { status });
+          if (e instanceof UnauthorizedError || (e instanceof Error && e.message === "UNAUTHORIZED")) {
+            return new Response("Unauthorized", { status: 401 });
+          }
+          console.error("[attachments/content] 读取附件失败", e);
+          return new Response("Internal Server Error", { status: 500 });
         }
       },
     },