@allbluecn/web-app 0.19.2 → 0.19.4

package/src/routes/api/attachments/upload.ts

@@ -40,8 +40,11 @@ export const Route = createFileRoute("/api/attachments/upload")({
             typeof rawDescription === "string" && rawDescription.trim()
               ? rawDescription.trim().slice(0, 500)
               : null;
-          const attachmentId = formData.get("attachmentId") as string | null;
-          const fileHash = formData.get("fileHash") as string | null;
+          // FormData 字段可能是 File：非字符串一律视同缺省（审计 ⚪，防 where:{id} 收到 File）
+          const rawAttachmentId = formData.get("attachmentId");
+          const attachmentId = typeof rawAttachmentId === "string" && rawAttachmentId ? rawAttachmentId : null;
+          const rawFileHash = formData.get("fileHash");
+          const fileHash = typeof rawFileHash === "string" && rawFileHash ? rawFileHash : null;
           if (typeof storyId !== "string" || !storyId) {
             return Response.json({ error: "缺少 storyId" }, { status: 400 });
           }
@@ -52,8 +55,12 @@ export const Route = createFileRoute("/api/attachments/upload")({
             return Response.json({ error: "文件大小需在 10MB 以内" }, { status: 400 });
           }
 
-          const story = await prisma.story.findUnique({
-            where: { id: storyId },
+          // 需求所属项目须有当前用户的有效成员关系（不存在与无权限统一 404，不暴露需求 id 存在性）
+          const story = await prisma.story.findFirst({
+            where: {
+              id: storyId,
+              project: { members: { some: { userId, status: { not: "suspended" } } } },
+            },
             select: { id: true },
           });
           if (!story) {
@@ -61,43 +68,53 @@ export const Route = createFileRoute("/api/attachments/upload")({
           }
 
           const bytes = new Uint8Array(await file.arrayBuffer());
-          let attachment;
-          let activity;
 
-          if (attachmentId) {
-            // 编辑模式：替换现有附件
-            attachment = await prisma.storyAttachment.update({
-              where: { id: attachmentId },
-              data: {
-                fileName: file.name.slice(0, 255),
-                fileSize: BigInt(file.size),
-                mimeType: inferMimeType(file.name, file.type),
-                description,
-                bytes,
-                fileHash: fileHash ?? null,
-              },
-            });
-            activity = await prisma.storyActivity.create({
-              data: {
-                storyId,
-                userId,
-                action: "attachment_updated",
-                newValue: file.name.slice(0, 255),
-              },
-              select: ACTIVITY_SELECT,
-            });
-          } else {
+          // 多段写收敛进事务（审计 🟡）：create attachment → update storageUrl → create
+          // activity 中途失败不再留下 storageUrl:"pending" 的悬空附件或缺失动态
+          const txResult = await prisma.$transaction(async (tx) => {
+            if (attachmentId) {
+              // 编辑模式：替换现有附件——attachmentId 必须属于本需求，否则可凭 id 覆盖任意附件
+              const target = await tx.storyAttachment.findFirst({
+                where: { id: attachmentId, storyId },
+                select: { id: true },
+              });
+              if (!target) {
+                return { kind: "missing" as const };
+              }
+              const attachment = await tx.storyAttachment.update({
+                where: { id: attachmentId },
+                data: {
+                  fileName: file.name.slice(0, 255),
+                  fileSize: BigInt(file.size),
+                  mimeType: inferMimeType(file.name, file.type),
+                  description,
+                  bytes,
+                  fileHash,
+                },
+              });
+              const activity = await tx.storyActivity.create({
+                data: {
+                  storyId,
+                  userId,
+                  action: "attachment_updated",
+                  newValue: file.name.slice(0, 255),
+                },
+                select: ACTIVITY_SELECT,
+              });
+              return { kind: "saved" as const, attachment, activity };
+            }
+
             // 新增模式：先检查同 story 是否已有相同 hash 的附件
             const existing = fileHash
-              ? await prisma.storyAttachment.findFirst({
+              ? await tx.storyAttachment.findFirst({
                   where: { storyId, fileHash },
                   select: { id: true },
                 })
               : null;
             if (existing) {
-              return Response.json({ duplicated: true, existingId: existing.id }, { status: 200 });
+              return { kind: "duplicated" as const, existingId: existing.id };
             }
-            attachment = await prisma.storyAttachment.create({
+            const attachment = await tx.storyAttachment.create({
               data: {
                 storyId,
                 fileName: file.name.slice(0, 255),
@@ -106,15 +123,15 @@ export const Route = createFileRoute("/api/attachments/upload")({
                 description,
                 storageUrl: "pending",
                 bytes,
-                fileHash: fileHash ?? null,
+                fileHash,
               },
             });
             const storageUrl = `/api/attachments/${attachment.id}/content`;
-            await prisma.storyAttachment.update({
+            await tx.storyAttachment.update({
               where: { id: attachment.id },
               data: { storageUrl },
             });
-            activity = await prisma.storyActivity.create({
+            const activity = await tx.storyActivity.create({
               data: {
                 storyId,
                 userId,
@@ -123,8 +140,20 @@ export const Route = createFileRoute("/api/attachments/upload")({
               },
               select: ACTIVITY_SELECT,
             });
+            return { kind: "saved" as const, attachment, activity };
+          });
+
+          if (txResult.kind === "missing") {
+            return Response.json({ error: "附件不存在" }, { status: 404 });
+          }
+          if (txResult.kind === "duplicated") {
+            return Response.json(
+              { duplicated: true, existingId: txResult.existingId },
+              { status: 200 },
+            );
           }
 
+          const { attachment, activity } = txResult;
           const storageUrl = `/api/attachments/${attachment.id}/content`;
 
           return Response.json({
@@ -138,9 +167,14 @@ export const Route = createFileRoute("/api/attachments/upload")({
             activity: toActivityItem(activity),
           });
         } catch (e) {
-          const message = e instanceof Error ? e.message : "上传失败";
-          const status = message === "UNAUTHORIZED" ? 401 : 500;
-          return Response.json({ error: message }, { status });
+          // "UNAUTHORIZED" 是 requireAuth 的控制流哨兵，映射 401；其余错误细节只进
+          // 服务端日志，客户端收通用文案（不回传 Prisma schema 细节）
+          const message = e instanceof Error ? e.message : "";
+          if (message === "UNAUTHORIZED") {
+            return Response.json({ error: "上传失败" }, { status: 401 });
+          }
+          console.error("[attachments/upload] 上传失败:", e instanceof Error ? e.message : e);
+          return Response.json({ error: "上传失败" }, { status: 500 });
         }
       },
     },

package/src/routes/api/auth/desktop-callback.ts

@@ -1,9 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
 import { createFileRoute } from '@tanstack/react-router'
 import { getSession } from 'start-authjs'
 import { prisma } from '@allbluecn/database'
 import { getProService, isProEdition } from '@/server/pro-services'
 import { getAuthConfig } from '@/lib/auth/auth.config'
 import { generateEntitlementsToken } from '@/server/entitlements-token'
+import { checkAuthRateLimit, RateLimitError } from '@/server/middlewares/rate-limit'
 import type { FeatureKey } from '@allbluecn/kernel'
 
 export const Route = createFileRoute('/api/auth/desktop-callback')({
@@ -15,17 +33,19 @@ export const Route = createFileRoute('/api/auth/desktop-callback')({
           return new Response('未登录', { status: 401 })
         }
 
-        const cookieHeader = request.headers.get('cookie') ?? ''
-        const tokenMatch = cookieHeader.match(
-          /(?:next-auth\.session-token|authjs\.session-token|auth\.session-token)=([^;]+)/,
-        )
-        const token = tokenMatch?.[1]
-        if (!token) {
-          return new Response('无法获取 token', { status: 500 })
-        }
-
         const url = new URL(request.url)
         if (url.searchParams.get('exchange') === 'true') {
+          // 权益签发含 workspace 查询 + 签名 token 生成（审计 ⚪）：登录态风险低，
+          // 但仍加 IP 限流防脚本高频刷签发
+          try {
+            await checkAuthRateLimit('desktop-callback-exchange', 30, 60_000)
+          } catch (err) {
+            if (err instanceof RateLimitError) {
+              return Response.json({ error: 'Too many requests' }, { status: 429 })
+            }
+            throw err
+          }
+
           const userId = session.user.id ?? ''
           const username = session.user.name ?? undefined
           const email = session.user.email ?? null
@@ -82,10 +102,26 @@ export const Route = createFileRoute('/api/auth/desktop-callback')({
           }
         }
 
+        // 深链回传 session token（审计 🟡【待决策】：token 经 URL query 进 custom scheme，
+        // 可能落入中间层日志；改一次性 exchange code 需桌面端协同，单侧不动）
+        const cookieHeader = request.headers.get('cookie') ?? ''
+        const tokenMatch = cookieHeader.match(
+          /(?:next-auth\.session-token|authjs\.session-token|auth\.session-token)=([^;]+)/,
+        )
+        const token = tokenMatch?.[1]
+        if (!token) {
+          return new Response('无法获取 token', { status: 500 })
+        }
+
+        // 原样回传桌面端一次性 state（deep_link.rs 比对消费，缺失时桌面端只能降级放行；
+        // 审计 A08 跨仓协议项——OSS 侧先行，Pro web-saas 同名文件需同步）
+        const desktopState = url.searchParams.get('desktop_state')
+        const stateParam = desktopState ? `&desktop_state=${encodeURIComponent(desktopState)}` : ''
+
         return new Response(null, {
           status: 302,
           headers: {
-            Location: `allblue://callback?token=${encodeURIComponent(token)}`,
+            Location: `allblue://callback?token=${encodeURIComponent(token)}${stateParam}`,
             'Content-Type': 'text/html',
           },
         })

package/src/routes/api/billing-webhook.ts

@@ -31,11 +31,15 @@ export const Route = createFileRoute('/api/billing-webhook')({
           return new Response('Missing signature', { status: 400 })
         }
         const rawBody = await request.text()
+        // 服务缺失（OSS 部署）直接 501：原 `?.` 短路 + 200 会让上游把端点当作
+        // 正常消费（审计 🟡），501 明确告知无此能力
+        const billing = getProService('billing')
+        if (!billing) {
+          return new Response('Billing module unavailable', { status: 501 })
+        }
         try {
-          await (getProService('billing'))?.handleWebhookEvent(rawBody, signature)
-          if (getProService('billing')) {
-            await sendBillingEmailForEvent(rawBody)
-          }
+          await billing.handleWebhookEvent(rawBody, signature)
+          await sendBillingEmailForEvent(rawBody)
           return new Response(JSON.stringify({ received: true }), {
             status: 200,
             headers: { 'Content-Type': 'application/json' },

package/src/routes/api/blob/$id.ts

@@ -19,7 +19,7 @@ import { createFileRoute } from "@tanstack/react-router";
 import { prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
 
-// Blob 表无 fileName 字段，用 id 作 fallback；Content-Disposition 用 RFC 5987 编码
+// URL 路径中的文件名不可信，Content-Disposition 用 RFC 5987 filename* 编码
 function contentDisposition(id: string): string {
   const encoded = encodeURIComponent(id);
   return `inline; filename*=UTF-8''${encoded}`;
@@ -50,6 +50,11 @@ export const Route = createFileRoute("/api/blob/$id")({
               "Content-Length": String(body.byteLength),
               "Content-Disposition": contentDisposition(params.id),
               "Cache-Control": "private, max-age=31536000, immutable",
+              // 归属校验严密（self-XSS 面），但仍补 nosniff + CSP sandbox：
+              // text/html|image/svg+xml 类 mimeType 直开时脚本沙箱化于 opaque origin，
+              // 不可触同源凭据；仅 sandbox 不限资源，图片预览新开标签不受影响
+              "X-Content-Type-Options": "nosniff",
+              "Content-Security-Policy": "sandbox",
             },
           });
         } catch (e) {

package/src/routes/api/cron/changelog-release.ts

@@ -82,8 +82,12 @@ export const Route = createFileRoute('/api/cron/changelog-release')({
           })
           if (res.sent) sent++
         }
+        const failed = subs.length - sent
 
-        if (subs.length < BATCH_SIZE) {
+        // 收尾条件须同时满足「最后一批」且「本批零失败」（审计 🟡）：原实现仅看
+        // take 数量，批内个别 sendTemplateEmail 失败的订阅者会被版本标记永久跳过；
+        // 不推进标记时下轮经 notIn 反查自动重试失败者
+        if (subs.length < BATCH_SIZE && failed === 0) {
           await prisma.systemSetting.upsert({
             where: { key: LAST_RELEASED_KEY },
             create: { key: LAST_RELEASED_KEY, value: current, desc: 'changelog 已发布版本号' },
@@ -91,7 +95,7 @@ export const Route = createFileRoute('/api/cron/changelog-release')({
           })
           return Response.json({ done: true, sent })
         }
-        return Response.json({ done: false, sent })
+        return Response.json({ done: false, sent, failed })
       },
     },
   },

package/src/routes/api/cron/subscription-reminders.ts

@@ -81,24 +81,31 @@ export const Route = createFileRoute('/api/cron/subscription-reminders')({
           if (!endDate) continue
           const endDateStr = dateOnly(endDate)
 
+          // 一次执行内每个订阅只发一封（审计 🟡）：取「命中窗口中距到期最近的一档」
+          //（1d 优先于 3d/7d），避免长时间未跑后首次触发同一用户连收多封；
+          // 跨执行的阶梯提醒（7d→3d→1d）仍由 dedupeKey 去重 + 每日 cron 推进
+          let hit: (typeof WINDOWS)[number] | null = null
           for (const w of WINDOWS) {
             const until = new Date(todayStart.getTime() + w.offsetMs)
             if (endDate < todayStart || endDate > until) continue
-            const dedupeKey = `sub-reminder:${sub.id}:${endDateStr}:${w.days}`
-            const res = await sendTemplateEmail({
-              key: 'billing.subscription-ending',
-              to: sub.user.email,
-              locale: sub.user.locale ?? 'zh',
-              userId: sub.userId,
-              dedupeKey,
-              vars: {
-                planName: sub.plan.displayName,
-                endDate: endDateStr,
-                dashboardUrl: `${appUrl}/settings/billing`,
-              },
-            })
-            if (res.sent) processed++
+            if (!hit || w.days < hit.days) hit = w
           }
+          if (!hit) continue
+
+          const dedupeKey = `sub-reminder:${sub.id}:${endDateStr}:${hit.days}`
+          const res = await sendTemplateEmail({
+            key: 'billing.subscription-ending',
+            to: sub.user.email,
+            locale: sub.user.locale ?? 'zh',
+            userId: sub.userId,
+            dedupeKey,
+            vars: {
+              planName: sub.plan.displayName,
+              endDate: endDateStr,
+              dashboardUrl: `${appUrl}/settings/billing`,
+            },
+          })
+          if (res.sent) processed++
         }
 
         return Response.json({ processed })

package/src/routes/api/design/prototype/route.ts

@@ -213,10 +213,12 @@ function runDesignPrototypeStream(
       }
       // 中止即静默收尾（前端保留已生成部分并自行提示）；异常同理不回滚（FS-8.3）
       if (!request.signal.aborted) {
+        // 文案协议化（审计 A5x-5 待决策收口）：服务端不再持有中文——完成态由客户端
+        // 回落 m.canvas_ai_doneFallback()，message 仅在 LLM 自带总结时透传
         yield {
           type: "CUSTOM",
           name: "canvas/done",
-          value: { message: getDoneMessage() ?? "生成完成" },
+          value: { status: "completed", message: getDoneMessage() },
         }
       }
     } catch (err) {
@@ -226,7 +228,7 @@ function runDesignPrototypeStream(
         yield {
           type: "CUSTOM",
           name: "canvas/done",
-          value: { message: `生成中断：${reason}（已保留已生成部分）` },
+          value: { status: "interrupted", reason },
         }
       }
     }
@@ -319,11 +321,12 @@ export const Route = createFileRoute("/api/design/prototype")({
             },
           )
         } catch (err) {
-          // AI 配置缺失/路由失败发生在响应开始前，可安全以 JSON 错误收场
+          // AI 配置缺失/路由失败发生在响应开始前，可安全以 JSON 错误收场；
+          // detail（provider 配置细节）只进服务端日志，不透传客户端（审计 🟡）
           const detail = err instanceof Error ? err.message : String(err)
           console.error(`[design/prototype] AI 入口失败: ${detail}`)
           return new Response(
-            JSON.stringify({ error: "ai_unavailable", detail }),
+            JSON.stringify({ error: "ai_unavailable" }),
             { status: 502, headers: { "Content-Type": "application/json" } },
           )
         }

package/src/routes/api/license/activate/route.ts

@@ -17,11 +17,29 @@
 
 import { createFileRoute } from '@tanstack/react-router'
 import { getProService } from '@/server/pro-services'
+import { checkAuthRateLimit, RateLimitError } from '@/server/middlewares/rate-limit'
+
+// 公开未鉴权端点（桌面端激活）：IP 限流 + 入参长度上限（审计 2026-10-25 🟠，
+// 防 key 爆破 / DB 写放大）。key 为签名的 base64 payload.signature 令牌，字符集
+// 不收紧以免误伤格式演变，长度 + 频率已足够抬高碰撞成本。
+const MAX_KEY_LENGTH = 2048
+const MAX_FINGERPRINT_LENGTH = 512
 
 export const Route = createFileRoute('/api/license/activate')({
   server: {
     handlers: {
       POST: async ({ request }) => {
+        try {
+          await checkAuthRateLimit('license-activate', 10, 60_000)
+        } catch (err) {
+          if (err instanceof RateLimitError) {
+            return Response.json(
+              { success: false, message: 'Too many requests' },
+              { status: 429 },
+            )
+          }
+          throw err
+        }
         const license = getProService('license')
         if (!license) {
           return Response.json(
@@ -36,7 +54,12 @@ export const Route = createFileRoute('/api/license/activate')({
         const key = typeof body?.key === 'string' ? body.key : ''
         const fingerprint =
           typeof body?.fingerprint === 'string' ? body.fingerprint : ''
-        if (!key || !fingerprint) {
+        if (
+          !key ||
+          !fingerprint ||
+          key.length > MAX_KEY_LENGTH ||
+          fingerprint.length > MAX_FINGERPRINT_LENGTH
+        ) {
           return Response.json(
             { success: false, message: '缺少 key 或 fingerprint' },
             { status: 400 },

package/src/routes/api/license/heartbeat/route.ts

@@ -17,11 +17,24 @@
 
 import { createFileRoute } from '@tanstack/react-router'
 import { getProService } from '@/server/pro-services'
+import { checkAuthRateLimit, RateLimitError } from '@/server/middlewares/rate-limit'
+
+// 公开未鉴权端点：IP 限流 + instanceId 长度上限（审计 2026-10-25 🟠，
+// 防随机 instanceId 高频刷写激活记录）
+const MAX_INSTANCE_ID_LENGTH = 128
 
 export const Route = createFileRoute('/api/license/heartbeat')({
   server: {
     handlers: {
       POST: async ({ request }) => {
+        try {
+          await checkAuthRateLimit('license-heartbeat', 30, 60_000)
+        } catch (err) {
+          if (err instanceof RateLimitError) {
+            return Response.json({ ok: false, message: 'Too many requests' }, { status: 429 })
+          }
+          throw err
+        }
         const license = getProService('license')
         if (!license) {
           return Response.json(
@@ -34,7 +47,7 @@ export const Route = createFileRoute('/api/license/heartbeat')({
         } | null
         const instanceId =
           typeof body?.instanceId === 'string' ? body.instanceId : ''
-        if (!instanceId) {
+        if (!instanceId || instanceId.length > MAX_INSTANCE_ID_LENGTH) {
           return Response.json(
             { ok: false, message: '缺少 instanceId' },
             { status: 400 },

package/src/routes/api/notifications/stream.ts

@@ -22,13 +22,14 @@ import { prisma } from '@allbluecn/database'
 import { getCurrentSession } from '@/lib/session'
 import { notificationBus } from '@/server/notifications/event-bus'
 import { deliverDueDigests } from '@/server/notifications/notification-service'
+import { customChunk } from '@/server/lib/sse-chunk'
 import type { NotificationSseValue } from '@allbluecn/kernel'
 
 export const Route = createFileRoute('/api/notifications/stream')({
   server: {
     handlers: {
       GET: async ({ request }) => {
-        let session = null as any
+        let session: Awaited<ReturnType<typeof getCurrentSession>> | null = null
         try {
           session = await getCurrentSession(request)
         } catch {
@@ -55,30 +56,36 @@ export const Route = createFileRoute('/api/notifications/stream')({
             const count = await prisma.notification.count({
               where: { userId, readAt: null },
             })
-            yield {
-              type: 'CUSTOM',
-              name: 'notifications',
-              value: { kind: 'unread_snapshot', count },
-            } as unknown as StreamChunk
+            yield customChunk('notifications', { kind: 'unread_snapshot', count })
 
-            // 连接建立时检查到期 digest 摘要（fire-and-forget，摘要经 bus 实时推送）
-            void deliverDueDigests(userId)
+            // 连接建立时检查到期 digest 摘要（fire-and-forget，摘要经 bus 实时推送）；
+            // reject 须兜底 catch，否则成为 unhandled rejection（审计 🟡）
+            void deliverDueDigests(userId).catch((e: unknown) => {
+              console.error(
+                '[notifications] digest 发送失败:',
+                e instanceof Error ? e.message : 'unknown',
+              )
+            })
 
             while (!abortController.signal.aborted) {
               if (queue.length === 0) {
+                // 挂起窗：事件到达即 clear 计时器（审计 🟡：原实现每个空转-唤醒循环
+                // 泄漏一个最长 25s 的悬挂定时器）
                 await new Promise<void>((resolve) => {
-                  notify = resolve
-                  setTimeout(resolve, 25000)
+                  const timer = setTimeout(() => {
+                    notify = null
+                    resolve()
+                  }, 25000)
+                  notify = () => {
+                    clearTimeout(timer)
+                    resolve()
+                  }
                 })
                 notify = null
                 continue
               }
               const value = queue.shift()!
-              yield {
-                type: 'CUSTOM',
-                name: 'notifications',
-                value,
-              } as unknown as StreamChunk
+              yield customChunk('notifications', value)
             }
           } finally {
             unsubscribe()

package/src/routes/api/share/design/$designId/events.ts

@@ -17,11 +17,24 @@
 
 import { createFileRoute } from '@tanstack/react-router'
 import { addClient, removeClient } from '@/lib/share-events'
+import { getCurrentSession } from '@/lib/session'
+import { canViewSharedDesign, isDesignOwner } from '@/server/design/access'
 
 export const Route = createFileRoute('/api/share/design/$designId/events')({
   server: {
     handlers: {
       GET: async ({ request, params }) => {
+        // 审计 2026-10-25：零鉴权 SSE——匿名可收听任意设计的分享钥匙广播并占满连接槽。
+        // 口径与评论读一致：属主 或 通过密码门禁的分享访客；其余 404（不泄露存在性）。
+        const session = await getCurrentSession(request)
+        const userId = session?.user?.id ?? null
+        const allowed =
+          (userId ? await isDesignOwner(params.designId, userId) : false) ||
+          (await canViewSharedDesign(params.designId))
+        if (!allowed) {
+          return new Response('Not found', { status: 404 })
+        }
+
         const encoder = new TextEncoder()
         let controller: ReadableStreamDefaultController
 

package/src/routes/api/story-ai.ts

@@ -17,12 +17,23 @@
 
 import { createFileRoute } from "@tanstack/react-router"
 import { toServerSentEventsResponse } from "@tanstack/ai"
+import { getCurrentSession } from "@/lib/session"
 import { handleStoryAiRequest } from "@/server/ai-gateway"
 
 export const Route = createFileRoute("/api/story-ai")({
   server: {
     handlers: {
       POST: async ({ request }) => {
+        // 前置鉴权（口径同 /api/chat）：401 早退，不在 SSE 响应头已发出后才在
+        // 生成器内爆发（客户端将收到断流而非 401）；生成器内的校验保留兜底
+        const session = await getCurrentSession(request)
+        if (!session?.user?.id) {
+          return new Response(JSON.stringify({ error: "unauthorized" }), {
+            status: 401,
+            headers: { "Content-Type": "application/json" },
+          })
+        }
+
         const abortController = new AbortController()
         request.signal.addEventListener("abort", () => abortController.abort())
         const stream = handleStoryAiRequest(request)

package/src/routes/api/test-runs/$runId/events.ts

@@ -33,6 +33,7 @@ import type { StreamChunk } from "@tanstack/ai";
 import { prisma } from "@allbluecn/database";
 import { getCurrentSession } from "@/lib/session";
 import { runStepEventBus } from "@/server/testcase/step-events";
+import { customChunk } from "@/server/lib/sse-chunk";
 import { TEST_RUN_STEP_SSE_EVENT } from "@/server/serverFns/testcase/constants";
 import type { TestRunStepEvent } from "@/server/serverFns/testcase/types";
 
@@ -92,19 +93,22 @@ export const Route = createFileRoute("/api/test-runs/$runId/events")({
           try {
             while (!abortController.signal.aborted) {
               if (queue.length === 0) {
+                // 挂起窗：事件到达即 clear 计时器（同 notifications/stream，防悬挂定时器累积）
                 await new Promise<void>((resolve) => {
-                  notify = resolve;
-                  setTimeout(resolve, STEP_STREAM_IDLE_WAIT_MS);
+                  const timer = setTimeout(() => {
+                    notify = null;
+                    resolve();
+                  }, STEP_STREAM_IDLE_WAIT_MS);
+                  notify = () => {
+                    clearTimeout(timer);
+                    resolve();
+                  };
                 });
                 notify = null;
                 continue;
               }
               const value = queue.shift()!;
-              yield {
-                type: "CUSTOM",
-                name: TEST_RUN_STEP_SSE_EVENT,
-                value,
-              } as unknown as StreamChunk;
+              yield customChunk(TEST_RUN_STEP_SSE_EVENT, value);
             }
           } finally {
             unsubscribe();