@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/ai-task/executor.ts

@@ -8,8 +8,10 @@
 import { prisma } from '@allbluecn/database'
 import { runChat } from '@/server/ai-gateway/adapter'
 import { createNotification } from '@/server/notifications/notification-service'
+import { truncateWithMarker } from '@/server/lib/text-truncate'
 import { buildSourceContextBlock } from './context-builder'
 import type { TaskSource } from './types'
+import { isProjectMember } from '@/server/lib/project-membership'
 
 /** 无人值守执行的工具白名单（规格 §5.3）：恰三个只读工具 */
 export const AI_TASK_ALLOWED_TOOLS = [
@@ -61,10 +63,6 @@ type RunOutcome = {
   error: string | null
 }
 
-function truncateText(text: string, limit: number): string {
-  return text.length <= limit ? text : text.slice(0, limit) + '…[截断]'
-}
-
 /** 通知 body：硬截断（不带省略标记），精确 ≤ limit 字符 */
 function sliceText(text: string, limit: number): string {
   return text.slice(0, limit)
@@ -83,11 +81,16 @@ function firstLineText(text: string): string {
 async function lookupSource(
   sourceType: string,
   sourceId: string,
+  userId: string,
 ): Promise<Record<string, unknown> | null> {
+  // 审计 A4x-1 🟠：源条目必须落在调用者可访问的项目内——否则他人需求描述/堆栈/复现步骤
+  // 会被拼进 AI 提示词并经 resultSummary 回显（跨项目文本泄露）。上游可能已校验，
+  // 此处按「纵深防御」再收一次（源删除/无权限统一降级为「源条目已删除」提示）。
   if (sourceType === 'story') {
-    return prisma.story.findUnique({
+    const row = await prisma.story.findUnique({
       where: { id: sourceId },
       select: {
+        projectId: true,
         identifier: true,
         name: true,
         description: true,
@@ -97,11 +100,15 @@ async function lookupSource(
         project: { select: { name: true } },
       },
     })
+    if (!row || !(await isProjectMember(row.projectId, userId))) return null
+    const { projectId: _storyProjectId, ...rest } = row
+    return rest
   }
   if (sourceType === 'bug') {
-    return prisma.bug.findUnique({
+    const row = await prisma.bug.findUnique({
       where: { id: sourceId },
       select: {
+        projectId: true,
         identifier: true,
         title: true,
         severity: true,
@@ -112,11 +119,15 @@ async function lookupSource(
         story: { select: { name: true } },
       },
     })
+    if (!row || !(await isProjectMember(row.projectId, userId))) return null
+    const { projectId: _bugProjectId, ...rest } = row
+    return rest
   }
   if (sourceType === 'testcase') {
-    return prisma.testCase.findUnique({
+    const row = await prisma.testCase.findUnique({
       where: { id: sourceId },
       select: {
+        projectId: true,
         identifier: true,
         title: true,
         precondition: true,
@@ -124,12 +135,15 @@ async function lookupSource(
         type: true,
       },
     })
+    if (!row || !(await isProjectMember(row.projectId, userId))) return null
+    const { projectId: _testCaseProjectId, ...rest } = row
+    return rest
   }
   return null
 }
 
 /** 系统提示词组装：基础指令 + 项目名（有 projectId 时）+ 源上下文（源型时） */
-async function buildSystemPrompts(task: TaskInput): Promise<string[]> {
+async function buildSystemPrompts(task: TaskInput, userId: string): Promise<string[]> {
   const prompts = [
     '你是 AllBlue 的 AI 任务执行助手，正在无人值守地执行任务，过程中无法与用户交互。',
     '请独立完成任务指令：可使用提供的只读工具检索必要信息，完成后输出 markdown 格式的结果摘要。',
@@ -145,7 +159,7 @@ async function buildSystemPrompts(task: TaskInput): Promise<string[]> {
   }
 
   if (task.sourceType && task.sourceId) {
-    const row = await lookupSource(task.sourceType, task.sourceId)
+    const row = await lookupSource(task.sourceType, task.sourceId, userId)
     if (row) {
       // lookupSource 仅对三种合法 sourceType 返回非 null，此处断言安全
       prompts.push(buildSourceContextBlock(task.sourceType as TaskSource, row))
@@ -163,34 +177,42 @@ async function buildSystemPrompts(task: TaskInput): Promise<string[]> {
 async function runInstruction(opts: ExecuteAiTaskRunOptions): Promise<RunOutcome> {
   const { task, runId, userId } = opts
   try {
-    const systemPrompts = await buildSystemPrompts(task)
+    const systemPrompts = await buildSystemPrompts(task, userId)
 
     // ⚠️ 每次执行时读取（不得模块顶层求值）：测试经 env 注入短超时才生效
     const timeoutMs = Number(process.env.AI_TASK_TIMEOUT_MS) || DEFAULT_TIMEOUT_MS
 
-    const result = await Promise.race([
-      runChat(
-        [{ role: 'user', content: task.instruction }],
-        {
-          systemPrompts,
-          userId,
-          parentRunId: runId,
-          allowedTools: [...AI_TASK_ALLOWED_TOOLS],
-        },
-      ),
-      new Promise<never>((_, reject) => {
-        const timer = setTimeout(() => reject(new TaskTimeoutError(timeoutMs)), timeoutMs)
-        timer.unref?.()
-      }),
-    ])
-    return { status: 'completed', resultSummary: result, error: null }
+    // 超时 timer 成功/失败路径统一清理（审计 🟡）：原先仅 unref，成功路径
+    // timer 挂到进程级定时器队列。runChat 暂无 AbortSignal 入参，超时后
+    // LLM 流仍会跑完——彻底中止需 ai-gateway 侧扩展 signal，另行立项。
+    let timer: ReturnType<typeof setTimeout> | undefined
+    try {
+      const result = await Promise.race([
+        runChat(
+          [{ role: 'user', content: task.instruction }],
+          {
+            systemPrompts,
+            userId,
+            parentRunId: runId,
+            allowedTools: [...AI_TASK_ALLOWED_TOOLS],
+          },
+        ),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => reject(new TaskTimeoutError(timeoutMs)), timeoutMs)
+          timer.unref?.()
+        }),
+      ])
+      return { status: 'completed', resultSummary: result, error: null }
+    } finally {
+      if (timer) clearTimeout(timer)
+    }
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e)
     const isTimeout = e instanceof TaskTimeoutError
     return {
       status: isTimeout ? 'timeout' : 'failed',
       resultSummary: null,
-      error: truncateText(message, ERROR_LIMIT),
+      error: truncateWithMarker(message, ERROR_LIMIT),
     }
   }
 }

package/src/server/audit.ts

@@ -7,6 +7,9 @@ export interface AuditEntryInput {
   resourceId: string
   action: string
   metadata?: Record<string, unknown>
+  /** 请求上下文（serverFn 有 request 时透传，审计追溯用；缺省 null 维持旧口径） */
+  ip?: string | null
+  userAgent?: string | null
 }
 
 export async function auditLog(entry: AuditEntryInput): Promise<void> {
@@ -16,8 +19,8 @@ export async function auditLog(entry: AuditEntryInput): Promise<void> {
     await audit.log({
       ...entry,
       metadata: entry.metadata ?? {},
-      ip: null,
-      userAgent: null,
+      ip: entry.ip ?? null,
+      userAgent: entry.userAgent ?? null,
     })
   } catch (err) {
     console.error('[audit] 写入失败:', err instanceof Error ? err.message : String(err))

package/src/server/auth-helpers.ts

@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import type { Session, SessionUser } from '@/lib/session'
+
 export class UnauthorizedError extends Error {
   constructor(message: string = 'UNAUTHORIZED') {
     super(message)
@@ -22,7 +24,6 @@ export class UnauthorizedError extends Error {
     Object.setPrototypeOf(this, UnauthorizedError.prototype)
   }
 }
-
 export class ForbiddenError extends Error {
   constructor(message: string = 'FORBIDDEN') {
     super(message)
@@ -31,15 +32,36 @@ export class ForbiddenError extends Error {
   }
 }
 
-export async function requireAuth(request?: Request) {
+/** desktop guest 降级的 warn-once 标记（进程级） */
+let warnedDesktopGuest = false
+
+/**
+ * requireAuth 成功返回的会话形状：user 必在且 id 为 string（含 desktop guest）。
+ * 消费方直接写 `session.user.id`，无需非空断言
+ * （审计 A2x-3/4/7：`session.user!.id!` 全域 387 处机械替换的类型基础）。
+ */
+export type AuthedSession = Omit<Session, 'user'> & { user: SessionUser & { id: string } }
+
+export async function requireAuth(request?: Request): Promise<AuthedSession> {
   const { getCurrentSession } = await import('@/lib/session')
   const { isDesktopServer, buildGuestSession } = await import('@/server/desktop-guest')
   const session = await getCurrentSession(request)
   if (session?.user?.id) {
-    return session
+    // user.id 存在性已在此判定，收窄为 AuthedSession（唯一出口 cast，换取消费方全域免断言）
+    return session as AuthedSession
   }
   if (isDesktopServer()) {
-    return buildGuestSession()
+    // 审计修复：guest 降级不再完全静默——desktop 单机语义合法，但服务器部署
+    // 误设 DEPLOY_TARGET=desktop 时所有匿名请求都会变成共享 guest 身份
+    // （fail-open）。warn-once 留排查线索，不改变行为。
+    if (!warnedDesktopGuest) {
+      warnedDesktopGuest = true
+      console.warn(
+        `[requireAuth] DEPLOY_TARGET=desktop：未登录请求已发放共享 guest 会话（${request?.url ?? 'unknown'}）。` +
+          '若这是服务器/云端部署，请移除 DEPLOY_TARGET=desktop 以恢复鉴权。',
+      )
+    }
+    return buildGuestSession() as AuthedSession
   }
   const url = request?.url ?? 'unknown'
   console.warn(`[requireAuth] 未授权访问: ${url}`)
@@ -61,6 +83,17 @@ export async function requireUserInDb(userId: string) {
   }
 }
 
+/**
+ * requireAuth 的「只要 userId」薄封装——收敛各 serverFn 文件内重复的
+ * requireSessionUser 本地 helper（桌面端 guest session 语义与 requireAuth 一致）。
+ */
+export async function requireUserId(request?: Request): Promise<string> {
+  const session = await requireAuth(request)
+  const id = session.user?.id
+  if (!id) throw new UnauthorizedError()
+  return id
+}
+
 export async function requireAdmin(request?: Request) {
   const session = await requireAuth(request)
   const user = session.user

package/src/server/billing-email.ts

@@ -1,3 +1,7 @@
+// 计费 webhook 邮件链路：上游 routes/api/billing-webhook.ts 必须先经
+// getProService('billing').handleWebhookEvent(rawBody, signature) 完成 Creem
+// 签名校验（WebhookSignatureError → 400）后才调用本函数——本模块信任该前置，
+// 不重复验签。OSS 无 billing 服务时上游同 gate 拦截，本函数不会被触达。
 import { prisma } from '@allbluecn/database'
 import { sendTemplateEmail } from '@/server/email'
 
@@ -35,5 +39,9 @@ export async function sendBillingEmailForEvent(rawBody: string): Promise<void> {
         ? { planName: sub.plan.displayName, periodEnd, dashboardUrl: `${appUrl}/settings/billing` }
         : { planName: sub.plan.displayName, endDate: periodEnd, dashboardUrl: `${appUrl}/settings/billing` },
     })
-  } catch { /* 计费邮件失败不影响 webhook 200 */ }
+  } catch (err) {
+    // 计费邮件失败不影响 webhook 200，但不静默（留排查线索，与其他
+    // fire-and-forget 链路口径一致）
+    console.warn('[billing-email] 发送失败:', err instanceof Error ? err.message : String(err))
+  }
 }

package/src/server/bug/bug-permissions.ts

@@ -19,18 +19,12 @@
 // 独立模块而非复用 bug-crud 内部私有函数——serverFn 文件禁止非 createServerFn 导出
 // （同 bug-list-query.ts 先例）。
 import { getPrisma } from "@allbluecn/database/get-prisma";
+import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
 // 按 projectId 直判成员资格（bug-crud.ts 内私有函数的同名变体收编于此，供跨文件
 // 复用：BUG 设置页凭证/设置读写等无 bugId 入口的操作）；suspended 视同无权。
 export async function assertProjectMembership(projectId: string, userId: string): Promise<void> {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的 BUG");
-  }
+  await assertProjectMembershipShared(projectId, userId, "无权限操作该项目的 BUG");
 }
 
 // 反查 bug 所属项目后校验当前用户成员资格；返回 projectId 供调用方复用（免二次反查）
@@ -45,3 +39,16 @@ export async function assertBugProjectMember(bugId: string, userId: string): Pro
   await assertProjectMembership(bug.projectId, userId);
   return bug.projectId;
 }
+
+// 一次取用户可访问（有效成员，suspended 视同无权）的项目 id 集合——bug 域批量
+// 写操作（bulk link/unlink、reorder）的统一可见圈。此前在 bug-story-bulk /
+// bug-reorder / testcase-bulk 三处逐字重复，口径易漂移（如某处漏 suspended
+// 过滤即权限分裂），收敛于此（testcase 域后续批次对齐）。
+export async function getAccessibleProjectIds(userId: string): Promise<string[]> {
+  const prisma = await getPrisma();
+  const rows = await prisma.projectMember.findMany({
+    where: { userId, status: { not: "suspended" } },
+    select: { projectId: true },
+  });
+  return rows.map((r) => r.projectId);
+}

package/src/server/bug-collect/collect-handler.ts

@@ -22,7 +22,14 @@
 // prisma 一律走 getPrisma() 惰性获取（同 serverFns 惯例），禁止顶层 import { prisma }。
 import { getPrisma } from "@allbluecn/database/get-prisma";
 import type { Prisma } from "@allbluecn/database";
+import { getClientIp } from "@allbluecn/kernel";
 import { checkRateLimit } from "@/server/lib/rate-limit";
+import { detectImageMime } from "@/server/lib/image-magic";
+import {
+  allocateBugSequence,
+  buildBugPrefix,
+} from "@/server/lib/bug-sequence";
+import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
 import { hashToken, isValidTokenFormat } from "@/server/bug-report/tokens";
 import type { BugSeverity } from "@/shared/bug/constants";
 
@@ -125,8 +132,12 @@ function parseReproduceSteps(
   return { steps: lines.map((action, i) => ({ order: i + 1, action })) };
 }
 
-const isRecord = (v: unknown): v is Record<string, unknown> =>
-  typeof v === "object" && v !== null;
+/** 匿名限流 key 的客户端 IP：走 kernel getClientIp（CF-Connecting-IP /
+ * X-Real-IP / XFF 末段的可信代理口径），禁止直取原始 XFF 整串——客户端
+ * 伪造不同 XFF 即得全新限流桶。取不到回落 unknown（共享一桶，fail-closed）。 */
+export function rateLimitIpOf(request: Request): string {
+  return getClientIp(request) ?? "unknown";
+}
 
 /**
  * 收集提交完整链（§9 顺序：限流 → token → honeypot → 建单）。
@@ -167,38 +178,36 @@ export async function submitCollectedBug(params: {
   // Bug.createdById 必填 FK：登录落 reporter，匿名落项目 owner（活动流 actorType 区分）
   const creatorId = sessionUserId ?? project.ownerId;
 
-  // ── 截图 blob 归属校验：上传端点以项目 owner 落 Blob.userId，此处防跨项目/他人 blobId 注入 ──
+  // ── 截图 blob 归属校验：上传端点以项目 owner 落 Blob.userId，此处防跨项目/他人 blobId 注入。
+  // 追加 24h 时间窗：blob 必须是近期上传产物——同 owner 名下其他项目的历史 blob
+  // id（需猜中 cuid）即使满足归属校验也不再可挂进本项目事件快照。 ──
   const blobIds = input.screenshotBlobIds ?? [];
   if (blobIds.length > 0) {
     const blobs = await prisma.blob.findMany({
-      where: { id: { in: blobIds } },
-      select: { id: true, userId: true },
+      where: {
+        id: { in: blobIds },
+        userId: project.ownerId,
+        createdAt: { gte: new Date(Date.now() - 24 * 60 * 60_000) },
+      },
+      select: { id: true },
     });
-    const owned = new Set(blobs.filter((b) => b.userId === project.ownerId).map((b) => b.id));
-    if (owned.size !== blobIds.length) return { ok: false, reason: "invalid_screenshots" };
+    if (blobs.length !== blobIds.length) return { ok: false, reason: "invalid_screenshots" };
   }
 
   const reproduceSteps = parseReproduceSteps(input.reproduceSteps);
   const severity = input.severity ?? "medium";
 
-  // ── 建单（事务发号 + identifier 撞号重试，照 bug-crud.ts）──
-  for (let attempt = 0; attempt < 5; attempt++) {
-    try {
-      const bug = await prisma.$transaction(async (tx) => {
-        const counter = await tx.sequenceCounter.upsert({
-          where: { scope: `bug:${project.id}` },
-          create: { scope: `bug:${project.id}`, seq: 1 },
-          update: { seq: { increment: 1 } },
-        });
-        const prefix =
-          (project.displayId ?? project.name ?? "")
-            .replace(/[^a-zA-Z0-9]/g, "")
-            .toUpperCase() || "PRJ";
+  // ── 建单（事务发号 + identifier 撞号重试，发号语义单源在 lib/bug-sequence）──
+  const prefix = buildBugPrefix(project.displayId, project.name);
+  return withSequenceNumberRetry(
+    () =>
+      prisma.$transaction(async (tx) => {
+        const { seq, identifier } = await allocateBugSequence(tx, project.id, prefix);
 
         const created = await tx.bug.create({
           data: {
-            sequenceId: counter.seq,
-            identifier: `${prefix}-B${counter.seq}`,
+            sequenceId: seq,
+            identifier,
             projectId: project.id,
             title: input.title,
             description: input.description ?? null,
@@ -237,24 +246,16 @@ export async function submitCollectedBug(params: {
         });
 
         return created;
-      });
-
-      // lastUsedAt fire-and-forget（不阻塞响应）
-      void prisma.projectAccessToken
-        .update({ where: { id: token.id }, data: { lastUsedAt: new Date() } })
-        .catch(() => {});
-
-      return { ok: true, bugId: bug.id, identifier: bug.identifier };
-    } catch (e: unknown) {
-      const err = isRecord(e) ? e : {};
-      const code = typeof err.code === "string" ? err.code : undefined;
-      const target = isRecord(err.meta) && Array.isArray(err.meta.target) ? err.meta.target : [];
-      // 并发发号撞 identifier（P2002）取新 seq 重试；其余照常抛出
-      if (code === "P2002" && target.includes("identifier") && attempt < 4) continue;
-      throw e;
-    }
-  }
-  throw new Error("创建 BUG 失败：编号冲突，请重试");
+      }),
+    { exhaustedMessage: "创建 BUG 失败：编号冲突，请重试" },
+  ).then((bug) => {
+    // lastUsedAt fire-and-forget（不阻塞响应）
+    void prisma.projectAccessToken
+      .update({ where: { id: token.id }, data: { lastUsedAt: new Date() } })
+      .catch(() => {});
+
+    return { ok: true, bugId: bug.id, identifier: bug.identifier } as const;
+  });
 }
 
 // ── 截图上传端点（POST /api/bugs/collect-upload，§9）──
@@ -279,7 +280,9 @@ export async function handleCollectUpload(request: Request): Promise<Response> {
   const token = await resolveCollectToken(key);
   if (!token) return json({ error: "invalid_token" }, 401);
 
-  const ip = request.headers.get("x-forwarded-for") ?? "unknown";
+  // 审计修复：改用 kernel getClientIp（可信代理口径），原始 XFF 整串可被
+  // 客户端逐请求伪造 → 全新限流桶，20×5MB/15min 名存实亡
+  const ip = rateLimitIpOf(request);
   const limit = checkRateLimit(`bug-collect-upload:${ip}`, { ...COLLECT_UPLOAD_RATE_LIMIT });
   if (!limit.allowed) {
     return json(
@@ -298,6 +301,7 @@ export async function handleCollectUpload(request: Request): Promise<Response> {
   const files = formData.getAll("files").filter(isUploadFile);
   if (files.length === 0) return json({ error: "no_files" }, 400);
   if (files.length > MAX_COLLECT_SCREENSHOTS) return json({ error: "too_many_files" }, 400);
+  // 声明大小前置防线（读 buffer 之前拒绝，省一次大文件读取）
   for (const file of files) {
     if (!ALLOWED_SCREENSHOT_MIME.has(file.type)) return json({ error: "unsupported_type" }, 415);
     if (file.size > MAX_SCREENSHOT_BYTES) return json({ error: "file_too_large" }, 413);
@@ -310,19 +314,29 @@ export async function handleCollectUpload(request: Request): Promise<Response> {
   });
   if (!project) return json({ error: "invalid_token" }, 401);
 
+  // file 字节全部预读完成后才做魔数复检/写入：失败路径 0 写入。MIME 声明值之外
+  // 加魔数复检（审计 🟡）：任意字节流改名 image/png 不再入库经截图代理回显。
+  const prepared = await Promise.all(
+    files.map(async (file) => ({
+      declared: file.type,
+      bytes: new Uint8Array(await file.arrayBuffer()),
+    })),
+  );
+  for (const item of prepared) {
+    if (detectImageMime(item.bytes) !== item.declared) {
+      return json({ error: "unsupported_type" }, 415);
+    }
+  }
+
   // DB-06：逐文件 blob.create（N 次往返，bytes 大字段）改单次 createManyAndReturn
   // 批量写并取回自增 id（MAX_COLLECT_SCREENSHOTS=3 上限内单批即可，无需分批）。
-  // file 字节全部预读完成后才批量写入：失败路径 0 写入，优于原实现的
-  // 逐文件「读→写」交错（中途失败会留下部分已写 blob）。
   const blobRows = await prisma.blob.createManyAndReturn({
-    data: await Promise.all(
-      files.map(async (file) => ({
-        mimeType: file.type,
-        bytes: Uint8Array.from(Buffer.from(await file.arrayBuffer())),
-        size: file.size,
-        userId: project.ownerId,
-      })),
-    ),
+    data: prepared.map((item) => ({
+      mimeType: item.declared,
+      bytes: item.bytes,
+      size: item.bytes.byteLength,
+      userId: project.ownerId,
+    })),
     select: { id: true },
   });
   const blobIds = blobRows.map((row) => row.id);